{
    "$schema": "https://json-schema.org/draft/2020-12/schema",
    "$id": "https://vendorapp.co/openvmo/templates/openvmo-register.schema.json",
    "title": "OpenVMO vendor register entry, v1.0",
    "description": "One vendor in an OpenVMO register. Fields without a level note are required at Level 1; others become expected at the level shown. Licence: CC0 1.0. https://vendorapp.co/openvmo/inventory/",
    "type": "object",
    "required": ["vendor_id", "legal_name", "domain", "country", "service_description", "business_owner", "lifecycle_state", "tier", "tier_rationale", "data_categories", "access_type"],
    "properties": {
        "vendor_id": { "type": "string", "description": "Stable internal ID." },
        "legal_name": { "type": "string" },
        "trading_name": { "type": "string" },
        "domain": { "type": "string", "description": "Primary website domain." },
        "country": { "type": "string", "pattern": "^[A-Z]{2}$", "description": "ISO 3166-1 alpha-2 country code." },
        "service_description": { "type": "string", "description": "What the vendor is used for, in plain words." },
        "business_owner": { "type": "string", "description": "Named person who answers for the relationship (GOV-2)." },
        "lifecycle_state": { "enum": ["proposed", "active", "suspended", "offboarding", "offboarded"], "description": "INV-4." },
        "tier": { "enum": [1, 2, 3], "description": "From the OpenVMO tiering rubric (TIER-1)." },
        "tier_rationale": {
            "type": "object",
            "description": "The tiering rubric answers, each the tier that question produced.",
            "properties": {
                "q1_data": { "enum": [1, 2, 3] },
                "q2_access": { "enum": [1, 2, 3] },
                "q3_impact": { "enum": [1, 2, 3] },
                "q4_customer_facing": { "enum": [1, 3] },
                "q5_regulatory": { "enum": [1, 3] }
            }
        },
        "data_categories": {
            "type": "array",
            "items": { "enum": ["none", "internal", "confidential", "personal", "special_category", "customer_production"] }
        },
        "access_type": {
            "type": "array",
            "items": { "enum": ["none", "sso_user", "admin", "api_integration", "network", "physical"] }
        },
        "contract_ref": { "type": "string", "format": "uri", "description": "CON-1." },
        "renewal_date": { "type": "string", "format": "date", "description": "CON-2." },
        "notice_period_days": { "type": "integer", "minimum": 0, "description": "CON-2." },
        "annual_spend": {
            "type": "object",
            "properties": { "amount": { "type": "number" }, "currency": { "type": "string", "pattern": "^[A-Z]{3}$" } }
        },
        "dpa_in_place": { "type": "boolean", "description": "Level 2. Required when the vendor processes personal data (DD-3)." },
        "assurance": {
            "type": "array",
            "description": "Level 2 (DD-2, MON-2).",
            "items": {
                "type": "object",
                "properties": {
                    "type": { "enum": ["soc2_t2", "soc2_t1", "iso27001", "mvsp", "csa_star", "cyber_essentials_plus", "questionnaire", "other"] },
                    "issuer": { "type": "string" },
                    "ref": { "type": "string" },
                    "expiry": { "type": "string", "format": "date" },
                    "verified_at": { "type": "string", "format": "date" }
                }
            }
        },
        "last_review_date": { "type": "string", "format": "date", "description": "Level 2 (MON-1)." },
        "next_review_due": { "type": "string", "format": "date", "description": "Level 2 (MON-1)." },
        "open_risks": {
            "type": "array",
            "description": "Level 2 (DD-4, CON-4).",
            "items": {
                "type": "object",
                "properties": {
                    "id": { "type": "string" },
                    "description": { "type": "string" },
                    "owner": { "type": "string" },
                    "accepted_until": { "type": "string", "format": "date" }
                }
            }
        },
        "subprocessors": {
            "type": "array",
            "description": "Level 2 for Tier 1 vendors (FP-1).",
            "items": {
                "type": "object",
                "properties": {
                    "name": { "type": "string" },
                    "purpose": { "type": "string" },
                    "location": { "type": "string" },
                    "source_url": { "type": "string", "format": "uri" },
                    "as_of": { "type": "string", "format": "date" }
                }
            }
        },
        "supports_critical_function": { "type": "boolean", "description": "Level 3 (TIER-3). Maps to DORA and EBA critical or important functions." },
        "exit_plan_ref": { "type": "string", "format": "uri", "description": "Level 3 (EXIT-2)." },
        "offboarded_at": { "type": "string", "format": "date" },
        "offboarding_reason": { "type": "string" },
        "offboarding_evidence": {
            "type": "object",
            "description": "EXIT-1.",
            "properties": {
                "access_revoked_at": { "type": "string", "format": "date" },
                "data_deletion_confirmed_at": { "type": "string", "format": "date" },
                "evidence_ref": { "type": "string", "format": "uri" }
            }
        }
    }
}