FedRAMP Marketplace Monitor

SOURCE COVERAGE & PRACTICAL LIMITS

Full product guide

Documentation captured from build 1.0.1. Example outputs retain their original sample context; they are not live results.

Know when a watched FedRAMP offering changes

Keep a source-linked watchlist of cloud offerings for vendor research, federal sales planning and GRC review. This Actor combines official marketplace catalog metadata, dated status transitions and identity-matched package overviews, then tells you which saved fields changed.

Each paid row represents one offering observation. Legacy status labels remain separate from newer certification paths, and ambiguous source states stay visible for human review.

Run in Apify Console · Output · Comparisons · Source limits

Start with Cloud.gov

{
  "fedrampIds": ["F1607067912"],
  "maxResults": 3
}

Open Dataset for the observation and Run report for source timestamps, exclusions and coverage. No source API key is needed. Empty input checks three named sample offerings: Cloud.gov, Mystic Message Archival and 911inform.

A record you can explain

In retained official evidence from 15 October 2026, Cloud.gov has the legacy label FedRAMP Authorized and a newer Rev5 / JAB / Class C status label of FedRAMP Certified. Its transition date is in 2017 while the status feed's recorded date is in 2026. These are distinct source facts; the Actor does not describe that import as a new 2026 authorization.

Build a three-offering watchlist

{
  "fedrampIds": ["F1607067912", "FR2335047392", "FR2617641654"],
  "maxResults": 3,
  "comparePrevious": true,
  "snapshotName": "offering-watch-demo"
}

1. Save a private task with the exact offerings relevant to your vendor shortlist.
2. Keep a dedicated snapshotName. The first saved observation is new; repeat runs can be changed or unchanged.
3. Upsert your own spreadsheet, CRM or review queue by fedrampId. Inspect changedFields and previous before acting on a label change.
4. Set onlyChanges: true to skip unchanged rows. A successful empty dataset can mean no changes; inspect SUMMARY.unchangedSkipped and failures.
5. Use a single writer per namespace/filter scope. Concurrent history modification is detected before overwrite and reported as partial, but is not a distributed lock.

History advances only for confirmed saved rows. Missing IDs, source errors and excluded package records never generate synthetic paid observations or inferred delistings.

Research a provider pipeline

{
  "keywords": ["Microsoft"],
  "maxResults": 3
}

Keywords are literal, case-insensitive OR matches on published provider/service names. With no explicit IDs, matching supported offerings are ordered by ID and output is capped. This is an alphabetically bounded sample, not a ranking of commercial potential. With explicit IDs, keywords additionally filter that watchlist.

How the sources are interpreted

The Actor fetches three public JSON files from the official FedRAMP repository: the legacy catalog, certification status changelog and package-overview aggregate. All three must be fetched and validated before combined observations are emitted. Each response has an 8 MiB bound. The feeds update separately; this is not an atomic or real-time certification database.

• Identity first: package overviews are used only when their declared package ID exactly matches the aggregate's valid expected offering ID and the publisher has not flagged a mismatch. Missing, placeholder or mismatched declared IDs are excluded and counted in SUMMARY.feedDiagnostics.excludedPackageRecordCount. An invalid expected aggregate ID fails source validation. Status-only IDs without supported offering names are also excluded. These exclusions define coverage; they do not invalidate a separately supported catalog observation.
• Separate source projections: legacy catalog names and labels take precedence for the top-level legacy fields. Package-only offerings use the first deterministically sorted normalized variant for their display names. All distinct supported variants remain in packageVariants; exact duplicates and array order changes do not create artificial changes.
• Dated path observations: latestStatuses groups by certification type, path and class, chooses the greatest transition date and then recorded date, and preserves conflicting same-time labels with statusAmbiguous: true. An earlier class can remain as its own historical path observation. These are not a single authoritative current approval verdict.
• Stable comparisons: selected business fields, dated status entries and normalized package variants participate in the hash. Feed export timestamps, fetch timestamps, package version counters and unrelated provider text do not. A fresh export alone does not trigger a change.

This is public metadata monitoring. It does not assess security controls, grant certification, determine agency purchasing eligibility, read private authorization packages or fetch provider trust-center content. Contact fields and media are not collected. Verify consequential procurement or compliance decisions against the official marketplace and the responsible authority.

Pricing and bounded operation

The base price is $0.005 per saved offering observation, plus the published start event. The Store shows any applicable plan discount. Filtered, unchanged-skipped and failed records are not paid results.

• fedrampIds: up to 50 exact IDs.
• maxResults: 1-100 saved rows; default 3.
• maxRunSeconds: default 240, with an additional 25-second reserve against the platform timeout.
• Use the platform spending limit to bound cost. Saved count and spending stops are explicit.

SUMMARY and the HTML Run report show failed sources, feed timestamps, exclusions, available/matching offerings and history outcome. selectedWindowComplete describes the selected watchlist or filtered window, not all FedRAMP products. An intentional result cap can have status: "ok" with selectedWindowComplete: false; source, deadline or spending failures make coverage incomplete. If all output fails, the Actor fails rather than silently succeeding with no usable data.

References and support

• Official FedRAMP marketplace
• Official public data repository and update notes
• FedRAMP certification data-sharing rules
• Published FedRAMP schemas

Use this Actor's Issues tab or bmay@mayd-it.com for support or data correction requests. Include an offering ID and run URL; keep credentials and private assessment documents out of your message.