RPKI Relying-Party VRP Extractor

Point at any RPKI validator's VRP export and extract every validated ROA — origin ASN, prefix, maxLength, trust anchor, and expiry — with optional ASN / prefix / trust-anchor filters.

Every RPKI Relying-Party validator (rpki-client, Routinator, FORT, OctoRPKI / Cloudflare) publishes the ROAs it validated from the five RIR trust anchors (AFRINIC, APNIC, ARIN, LACNIC, RIPE) as a JSON dump — the Validated ROA Payload (VRP) set. Incumbents scrape RIPEstat / PeeringDB around routing security; this actor parses the VRP set itself, generically, so one actor reads any validator that publishes a dump.

Verified live against Cloudflare (https://rpki.cloudflare.com/rpki.json, ~973k ROAs) and rpki-client.org (https://console.rpki-client.org/vrps.json, ~973k ROAs).

What you get

One normalized row per validated ROA, plus one trailing metadata record:

Field	Description
asn	Origin ASN, normalized to AS<n> (accepts 13335 or "AS13335" at source)
_asnNum	The numeric AS number, for range / equality ops
prefix	The authorized IP prefix (CIDR)
_prefixLen	The prefix length (/N), derived
maxLength	ROA maxLength (nullable)
ta	Trust anchor: afrinic / apnic / arin / lacnic / ripe (nullable)
expires	Expiry as Unix epoch (nullable — some validators omit it)
expiresIso	Expiry as an ISO-8601 UTC string (nullable)
_source	The export host
_recordType	roa for ROA rows, meta for the trailing metadata record
_meta	On the metadata record only: the validator's own buildtime / elapsedtime / vrps count + the emitted-row count + the filters used

Input

Field	Required	Description
vrpUrl	✅	Validator VRP export URL, e.g. https://rpki.cloudflare.com/rpki.json
filterAsn		Keep only ROAs for this origin ASN (AS13335 or 13335)
filterPrefix		Keep only ROAs whose prefix is within this CIDR (e.g. 1.0.0.0/8)
ta		Keep only ROAs from this trust anchor (afrinic / apnic / arin / lacnic / ripe)
maxRecords		Stop after N ROAs (default 50000; raise to pull the full ~1M set)

Example

{
  "vrpUrl": "https://console.rpki-client.org/vrps.json",
  "filterAsn": "AS13335",
  "maxRecords": 5000
}

Use cases

• BGP Route-Origin-Validation (ROV) — the authoritative allow-list of which ASNs may originate which prefixes, to check announcements against.
• RIR / RPKI compliance audit — which of your prefixes have valid ROAs, per trust anchor, and when they expire.
• IRR / routing-hygiene tooling — cross-check IRR objects against the validated ROA set.
• Network-intelligence & threat research — a normalized, filterable feed of the global VRP set from any validator.

How it works

• Sends a browser-ish User-Agent + Accept: application/json and follows redirects.
• Reads the full ~100 MB body before parsing (a truncated read is a parse failure, not fewer rows).
• Auto-detects the VRP array key (roas → vrps → data → a bare root list) so it reads any validator's dump shape.
• Normalizes the inconsistently-typed asn (13335 vs "AS13335") to a canonical AS<n> + numeric _asnNum, and treats every field except asn and prefix as nullable.
• Fails fast — never a fabricated empty success — if the URL is unreachable, serves HTML / 403 instead of JSON, returns no recognizable VRP array, or matches zero ROAs.

Pricing

Pay-per-event: $0.0004 per record (tiered volume discount by subscription tier). You pay only for ROAs actually emitted; the trailing metadata record is free.

Your maximum charge is respected

If you set a maximum total charge for the run, the actor writes and bills only as many ROAs as that budget covers, then stops. If the budget cannot cover even one ROA, it does not download the export at all. maxRecords is a hard limit. If the platform restarts a run, ROAs that were already written and billed are not written or billed again.