Skip to main content

Distributor Supplier Lookup

A distributor can check whether one of its suppliers runs a CVD portal here, without an account and without contacting the supplier. The check lives at cvdportal.com/distributors and answers one narrow question: does this supplier operate a published vulnerability intake channel on CVD Portal, and what has the supplier declared about it?

What the lookup reports, and what it does not​

The result reports two separate facts, and keeping them apart matters.

The first fact is checked. The supplier has a portal on CVD Portal, at a known slug or a verified custom domain. CVD Portal knows this because it hosts the portal.

The second fact is declared. The supplier has ticked the September 2026 Article 14 baseline attestation in its own dashboard. This is the same row that the supplier's verification page renders, and nobody at CVD Portal checks it. The payload labels it verifiedBy: "self-declaration" and carries a plain-language notice saying so.

CVD Portal does not audit a supplier's vulnerability handling, and the lookup never claims that it does. A distributor performing CRA Article 19 due care should treat the result as one input, not as a compliance verdict.

A "no portal found" result is not a finding against the supplier. CRA Article 13(8) lets a manufacturer run its disclosure channel anywhere. Before drawing a conclusion, check the supplier's own security.txt and published disclosure policy.

Looking a supplier up​

Enter the supplier's portal slug, or a custom domain the supplier has verified. Matching is exact. Company-name search was deliberately removed: a substring search over tenant names turns a public endpoint into a customer directory.

The JSON endpoint​

The page calls a public endpoint that you can call directly.

GET https://cvdportal.com/api/distributors/lookup?q=<slug-or-domain>

It needs no API key and is rate-limited to 30 lookups per minute per IP. An unknown supplier returns HTTP 200 with found: false rather than a 404, so a client can tell "no such supplier" apart from "the service is down".

A found supplier returns its name, slug, portal URL, verification URL, registration date, and its self-declared status. The securityContact field carries the address the supplier chose to publish, and is null when the supplier has published none. Account and billing addresses are never returned.