# FedRAMP Marketplace Monitor

Monitor official FedRAMP offering metadata and dated status paths. Compare saved observations with clear source timestamps, legacy labels and deterministic package variants.

Canonical product page: https://mayd-it.com/data-tools/actors/fedramp-marketplace-monitor/
Public Actor: https://apify.com/maydit/fedramp-marketplace-monitor

## Example input

```json
{
  "fedrampIds": [
    "F1607067912"
  ],
  "maxResults": 3
}
```

## Full guide

![FedRAMP Marketplace Monitor - cloud offering intelligence](https://api.apify.com/v2/key-value-stores/cCyrofyNNh9lwffXB/records/fedramp-marketplace-monitor-df959de38a93.png?signature=17vvLJNzKR5Si7k2Ur2S1)

# Know when a watched FedRAMP offering changes

Keep a source-linked watchlist of cloud offerings for vendor research, federal sales planning and GRC review. This Actor combines **official marketplace catalog metadata, dated status transitions and identity-matched package overviews**, then tells you which saved fields changed.

Each paid row represents one offering observation. Legacy status labels remain separate from newer certification paths, and ambiguous source states stay visible for human review.

[Run in Apify Console](https://console.apify.com/actors?search=fedramp-marketplace-monitor) · [Output](#a-record-you-can-explain) · [Comparisons](#build-a-three-offering-watchlist) · [Source limits](#how-the-sources-are-interpreted)

## Start with Cloud.gov

```json
{
  "fedrampIds": ["F1607067912"],
  "maxResults": 3
}
```

Open **Dataset** for the observation and **Run report** for source timestamps, exclusions and coverage. No source API key is needed. Empty input checks three named sample offerings: Cloud.gov, Mystic Message Archival and 911inform.

## A record you can explain

| Fields | Meaning |
| --- | --- |
| `fedrampId`, `serviceName`, `providerName` | Stable offering identity and published names |
| `legacyStatus`, `impactLevel`, `authorizationDateRaw` | Labels from the legacy marketplace catalog, preserved separately |
| `latestStatuses` | Latest published transition candidates for each certification type, path and class |
| `statusAmbiguous` | True when one path/class has conflicting statuses at the same transition and recorded time |
| `serviceModels`, `deploymentModel`, `assessor`, `smallBusiness` | Legacy catalog metadata, when supplied |
| `packageVariants`, `metadataSources` | Selected metadata from exactly matched package identities and its source family |
| `feedTimestamps`, `sourceUrls`, `sourceUrl` | Publisher export times, exact official JSON feeds and marketplace link |
| `contentHash`, `comparisonStatus`, `changedFields` | Stable comparison result for your workflow |
| `previous`, `previousObservedAt`, `observedAt` | Previous saved fields and observation times |

In retained official evidence from **15 October 2026**, Cloud.gov has the legacy label `FedRAMP Authorized` and a newer `Rev5 / JAB / Class C` status label of `FedRAMP Certified`. Its transition date is in 2017 while the status feed's recorded date is in 2026. These are distinct source facts; the Actor does not describe that import as a new 2026 authorization.

## Build a three-offering watchlist

```json
{
  "fedrampIds": ["F1607067912", "FR2335047392", "FR2617641654"],
  "maxResults": 3,
  "comparePrevious": true,
  "snapshotName": "offering-watch-demo"
}
```

1. Save a private task with the exact offerings relevant to your vendor shortlist.
2. Keep a dedicated `snapshotName`. The first saved observation is `new`; repeat runs can be `changed` or `unchanged`.
3. Upsert your own spreadsheet, CRM or review queue by `fedrampId`. Inspect `changedFields` and `previous` before acting on a label change.
4. Set `onlyChanges: true` to skip unchanged rows. A successful empty dataset can mean no changes; inspect `SUMMARY.unchangedSkipped` and failures.
5. Use a single writer per namespace/filter scope. Concurrent history modification is detected before overwrite and reported as partial, but is not a distributed lock.

History advances only for confirmed saved rows. Missing IDs, source errors and excluded package records never generate synthetic paid observations or inferred delistings.

## Research a provider pipeline

```json
{
  "keywords": ["Microsoft"],
  "maxResults": 3
}
```

Keywords are literal, case-insensitive OR matches on published provider/service names. With no explicit IDs, matching supported offerings are ordered by ID and output is capped. This is an alphabetically bounded sample, not a ranking of commercial potential. With explicit IDs, keywords additionally filter that watchlist.

## How the sources are interpreted

The Actor fetches three public JSON files from the **official FedRAMP repository**: the legacy catalog, certification status changelog and package-overview aggregate. All three must be fetched and validated before combined observations are emitted. Each response has an 8 MiB bound. The feeds update separately; this is not an atomic or real-time certification database.

- **Identity first:** package overviews are used only when their declared package ID exactly matches the aggregate's valid expected offering ID and the publisher has not flagged a mismatch. Missing, placeholder or mismatched declared IDs are excluded and counted in `SUMMARY.feedDiagnostics.excludedPackageRecordCount`. An invalid expected aggregate ID fails source validation. Status-only IDs without supported offering names are also excluded. These exclusions define coverage; they do not invalidate a separately supported catalog observation.
- **Separate source projections:** legacy catalog names and labels take precedence for the top-level legacy fields. Package-only offerings use the first deterministically sorted normalized variant for their display names. All distinct supported variants remain in `packageVariants`; exact duplicates and array order changes do not create artificial changes.
- **Dated path observations:** `latestStatuses` groups by certification type, path and class, chooses the greatest transition date and then recorded date, and preserves conflicting same-time labels with `statusAmbiguous: true`. An earlier class can remain as its own historical path observation. These are not a single authoritative current approval verdict.
- **Stable comparisons:** selected business fields, dated status entries and normalized package variants participate in the hash. Feed export timestamps, fetch timestamps, package version counters and unrelated provider text do not. A fresh export alone does not trigger a change.

This is public metadata monitoring. It does not assess security controls, grant certification, determine agency purchasing eligibility, read private authorization packages or fetch provider trust-center content. Contact fields and media are not collected. Verify consequential procurement or compliance decisions against the official marketplace and the responsible authority.

## Pricing and bounded operation

The base price is **$0.005 per saved offering observation**, plus the published start event. The Store shows any applicable plan discount. Filtered, unchanged-skipped and failed records are not paid results.

- `fedrampIds`: up to 50 exact IDs.
- `maxResults`: 1-100 saved rows; default 3.
- `maxRunSeconds`: default 240, with an additional 25-second reserve against the platform timeout.
- Use the platform spending limit to bound cost. Saved count and spending stops are explicit.

`SUMMARY` and the HTML **Run report** show failed sources, feed timestamps, exclusions, available/matching offerings and history outcome. `selectedWindowComplete` describes the selected watchlist or filtered window, not all FedRAMP products. An intentional result cap can have `status: "ok"` with `selectedWindowComplete: false`; source, deadline or spending failures make coverage incomplete. If all output fails, the Actor fails rather than silently succeeding with no usable data.

## References and support

- [Official FedRAMP marketplace](https://www.fedramp.gov/marketplace/products/)
- [Official public data repository and update notes](https://github.com/FedRAMP/marketplace-fedramp-gov-data)
- [FedRAMP certification data-sharing rules](https://www.fedramp.gov/2026/providers/rev5/rules/certification-data-sharing/)
- [Published FedRAMP schemas](https://www.fedramp.gov/schemas/)

Use this Actor's **Issues** tab or **bmay@mayd-it.com** for support or data correction requests. Include an offering ID and run URL; keep credentials and private assessment documents out of your message.