{ "openapi": "3.1.0", "info": { "title": "Attested API", "version": "1.0.0", "summary": "Which certifications and attestations 64 cloud, data, AI and developer-tool vendors hold, each with its source and the date it was captured", "description": "Which certifications and attestations 64 cloud, data, AI and developer-tool vendors hold, each with its source and the date it was captured. Refreshed every Wednesday at 10:00 UTC. Free to read; please cite \"Attested (attested.fru.dev)\" with a link. Responses are cached at the edge; keep to about 60 requests a minute. Guide: https://attested.fru.dev/agents", "contact": { "name": "fru.dev", "url": "https://fru.dev", "email": "fru.dev3@gmail.com" } }, "externalDocs": { "description": "For AI agents", "url": "https://attested.fru.dev/agents" }, "servers": [ { "url": "https://attested.fru.dev" } ], "paths": { "/api/holders": { "get": { "operationId": "vendors_holding", "summary": "Vendors that hold every listed certification, optionally at a minimum level", "description": "Vendors that hold every listed certification, optionally at a minimum level. Returns vendors with their held count and, for each listed certification, the state, level, sources and whether it is unverified.", "parameters": [ { "name": "has", "in": "query", "required": true, "description": "One to five certification ids, comma separated; add :level for a minimum level (ids and levels at /api/certifications)", "schema": { "type": "string" }, "example": "gxp,fedramp:high" }, { "name": "limit", "in": "query", "required": false, "description": "Items per page, 1 to 200", "schema": { "type": "integer", "minimum": 1, "maximum": 200, "default": 200 } }, { "name": "offset", "in": "query", "required": false, "description": "Items to skip, for the next page", "schema": { "type": "integer", "minimum": 0, "default": 0 } } ], "responses": { "200": { "description": "vendors with their held count and, for each listed certification, the state, level, sources and whether it is unverified", "content": { "application/json": { "schema": { "type": "object" }, "example": { "has": [ { "cert": "gxp", "name": "GxP qualification", "min_level": null }, { "cert": "part11", "name": "FDA 21 CFR Part 11", "min_level": null } ], "items": [ { "slug": "microsoft", "name": "Microsoft", "domain": "microsoft.com", "category": "Cloud", "held": 50, "url": "https://attested.fru.dev/vendors/microsoft", "trust_center": "https://learn.microsoft.com/en-us/compliance/regulatory/offering-home", "evidence": [ { "cert": "gxp", "name": "GxP qualification", "state": "active", "level": "", "sources": [ "Vendor compliance page" ], "registry": false, "unverified": false, "listed_since": null }, { "cert": "part11", "name": "FDA 21 CFR Part 11", "state": "active", "level": "", "sources": [ "Vendor compliance page" ], "registry": false, "unverified": false, "listed_since": null } ] }, { "slug": "aws", "name": "AWS", "domain": "aws.amazon.com", "category": "Cloud", "held": 41, "url": "https://attested.fru.dev/vendors/aws", "trust_center": "https://aws.amazon.com/compliance/programs/", "evidence": [ { "cert": "gxp", "name": "GxP qualification", "state": "active", "level": "", "sources": [ "Vendor compliance page" ], "registry": false, "unverified": false, "listed_since": null }, { "cert": "part11", "name": "FDA 21 CFR Part 11", "state": "active", "level": "", "sources": [ "Vendor compliance page" ], "registry": false, "unverified": false, "listed_since": null } ] } ], "total": 3, "limit": 3, "offset": 0, "next": null, "updated": "2026-09-24 03:25:56" } } } } } } }, "/api/vendors": { "get": { "operationId": "list_vendors", "summary": "Every tracked vendor, most certifications first", "description": "Every tracked vendor, most certifications first. Returns vendors with slug, name, domain, category, held count and trust-center link.", "parameters": [ { "name": "category", "in": "query", "required": false, "description": "Only one category", "schema": { "type": "string", "enum": [ "cloud", "data", "ai", "devtools", "saas", "security" ] } }, { "name": "limit", "in": "query", "required": false, "description": "Items per page, 1 to 200", "schema": { "type": "integer", "minimum": 1, "maximum": 200, "default": 200 } }, { "name": "offset", "in": "query", "required": false, "description": "Items to skip, for the next page", "schema": { "type": "integer", "minimum": 0, "default": 0 } } ], "responses": { "200": { "description": "vendors with slug, name, domain, category, held count and trust-center link", "content": { "application/json": { "schema": { "type": "object" }, "example": { "items": [ { "slug": "anthropic", "name": "Anthropic", "domain": "anthropic.com", "category": "AI labs", "held": 10, "url": "https://attested.fru.dev/vendors/anthropic", "trust_center": "https://trust.anthropic.com/" }, { "slug": "openai", "name": "OpenAI", "domain": "openai.com", "category": "AI labs", "held": 9, "url": "https://attested.fru.dev/vendors/openai", "trust_center": "https://openai.com/security-and-privacy/" } ], "total": 11, "limit": 3, "offset": 0, "next": "/api/vendors?category=ai&limit=3&offset=3", "updated": "2026-09-24 03:25:56" } } } } } } }, "/api/vendors/{slug}": { "get": { "operationId": "get_vendor", "summary": "One vendor and every certification it shows evidence for", "description": "One vendor and every certification it shows evidence for. Returns the vendor and its certifications with state, level, sources, unverified and the registry listing date.", "parameters": [ { "name": "slug", "in": "path", "required": true, "description": "Vendor slug from /api/vendors", "schema": { "type": "string" }, "example": "snowflake" } ], "responses": { "200": { "description": "the vendor and its certifications with state, level, sources, unverified and the registry listing date", "content": { "application/json": { "schema": { "type": "object" }, "example": { "slug": "snowflake", "name": "Snowflake", "domain": "snowflake.com", "category": "Data platforms", "held": 22, "url": "https://attested.fru.dev/vendors/snowflake", "trust_center": "https://trust.snowflake.com/", "certifications": [ { "cert": "soc1", "name": "SOC 1", "state": "active", "level": "Type II", "sources": [ "Vendor compliance page" ], "registry": false, "unverified": false, "listed_since": null }, { "cert": "soc2", "name": "SOC 2", "state": "active", "level": "Type II", "sources": [ "Vendor compliance page" ], "registry": false, "unverified": false, "listed_since": null } ], "updated": "2026-09-24 03:25:56" } } } }, "404": { "description": "Not found" } } } }, "/api/certifications": { "get": { "operationId": "list_certifications", "summary": "Every tracked certification with what it means and how many vendors hold it", "description": "Every tracked certification with what it means and how many vendors hold it. Returns certifications with id, name, family, meaning, level ids, holder count and official list.", "parameters": [ { "name": "limit", "in": "query", "required": false, "description": "Items per page, 1 to 200", "schema": { "type": "integer", "minimum": 1, "maximum": 200, "default": 200 } }, { "name": "offset", "in": "query", "required": false, "description": "Items to skip, for the next page", "schema": { "type": "integer", "minimum": 0, "default": 0 } } ], "responses": { "200": { "description": "certifications with id, name, family, meaning, level ids, holder count and official list", "content": { "application/json": { "schema": { "type": "object" }, "example": { "items": [ { "id": "soc1", "name": "SOC 1", "family": "SOC reports", "what": "An auditor's report on controls relevant to customers' financial reporting.", "levels": [ "type1", "type2" ], "holders": 21, "registry": null, "url": "https://attested.fru.dev/certifications/soc1" }, { "id": "soc2", "name": "SOC 2", "family": "SOC reports", "what": "An auditor's report on security, availability, confidentiality, processing integrity and privacy controls.", "levels": [ "type1", "type2" ], "holders": 52, "registry": null, "url": "https://attested.fru.dev/certifications/soc2" } ], "total": 63, "limit": 3, "offset": 0, "next": "/api/certifications?limit=3&offset=3", "updated": "2026-09-24 03:25:56" } } } } } } }, "/api/certifications/{id}": { "get": { "operationId": "get_certification", "summary": "One certification and every vendor with evidence for it", "description": "One certification and every vendor with evidence for it. Returns the certification and vendors with state, level, sources and unverified.", "parameters": [ { "name": "id", "in": "path", "required": true, "description": "Certification id from /api/certifications", "schema": { "type": "string" }, "example": "stateramp" } ], "responses": { "200": { "description": "the certification and vendors with state, level, sources and unverified", "content": { "application/json": { "schema": { "type": "object" }, "example": { "id": "stateramp", "name": "GovRAMP (StateRAMP)", "what": "A security verification for US state and local government cloud buyers.", "detail": "Renamed from StateRAMP in 2025. Authorized at Low, Moderate or High impact; Ready, Pending and Progressing are steps on the way. Evidence...", "issuer": "GovRAMP", "registry": "https://govramp.org/product-list/", "holders": 17, "vendors": [ { "vendor": "aws", "vendor_name": "AWS", "state": "active", "level": "High", "sources": [ "Vendor compliance page", "GovRAMP product list" ], "registry": true, "unverified": false, "listed_since": "2026-09-23" }, { "vendor": "box", "vendor_name": "Box", "state": "active", "level": "High", "sources": [ "GovRAMP product list" ], "registry": true, "unverified": false, "listed_since": "2026-09-24" } ], "updated": "2026-09-24 03:25:56" } } } }, "404": { "description": "Not found" } } } }, "/api/evidence": { "get": { "operationId": "get_evidence", "summary": "The evidence for one vendor and certification: each source, what it says, when it was read", "description": "The evidence for one vendor and certification: each source, what it says, when it was read. Returns claims with source link, scope, the sentence or registry note, capture date and reviewed flag.", "parameters": [ { "name": "vendor", "in": "query", "required": true, "description": "Vendor slug", "schema": { "type": "string" }, "example": "aws" }, { "name": "cert", "in": "query", "required": true, "description": "Certification id", "schema": { "type": "string" }, "example": "fips140" } ], "responses": { "200": { "description": "claims with source link, scope, the sentence or registry note, capture date and reviewed flag", "content": { "application/json": { "schema": { "type": "object" }, "example": { "claims": [ { "id": 578, "vendor": "aws", "cert": "fips140", "level": "fips1403", "state": "active", "scope": "18 active FIPS 140-3 modules: #5476 Amazon Linux 2023 GnuTLS Cryptographic Module; #5438 Amazon Linux 2023 OpenSSL FIPS Provider; #5429 A...", "sourceKind": "cmvp", "sourceUrl": "https://csrc.nist.gov/projects/cryptographic-module-validation-program/validated-modules/search?SearchMode=Advanced&Vendor=Amazon&Certifi...", "note": "NIST CMVP lists 18 active FIPS 140-3 certificates for Amazon Web Services, Inc., latest validated 08/11/2026", "validFrom": "", "validUntil": "", "firstSeen": "2026-09-24", "capturedAt": "2026-09-24", "reviewed": true }, { "id": 625, "vendor": "aws", "cert": "fips140", "level": "fips1403", "state": "active", "scope": "", "sourceKind": "vendor", "sourceUrl": "https://aws.amazon.com/compliance/programs/", "note": "...Value Assets (PBHVA) Assessment CMMC DoD Level 2 DoD Level 4 DoD Level 5 DoD Level 6 FedRAMP FIPS 140-3 HITRUST CSF MPA Asia Pacific A...", "validFrom": "", "validUntil": "", "firstSeen": "2026-09-24", "capturedAt": "2026-09-24", "reviewed": true } ] } } } } } } }, "/api/changes": { "get": { "operationId": "recent_changes", "summary": "Dated changes, newest first: authorizations, upgrades, listings and lapses", "description": "Dated changes, newest first: authorizations, upgrades, listings and lapses. Returns changes with date, vendor, certification, kind, level, how it was dated and the source.", "parameters": [ { "name": "vendor", "in": "query", "required": false, "description": "Only one vendor (slug)", "schema": { "type": "string" } }, { "name": "cert", "in": "query", "required": false, "description": "Only one certification (id)", "schema": { "type": "string" } }, { "name": "limit", "in": "query", "required": false, "description": "Changes per page, 1 to 200", "schema": { "type": "integer", "minimum": 1, "maximum": 200, "default": 50 } }, { "name": "offset", "in": "query", "required": false, "description": "Changes to skip, for the next page", "schema": { "type": "integer", "minimum": 0, "default": 0 } } ], "responses": { "200": { "description": "changes with date, vendor, certification, kind, level, how it was dated and the source", "content": { "application/json": { "schema": { "type": "object" }, "example": { "items": [ { "date": "2026-08-17", "vendor": "google-cloud", "cert": "fedramp", "kind": "removed", "level": "", "dated_by": "source", "scope": "Google Cloud VMware Engine (GCVE)", "source": "https://marketplace.fedramp.gov/products/FR2405153785" }, { "date": "2026-08-06", "vendor": "cloudflare", "cert": "fedramp", "kind": "upgraded", "level": "High", "dated_by": "source", "scope": "Cloudflare for Government - High", "source": "https://marketplace.fedramp.gov/products/FR2000863987A" } ], "limit": 3, "offset": 0, "next": "/api/changes?limit=3&offset=3" } } } } } } } } }