Programmatic access

ComplianceONE's FedRAMP Certification Data can be fetched programmatically (CDS-TRC-PAC), in machine-readable and human-readable forms. Public data needs no authentication. Agency and FedRAMP data is fetched with the token from an access link. Every JSON file carries the FedRAMP ID FR2700754082 (CDS-CSO-FID). The FedRAMP Marketplace listing is at https://fedramp.gov/marketplace/products/FR2700754082.

Public endpoints (no authentication)

Static files, served over HTTPS from www.complianceone.ai, regenerated from the Certification Package whenever it changes.

Endpoint	Content	Format	Cache
https://www.complianceone.ai/trust/cpo.json	Certification Package Overview (FRC-CSO-PKG)	FedRAMP CPO schema 2026-06-24	1 hour
https://www.complianceone.ai/trust/fedramp.json	Public certification data (CDS-CSO-PUB)	JSON	1 hour
https://www.complianceone.ai/trust/services.json	Public service list (CDS-CSO-SVC)	JSON	1 hour
https://www.complianceone.ai/trust/changes.json	Significant change history (SCN-CSO-HIS)	JSON	1 hour
https://www.complianceone.ai/trust/milestones.json	Certification progress (MKT-IIP-DCP)	JSON	1 hour
https://www.complianceone.ai/trust/status.json	Service status (CDS-CSO-AVR): live probe of the API, its dependencies and the AI service, with 90-day history	JSON	no cache
https://www.complianceone.ai/trust/status-history.json	The stored 90-day status history (checks every 30 minutes)	JSON	5 minutes
https://www.complianceone.ai/trust/secure-configuration-guide.json	Secure Configuration Guide (SCG-CSO-RSC)	complianceone.secure-configuration-guide.v1	1 hour
https://www.complianceone.ai/.well-known/security.txt	Security contact (RFC 9116)	text/plain	1 hour

All JSON endpoints allow cross-origin requests (Access-Control-Allow-Origin: *).

Human-readable materials (no authentication)

Each public page is plain HTML fetched with an HTTPS GET, with a 30-second cache. It is rendered from the same object as the JSON beside it, so the two forms cannot drift (CDS-TRC-HMR, CDS-CSO-CBF).

Page	Content	Machine-readable form
https://www.complianceone.ai/trust/	Trust Center landing page: certification data, services, progress, contacts, how to get access	fedramp.json, milestones.json
https://www.complianceone.ai/trust/services/	Services and their security categories	services.json
https://www.complianceone.ai/trust/changes/	Significant change history	changes.json
https://www.complianceone.ai/trust/status/	Service status and 90-day history	status.json
https://www.complianceone.ai/trust/secure-configuration-guide/	Secure Configuration Guide	secure-configuration-guide.json
https://www.complianceone.ai/trust/programmatic-access/	This page	N/A
https://www.complianceone.ai/security/	Vulnerability Disclosure Policy	/.well-known/security.txt

Agency and FedRAMP endpoints (access link token)

Served by the ComplianceONE Trust Center on https://api.complianceone.io. An access link carries a 256-bit random token; the same token works for every endpoint the grant covers, with no per-visit approval (CDS-TRC-USH). Responses are never cached (no-store) and are sent as file downloads.

Endpoint	Content	Form
https://api.complianceone.io/public/agency-reliance/{token}/index.json	What the grant covers, with the URL of each item	JSON
https://api.complianceone.io/public/agency-reliance/{token}/document-index.json	Policy and procedure index: name, file, summary, word count, version, date, related FedRAMP practices (CDS-CSO-IRP)	JSON
https://api.complianceone.io/public/agency-reliance/{token}/traceability.json	Control traceability	JSON
https://api.complianceone.io/public/agency-reliance/{token}/traceability.md	Control traceability	Markdown (human-readable)
https://api.complianceone.io/public/agency-reliance/{token}/component-definition.json	OSCAL component definition for the agency's own SSP	OSCAL JSON
https://api.complianceone.io/public/agency-reliance/{token}/ssp-skeleton.json	OSCAL SSP skeleton	OSCAL JSON
https://api.complianceone.io/public/agency-reliance/{token}/access-log.json	The grant's own access history for the last six months (CDS-TRC-ACL)	JSON

Materials not yet on the access link

These are supplied to agencies with a grant and to FedRAMP as JSON and Markdown files, on request to security@platformoneinc.com, within 1 business day. They are being added to the access link, target 2026-11-13:

• the Security Decision Record;
• Ongoing Certification Reports, and the certification-data snapshots aligned to each one (CDS-CSO-HAD);
• monthly vulnerability reports and the JSON history (updated at least every 14 days);
• incident reports, for affected agencies;
• FedRAMP Certification Reports;
• the policy and procedure documents named in document-index.json.

Access inventory (CDS-TRC-AAI)

PlatformOne keeps an inventory and history of every agency user or system with access: the grant, the agency, the people or systems it covers, and when and by whom it was requested, granted, changed, revoked or expired. Revoked grants stay as history. FedRAMP gets it from its own Trust Center access, or by email to security@platformoneinc.com; PlatformOne sends an export within 2 business days.

Token handling

• Treat the token as a credential: send it only over HTTPS, do not put it in shared documents or ticket systems, and do not embed it in client-side code.
• Unknown, rotated, revoked and expired tokens all return the same not-found response.
• To rotate a token, add or remove people or systems, or end access, email security@platformoneinc.com; changes are made within 1 business day (CDS-TRC-SSM).
• Every access is logged with the grant, channel, item and time; summaries are kept for 400 days.

Requesting access

Email security@platformoneinc.com from an official address, naming the agency, the purpose and the people or systems that need access. Decisions within 1 business day. FedRAMP is always granted. No NDA is required (CDS-UTC-AGA).