# CLEATUS programmatic access to public certification data - **requirement:** CDS-TRC-PAC - **provider:** CLEATUS, Inc. - **offering:** CLEATUS GovCloud - **as Of:** 2026-10-15 - **purpose:** This document tells you how to retrieve the public CLEATUS FedRAMP certification data with a program. The same files serve people and programs. Each certification document in JSON has a human-readable Markdown companion. The index is JSON only. - **base Url:** https://fedramp.trust.cleat.ai/ - **alternate Base Url:** https://trust.cleat.ai/ - **alternate Base Url Note:** Both hosts serve every file at the same path. The index lists each file URL on https://trust.cleat.ai/. ## index - **url:** https://fedramp.trust.cleat.ai/certification-data-index.json - **content Type:** application/json - **statement:** The index lists every published certification data resource. Start every retrieval from the index. ### resource Fields - **id:** A stable identifier for the resource. - **url:** The absolute URL of the file. - **format:** The media type of the file: application/json or text/markdown. - **description:** What the file contains. - **publication Status:** The publication state of the file, for example published, available, or partial-report. - **sha256:** The lowercase hex SHA-256 digest of the exact bytes the url serves, computed from those bytes when the site is built. Every resource except the index itself carries it. - **other Fields:** The index also carries the program, the certification class, and the publication status. It also carries the pending materials and the next Ongoing Certification Report date. Its access section points to this document. ## access - **method:** HTTP GET over HTTPS. HEAD requests return the same headers without the body. - **authentication:** None. Every listed resource is public. You need no account, API key, or token. - **cors:** Responses carry Access-Control-Allow-Origin: \*. A browser application on any origin can read them. - **tls:** HTTPS only. ## content Types ### Item 1 - **extension:** .json - **content Type:** application/json. Static files add charset=utf-8. The certification data index omits the charset. - **use:** Machine-readable certification data. ### Item 2 - **extension:** .md - **content Type:** text/markdown; charset=utf-8 - **use:** Human-readable certification data. A generator renders most companions from the JSON. A continuous integration (CI) check rejects a companion that does not match its JSON. ## examples ### Item 1 - **purpose:** Read the index of every resource. - **command:** ```sh curl -sS https://fedramp.trust.cleat.ai/certification-data-index.json ``` ### Item 2 - **purpose:** List the format and URL of every resource. This example uses jq. - **command:** ```sh curl -sS https://fedramp.trust.cleat.ai/certification-data-index.json | jq -r '.resources[] | "\(.format) \(.url)"' ``` ### Item 3 - **purpose:** Download every resource into the current directory. - **command:** ```sh curl -sS https://fedramp.trust.cleat.ai/certification-data-index.json | jq -r '.resources[].url' | xargs -n 1 curl -sSfO ``` ### Item 4 - **purpose:** Download every resource without jq. - **command:** ```sh curl -sS https://fedramp.trust.cleat.ai/certification-data-index.json | python3 -c 'import json, sys; [print(r["url"]) for r in json.load(sys.stdin)["resources"]]' | xargs -n 1 curl -sSfO ``` ### Item 5 - **purpose:** Fetch one machine-readable document and its human-readable companion. - **command:** ```sh curl -sS https://fedramp.trust.cleat.ai/cryptographic-modules.json && curl -sS https://fedramp.trust.cleat.ai/cryptographic-modules.md ``` ### Item 6 - **purpose:** Verify that every downloaded resource matches the SHA-256 digest in the index. Each line prints OK or FAILED. - **command:** ```sh curl -sS https://fedramp.trust.cleat.ai/certification-data-index.json | python3 -c 'import json, sys, hashlib, urllib.request; [print("OK" if hashlib.sha256(urllib.request.urlopen(r["url"]).read()).hexdigest() == r["sha256"] else "FAILED", r["url"]) for r in json.load(sys.stdin)["resources"] if "sha256" in r]' ``` ### Item 7 - **purpose:** Read the response headers of a resource. - **command:** ```sh curl -sSI https://fedramp.trust.cleat.ai/offering.json ``` - **changes:** Files keep the same URL when their content changes. Read the generatedAt field of the index and the date fields of each document to find the publication date. - **restricted Data:** This document covers the public certification data. Federal agencies request access to non-public certification data through the trust center portal at https://trust.paramify.com/cleatus. - **contact:** security@cleat.ai