Operates on Vendors. In the Zuper client app this module is labeled "Vendor" for most companies, and "Supplier" for companies in the roofing industry — the API and data shape are identical either way. Vendors and Subcontractors share the exact same underlying schema and endpoints; they're distinguished only by the vendor_type field (VENDOR here) and the /vendors vs /subcontractors route prefix. Vendor catalog rows record which products a vendor supplies, at what cost. This sub-resource exists only under /vendors — there is no /subcontractors/:uid/catalog route, even though the underlying schema and controller don't discriminate by vendor_type at all. Either filter.product or filter.vendor is required unless group_by is set.