RPKI Relying-Party VRP Extractor

Point at any RPKI validator's VRP export and extract every validated ROA — origin ASN, prefix, maxLength, trust anchor, and expiry — with optional ASN / prefix / trust-anchor filters.

Every RPKI Relying-Party validator (rpki-client, Routinator, FORT, OctoRPKI / Cloudflare) publishes the ROAs it validated from the five RIR trust anchors (AFRINIC, APNIC, ARIN, LACNIC, RIPE) as a JSON dump — the Validated ROA Payload (VRP) set. Incumbents scrape RIPEstat / PeeringDB around routing security; this actor parses the VRP set itself, generically, so one actor reads any validator that publishes a dump.

Verified live against Cloudflare (https://rpki.cloudflare.com/rpki.json, ~973k ROAs) and rpki-client.org (https://console.rpki-client.org/vrps.json, ~973k ROAs).

What you get

One normalized row per validated ROA, plus one trailing metadata record:

Field	Description
asn	Origin ASN, normalized to AS<n> (accepts 13335 or "AS13335" at source)
_asnNum	The numeric AS number, for range / equality ops
prefix	The authorized IP prefix (CIDR)
_prefixLen	The prefix length (/N), derived
maxLength	ROA maxLength (nullable)
ta	Trust anchor: afrinic / apnic / arin / lacnic / ripe (nullable)
expires	Expiry as Unix epoch (nullable — some validators omit it)
expiresIso	Expiry as an ISO-8601 UTC string (nullable)
_source	The export host
_recordType	roa for ROA rows, meta for the trailing metadata record
_meta	On the metadata record only: the validator's own buildtime / elapsedtime / vrps count + the emitted-row count + the filters used

Input

Field	Required	Description
vrpUrl	✅	Validator VRP export URL, e.g. https://rpki.cloudflare.com/rpki.json
filterAsn		Keep only ROAs for this origin ASN (AS13335 or 13335)
filterPrefix		Keep only ROAs whose prefix is within this CIDR (e.g. 1.0.0.0/8)
ta		Keep only ROAs from this trust anchor (afrinic / apnic / arin / lacnic / ripe)
maxRecords		Stop after N ROAs (default 50000; raise to pull the full ~1M set)

Example

{
  "vrpUrl": "https://console.rpki-client.org/vrps.json",
  "filterAsn": "AS13335",
  "maxRecords": 5000
}

Use cases

• BGP Route-Origin-Validation (ROV) — the authoritative allow-list of which ASNs may originate which prefixes, to check announcements against.
• RIR / RPKI compliance audit — which of your prefixes have valid ROAs, per trust anchor, and when they expire.
• IRR / routing-hygiene tooling — cross-check IRR objects against the validated ROA set.
• Network-intelligence & threat research — a normalized, filterable feed of the global VRP set from any validator.

How it works

• Sends a browser-ish User-Agent + Accept: application/json and follows redirects.
• Reads the full ~100 MB body before parsing (a truncated read is a parse failure, not fewer rows).
• Auto-detects the VRP array key (roas → vrps → data → a bare root list) so it reads any validator's dump shape.
• Normalizes the inconsistently-typed asn (13335 vs "AS13335") to a canonical AS<n> + numeric _asnNum, and treats every field except asn and prefix as nullable.
• Fails fast — never a fabricated empty success — if the URL is unreachable, serves HTML / 403 instead of JSON, returns no recognizable VRP array, or matches zero ROAs.

Pricing

Pay-per-event: $0.0004 per record (tiered volume discount by subscription tier). You pay only for ROAs actually emitted; the trailing metadata record is free.