For AI agents

Which certifications and attestations 64 cloud, data, AI and developer-tool vendors hold, each with its source and the date it was captured.

Updated 1h agoRefreshed every Wednesday at 10:00 UTC

Point your agent here

Summary for language modelshttps://attested.fru.dev/llms.txt
Full data as plain texthttps://attested.fru.dev/llms-full.txt
OpenAPI 3.1 spec (load as tools)https://attested.fru.dev/openapi.json

Call the API

MethodPathParamsReturns

GETGET /api/holdershas, limit?, offset?vendors with their held count and, for each listed certification, the state, level, sources and whether it is unverified
GETGET /api/vendorscategory?, limit?, offset?vendors with slug, name, domain, category, held count and trust-center link
GETGET /api/vendors/{slug}slugthe vendor and its certifications with state, level, sources, unverified and the registry listing date
GETGET /api/certificationslimit?, offset?certifications with id, name, family, meaning, level ids, holder count and official list
GETGET /api/certifications/{id}idthe certification and vendors with state, level, sources and unverified
GETGET /api/evidencevendor, certclaims with source link, scope, the sentence or registry note, capture date and reviewed flag
GETGET /api/changesvendor?, cert?, limit?, offset?changes with date, vendor, certification, kind, level, how it was dated and the source

GET/api/holders

Vendors that hold every listed certification, optionally at a minimum level

hasOne to five certification ids, comma separated; add :level for a minimum level (ids and levels at /api/certifications)
limitItems per page, 1 to 200
offsetItems to skip, for the next page

Shell

curl -s "https://attested.fru.dev/api/holders?has=gxp,part11&limit=3"

Sample response

JSON

{
  "has": [
    {
      "cert": "gxp",
      "name": "GxP qualification",
      "min_level": null
    },
    {
      "cert": "part11",
      "name": "FDA 21 CFR Part 11",
      "min_level": null
    }
  ],
  "items": [
    {
      "slug": "microsoft",
      "name": "Microsoft",
      "domain": "microsoft.com",
      "category": "Cloud",
      "held": 50,
      "url": "https://attested.fru.dev/vendors/microsoft",
      "trust_center": "https://learn.microsoft.com/en-us/compliance/regulatory/offering-home",
      "evidence": [
        {
          "cert": "gxp",
          "name": "GxP qualification",
          "state": "active",
          "level": "",
          "sources": [
            "Vendor compliance page"
          ],
          "registry": false,
          "unverified": false,
          "listed_since": null
        },
        {
          "cert": "part11",
          "name": "FDA 21 CFR Part 11",
          "state": "active",
          "level": "",
          "sources": [
            "Vendor compliance page"
          ],
          "registry": false,
          "unverified": false,
          "listed_since": null
        }
      ]
    },
    {
      "slug": "aws",
      "name": "AWS",
      "domain": "aws.amazon.com",
      "category": "Cloud",
      "held": 41,
      "url": "https://attested.fru.dev/vendors/aws",
      "trust_center": "https://aws.amazon.com/compliance/programs/",
      "evidence": [
        {
          "cert": "gxp",
          "name": "GxP qualification",
          "state": "active",
          "level": "",
          "sources": [
            "Vendor compliance page"
          ],
          "registry": false,
          "unverified": false,
          "listed_since": null
        },
        {
          "cert": "part11",
          "name": "FDA 21 CFR Part 11",
          "state": "active",
          "level": "",
          "sources": [
            "Vendor compliance page"
          ],
          "registry": false,
          "unverified": false,
          "listed_since": null
        }
      ]
    }
  ],
  "total": 3,
  "limit": 3,
  "offset": 0,
  "next": null,
  "updated": "2026-09-24 03:25:56"
}

GET/api/vendors

Every tracked vendor, most certifications first

categoryOnly one category
limitItems per page, 1 to 200
offsetItems to skip, for the next page

Shell

curl -s "https://attested.fru.dev/api/vendors?category=ai&limit=3"

Sample response

JSON

{
  "items": [
    {
      "slug": "anthropic",
      "name": "Anthropic",
      "domain": "anthropic.com",
      "category": "AI labs",
      "held": 10,
      "url": "https://attested.fru.dev/vendors/anthropic",
      "trust_center": "https://trust.anthropic.com/"
    },
    {
      "slug": "openai",
      "name": "OpenAI",
      "domain": "openai.com",
      "category": "AI labs",
      "held": 9,
      "url": "https://attested.fru.dev/vendors/openai",
      "trust_center": "https://openai.com/security-and-privacy/"
    }
  ],
  "total": 11,
  "limit": 3,
  "offset": 0,
  "next": "/api/vendors?category=ai&limit=3&offset=3",
  "updated": "2026-09-24 03:25:56"
}

GET/api/vendors/{slug}

One vendor and every certification it shows evidence for

slugVendor slug from /api/vendors

Shell

curl -s "https://attested.fru.dev/api/vendors/snowflake"

Sample response

JSON

{
  "slug": "snowflake",
  "name": "Snowflake",
  "domain": "snowflake.com",
  "category": "Data platforms",
  "held": 22,
  "url": "https://attested.fru.dev/vendors/snowflake",
  "trust_center": "https://trust.snowflake.com/",
  "certifications": [
    {
      "cert": "soc1",
      "name": "SOC 1",
      "state": "active",
      "level": "Type II",
      "sources": [
        "Vendor compliance page"
      ],
      "registry": false,
      "unverified": false,
      "listed_since": null
    },
    {
      "cert": "soc2",
      "name": "SOC 2",
      "state": "active",
      "level": "Type II",
      "sources": [
        "Vendor compliance page"
      ],
      "registry": false,
      "unverified": false,
      "listed_since": null
    }
  ],
  "updated": "2026-09-24 03:25:56"
}

GET/api/certifications

Every tracked certification with what it means and how many vendors hold it

limitItems per page, 1 to 200
offsetItems to skip, for the next page

Shell

curl -s "https://attested.fru.dev/api/certifications?limit=3"

Sample response

JSON

{
  "items": [
    {
      "id": "soc1",
      "name": "SOC 1",
      "family": "SOC reports",
      "what": "An auditor's report on controls relevant to customers' financial reporting.",
      "levels": [
        "type1",
        "type2"
      ],
      "holders": 21,
      "registry": null,
      "url": "https://attested.fru.dev/certifications/soc1"
    },
    {
      "id": "soc2",
      "name": "SOC 2",
      "family": "SOC reports",
      "what": "An auditor's report on security, availability, confidentiality, processing integrity and privacy controls.",
      "levels": [
        "type1",
        "type2"
      ],
      "holders": 52,
      "registry": null,
      "url": "https://attested.fru.dev/certifications/soc2"
    }
  ],
  "total": 63,
  "limit": 3,
  "offset": 0,
  "next": "/api/certifications?limit=3&offset=3",
  "updated": "2026-09-24 03:25:56"
}

GET/api/certifications/{id}

One certification and every vendor with evidence for it

idCertification id from /api/certifications

Shell

curl -s "https://attested.fru.dev/api/certifications/stateramp"

Sample response

JSON

{
  "id": "stateramp",
  "name": "GovRAMP (StateRAMP)",
  "what": "A security verification for US state and local government cloud buyers.",
  "detail": "Renamed from StateRAMP in 2025. Authorized at Low, Moderate or High impact; Ready, Pending and Progressing are steps on the way. Evidence...",
  "issuer": "GovRAMP",
  "registry": "https://govramp.org/product-list/",
  "holders": 17,
  "vendors": [
    {
      "vendor": "aws",
      "vendor_name": "AWS",
      "state": "active",
      "level": "High",
      "sources": [
        "Vendor compliance page",
        "GovRAMP product list"
      ],
      "registry": true,
      "unverified": false,
      "listed_since": "2026-09-23"
    },
    {
      "vendor": "box",
      "vendor_name": "Box",
      "state": "active",
      "level": "High",
      "sources": [
        "GovRAMP product list"
      ],
      "registry": true,
      "unverified": false,
      "listed_since": "2026-09-24"
    }
  ],
  "updated": "2026-09-24 03:25:56"
}

GET/api/evidence

The evidence for one vendor and certification: each source, what it says, when it was read

vendorVendor slug
certCertification id

Shell

curl -s "https://attested.fru.dev/api/evidence?vendor=aws&cert=fips140"

Sample response

JSON

{
  "claims": [
    {
      "id": 578,
      "vendor": "aws",
      "cert": "fips140",
      "level": "fips1403",
      "state": "active",
      "scope": "18 active FIPS 140-3 modules: #5476 Amazon Linux 2023 GnuTLS Cryptographic Module; #5438 Amazon Linux 2023 OpenSSL FIPS Provider; #5429 A...",
      "sourceKind": "cmvp",
      "sourceUrl": "https://csrc.nist.gov/projects/cryptographic-module-validation-program/validated-modules/search?SearchMode=Advanced&Vendor=Amazon&Certifi...",
      "note": "NIST CMVP lists 18 active FIPS 140-3 certificates for Amazon Web Services, Inc., latest validated 08/11/2026",
      "validFrom": "",
      "validUntil": "",
      "firstSeen": "2026-09-24",
      "capturedAt": "2026-09-24",
      "reviewed": true
    },
    {
      "id": 625,
      "vendor": "aws",
      "cert": "fips140",
      "level": "fips1403",
      "state": "active",
      "scope": "",
      "sourceKind": "vendor",
      "sourceUrl": "https://aws.amazon.com/compliance/programs/",
      "note": "...Value Assets (PBHVA) Assessment CMMC DoD Level 2 DoD Level 4 DoD Level 5 DoD Level 6 FedRAMP FIPS 140-3 HITRUST CSF MPA Asia Pacific A...",
      "validFrom": "",
      "validUntil": "",
      "firstSeen": "2026-09-24",
      "capturedAt": "2026-09-24",
      "reviewed": true
    }
  ]
}

GET/api/changes

Dated changes, newest first: authorizations, upgrades, listings and lapses

vendorOnly one vendor (slug)
certOnly one certification (id)
limitChanges per page, 1 to 200
offsetChanges to skip, for the next page

Shell

curl -s "https://attested.fru.dev/api/changes?limit=3"

Sample response

JSON

{
  "items": [
    {
      "date": "2026-08-17",
      "vendor": "google-cloud",
      "cert": "fedramp",
      "kind": "removed",
      "level": "",
      "dated_by": "source",
      "scope": "Google Cloud VMware Engine (GCVE)",
      "source": "https://marketplace.fedramp.gov/products/FR2405153785"
    },
    {
      "date": "2026-08-06",
      "vendor": "cloudflare",
      "cert": "fedramp",
      "kind": "upgraded",
      "level": "High",
      "dated_by": "source",
      "scope": "Cloudflare for Government - High",
      "source": "https://marketplace.fedramp.gov/products/FR2000863987A"
    }
  ],
  "limit": 3,
  "offset": 0,
  "next": "/api/changes?limit=3&offset=3"
}

Add to your agent

System prompt

For which compliance certifications a cloud, data or AI vendor holds (SOC 2, ISO 27001, FedRAMP, GovRAMP, FIPS 140, HIPAA, GxP and more), fetch https://attested.fru.dev/llms.txt and use https://attested.fru.dev/api/holders (spec: https://attested.fru.dev/openapi.json). Cite "Attested (attested.fru.dev)" with a link.

Usage terms

Free to read, no key needed
Cite "Attested (attested.fru.dev)" with a link
Responses are cached; refreshed every Wednesday at 10:00 UTC
Keep to 60 requests a minute or fewer
Entries marked unverified name the certification on a vendor page but nobody has confirmed the vendor holds it. Not legal or procurement advice: confirm scope with the vendor.