> ## Documentation Index
> Fetch the complete documentation index at: https://support.configview.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Viso Trust setup

ConfigView pulls your third-party risk inventory from **Viso Trust** through a single API token — the vendor relationships you track, their risk ratings, and the assessments run against them.

You will end up with **1 secret** in ConfigView (`VISO_API_TOKEN`) when setup is complete.

***

## Step 1: Create the Viso Trust API token

1. Sign in to [Viso Trust](https://app.visotrust.com/) as an administrator
2. Open your organization's **Settings** → **API** section
3. Generate a new API token and name it `ConfigView`
4. Copy the token — it is shown once

> If you cannot find the API section, the capability may not be enabled on your Viso Trust plan. Ask your Viso Trust customer success contact to enable API access before continuing.

***

## Step 2: Add the secret to ConfigView

1. Go to your ConfigView dashboard: `https://{companyname}.configview.com/admin/integrations/viso`
2. Under **Credentials**, enter each value and click the save icon on its row:
3. **Secret name:** `VISO_API_TOKEN`
4. **Secret value:** Paste the token from Step 1

***

## Step 3: Enable the Viso Trust scripts in ConfigView

1. Go to: `https://{companyname}.configview.com/admin/integrations/viso`
2. Click **Connect**. ConfigView creates its tables and schedules every collector at your default run time.
3. The collectors it will start running — stop any you do not want under **Collectors**:
4. Click **Verify now** to confirm the credentials work.

| Script                       | Notes                                                                                                                                   |
| ---------------------------- | --------------------------------------------------------------------------------------------------------------------------------------- |
| **Relationships**            | Every vendor relationship — name, status, inherent and residual risk, business owner, business unit. Start here; the rest depend on it. |
| **Relationships Details**    | The full record for each relationship, fetched one at a time. **Depends on Relationships.**                                             |
| **Relationship Assessments** | Assessments attached to each relationship — type, dates, who sent it, risk thresholds. **Depends on Relationships Details.**            |
| **Data Types**               | The catalogue of data classifications Viso Trust uses (name and description).                                                           |

> **Note:** Relationships Details depends on Relationships, and Relationship Assessments depends on Relationships Details. ConfigView wires these dependencies automatically — parent scripts always run first.

***

## Step 4: Verify

1. Go to: `https://{companyname}.configview.com/admin/integrations/viso`
2. Click **Verify now** to confirm the credentials work.

If a check fails:

* **`401` / `403`** — The token was revoked or copied incorrectly. Reissue from Step 1 and update the `VISO_API_TOKEN` secret.
* **Authenticates but `Relationships` returns nothing** — The token is valid but scoped to a user or organization with no vendor relationships visible. Check which account issued it.

***

## Data Tables

Once the scripts run, the corresponding tables are created in your database. All tables include a `run_at` column for historical tracking.

| Table                           | Source                           | Key Columns                                                                                                                                                  |
| ------------------------------- | -------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `viso_relationships`            | `GET /api/v1/relationships`      | relationship\_id, name, description, homepage, status, inherentRisk, residualRisk, isTransitional, businessUnit, businessOwner\_\*, createdDate, updatedDate |
| `viso_relationships_details`    | `GET /api/v1/relationships/{id}` | same shape as `viso_relationships`, populated per relationship                                                                                               |
| `viso_relationship_assessments` | `GET /api/v1/assessments/{id}`   | assessment\_id, assessmentType, createdDate, completedDate, expirationDate, phaseDate, followupType, followupRiskThreshold, sentBy\_\*                       |
| `viso_data_types`               | `GET /api/v1/data-types`         | name, description                                                                                                                                            |

***

## Things worth knowing

**Business cases are not collected.** Viso Trust publishes a `/api/v1/business-cases` endpoint, but ConfigView does not currently ingest it. A "Business Case" script existed previously and was removed in August 2026 — it was a mislabelled copy of Data Types that called the same endpoint and wrote the same table, so it duplicated rows rather than adding anything. If business-case data would be useful to you, mention it to your ConfigView contact; the endpoint is there, the collector simply has not been written.

**`inherentRisk` and `residualRisk` are different questions.** Inherent risk is the exposure before controls; residual is what remains after Viso Trust accounts for the vendor's answers. Reporting on the wrong one will systematically overstate or understate your position — decide which one your risk register means before building queries on it.

**Details and Assessments are per-relationship calls.** Each runs one API request per parent record, so their runtime scales with how many vendors you track. If you have hundreds of relationships, expect these two to take meaningfully longer than the list call and schedule them accordingly.

**Assessment dates are the useful part.** `expirationDate` against `completedDate` is what answers "which vendor reviews have lapsed" — the single most common thing people want this data for.