# Remove vendors from a group

Removes one or more vendors from a vendor group in the caller's directory and returns the group's resulting state, scoped server-side to the caller's organization. Requires an Idempotency-Key header (enforced at the gateway); a vendor id not currently a member is a no-op rather than an error. Capped at 500 vendor_ids per call. Does not offboard or delete the vendor itself.

Endpoint: POST /public/v1/vendors/groups/{id}/vendors:remove
Version: Beta

## Path parameters:

  - `id` (string, required)
    Vendor group to remove members from (bound from the {id} path parameter).

## Request fields (application/json):

  - `vendorIds` (array, required)
    Vendor ids to remove. Required, non-empty, capped at 500 per call. A vendor
that isn't currently a member is a no-op, not an error.

## Response 200:

  - `200` (unknown)
    A successful response.

## Response 200 fields (application/json):

  - `vendorGroup` (object, required)
    A vendor group in the caller's vendor directory, curated for public API consumers.
A vendor group is the customer's own named collection over the third parties they
track (e.g. by business unit or risk tier).

  - `vendorGroup.id` (string, required)
    Server-generated unique identifier of the group. Pass this back when addressing
a specific group.

  - `vendorGroup.name` (string, required)
    Human-readable display name of the group; unique within the caller's organization.

  - `vendorGroup.description` (string)
    Free-text description of the group. Absent when never set, which is
distinguishable from an explicitly empty description.

  - `vendorGroup.memberCount` (string, required)
    Number of vendors currently in this group. Maintained by the service and
read-only on this surface.

  - `vendorGroup.createdAt` (string, required)
    Time the group was created.

  - `vendorGroup.updatedAt` (string, required)
    Time the group's metadata was last updated.

## Response 400:

  - `400` (unknown)
    INVALID_ARGUMENT: vendor_ids is empty or exceeds the 500-entry cap, or the group id is missing or not a valid identifier.

## Response 401:

  - `401` (unknown)
    UNAUTHENTICATED: access token is absent, malformed, or missing the required organization claim.

## Response 403:

  - `403` (unknown)
    PERMISSION_DENIED: access token does not include the vendor-directory.write scope.

## Response 404:

  - `404` (unknown)
    NOT_FOUND: the group id does not exist in the caller's organization, or one of the vendor_ids does not exist within the caller's organization.

## Response default:

  - `default` (unknown)
    An unexpected error response.

## Response default fields (application/json):

  - `code` (integer, required)
    The status code, which should be an enum value of
[google.rpc.Code][google.rpc.Code].

  - `message` (string, required)
    A developer-facing error message, which should be in English. Any
user-facing error message should be localized and sent in the
[google.rpc.Status.details][google.rpc.Status.details] field, or localized
by the client.

  - `details` (array, required)
    A list of messages that carry the error details.  There is a common set of
message types for APIs to use.

  - `details.@type` (string)
    A URL/resource name that uniquely identifies the type of the serialized
protocol buffer message. This string must contain at least
one "/" character. The last segment of the URL's path must represent
the fully qualified name of the type (as in
`path/google.protobuf.Duration`). The name should be in a canonical form
(e.g., leading "." is not accepted).
In practice, teams usually precompile into the binary all types that they
expect it to use in the context of Any. However, for URLs which use the
scheme `http`, `https`, or no scheme, one can optionally set up a type
server that maps type URLs to message definitions as follows:
* If no scheme is provided, `https` is assumed.
* An HTTP GET on the URL must yield a [google.protobuf.Type][]
value in binary format, or produce an error.
* Applications are allowed to cache lookup results based on the
URL, or have them precompiled into a binary to avoid any
lookup. Therefore, binary compatibility needs to be preserved
on changes to types. (Use versioned type names to manage
breaking changes.)

Note: this functionality is not currently available in the official
protobuf release, and it is not used for type URLs beginning with
type.googleapis.com. As of May 2023, there are no widely used type server
implementations and no plans to implement one.
Schemes other than `http`, `https` (or the empty scheme) might be
used with implementation specific semantics.