# FedRAMP Marketplace Monitor (`maydit/fedramp-marketplace-monitor`) Actor

Monitor official FedRAMP offering metadata and dated status paths. Compare saved observations with clear source timestamps, legacy labels and deterministic package variants.

- **URL**: https://apify.com/maydit/fedramp-marketplace-monitor.md
- **Developed by:** [Brandt May](https://apify.com/maydit) (community)
- **Categories:** Automation
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $3.00 / 1,000 cloud product observations

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.
Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

![FedRAMP Marketplace Monitor - cloud offering intelligence](https://api.apify.com/v2/key-value-stores/cCyrofyNNh9lwffXB/records/fedramp-marketplace-monitor-df959de38a93.png?signature=17vvLJNzKR5Si7k2Ur2S1)

## Know when a watched FedRAMP offering changes

Keep a source-linked watchlist of cloud offerings for vendor research, federal sales planning and GRC review. This Actor combines **official marketplace catalog metadata, dated status transitions and identity-matched package overviews**, then tells you which saved fields changed.

Each paid row represents one offering observation. Legacy status labels remain separate from newer certification paths, and ambiguous source states stay visible for human review.

[Run in Apify Console](https://console.apify.com/actors?search=fedramp-marketplace-monitor) · [Output](#a-record-you-can-explain) · [Comparisons](#build-a-three-offering-watchlist) · [Source limits](#how-the-sources-are-interpreted)

### Start with Cloud.gov

```json
{
  "fedrampIds": ["F1607067912"],
  "maxResults": 3
}
```

Open **Dataset** for the observation and **Run report** for source timestamps, exclusions and coverage. No source API key is needed. Empty input checks three named sample offerings: Cloud.gov, Mystic Message Archival and 911inform.

### A record you can explain

| Fields | Meaning |
| --- | --- |
| `fedrampId`, `serviceName`, `providerName` | Stable offering identity and published names |
| `legacyStatus`, `impactLevel`, `authorizationDateRaw` | Labels from the legacy marketplace catalog, preserved separately |
| `latestStatuses` | Latest published transition candidates for each certification type, path and class |
| `statusAmbiguous` | True when one path/class has conflicting statuses at the same transition and recorded time |
| `serviceModels`, `deploymentModel`, `assessor`, `smallBusiness` | Legacy catalog metadata, when supplied |
| `packageVariants`, `metadataSources` | Selected metadata from exactly matched package identities and its source family |
| `feedTimestamps`, `sourceUrls`, `sourceUrl` | Publisher export times, exact official JSON feeds and marketplace link |
| `contentHash`, `comparisonStatus`, `changedFields` | Stable comparison result for your workflow |
| `previous`, `previousObservedAt`, `observedAt` | Previous saved fields and observation times |

In retained official evidence from **15 October 2026**, Cloud.gov has the legacy label `FedRAMP Authorized` and a newer `Rev5 / JAB / Class C` status label of `FedRAMP Certified`. Its transition date is in 2017 while the status feed's recorded date is in 2026. These are distinct source facts; the Actor does not describe that import as a new 2026 authorization.

### Build a three-offering watchlist

```json
{
  "fedrampIds": ["F1607067912", "FR2335047392", "FR2617641654"],
  "maxResults": 3,
  "comparePrevious": true,
  "snapshotName": "offering-watch-demo"
}
```

1. Save a private task with the exact offerings relevant to your vendor shortlist.
2. Keep a dedicated `snapshotName`. The first saved observation is `new`; repeat runs can be `changed` or `unchanged`.
3. Upsert your own spreadsheet, CRM or review queue by `fedrampId`. Inspect `changedFields` and `previous` before acting on a label change.
4. Set `onlyChanges: true` to skip unchanged rows. A successful empty dataset can mean no changes; inspect `SUMMARY.unchangedSkipped` and failures.
5. Use a single writer per namespace/filter scope. Concurrent history modification is detected before overwrite and reported as partial, but is not a distributed lock.

History advances only for confirmed saved rows. Missing IDs, source errors and excluded package records never generate synthetic paid observations or inferred delistings.

### Research a provider pipeline

```json
{
  "keywords": ["Microsoft"],
  "maxResults": 3
}
```

Keywords are literal, case-insensitive OR matches on published provider/service names. With no explicit IDs, matching supported offerings are ordered by ID and output is capped. This is an alphabetically bounded sample, not a ranking of commercial potential. With explicit IDs, keywords additionally filter that watchlist.

### How the sources are interpreted

The Actor fetches three public JSON files from the **official FedRAMP repository**: the legacy catalog, certification status changelog and package-overview aggregate. All three must be fetched and validated before combined observations are emitted. Each response has an 8 MiB bound. The feeds update separately; this is not an atomic or real-time certification database.

- **Identity first:** package overviews are used only when their declared package ID exactly matches the aggregate's valid expected offering ID and the publisher has not flagged a mismatch. Missing, placeholder or mismatched declared IDs are excluded and counted in `SUMMARY.feedDiagnostics.excludedPackageRecordCount`. An invalid expected aggregate ID fails source validation. Status-only IDs without supported offering names are also excluded. These exclusions define coverage; they do not invalidate a separately supported catalog observation.
- **Separate source projections:** legacy catalog names and labels take precedence for the top-level legacy fields. Package-only offerings use the first deterministically sorted normalized variant for their display names. All distinct supported variants remain in `packageVariants`; exact duplicates and array order changes do not create artificial changes.
- **Dated path observations:** `latestStatuses` groups by certification type, path and class, chooses the greatest transition date and then recorded date, and preserves conflicting same-time labels with `statusAmbiguous: true`. An earlier class can remain as its own historical path observation. These are not a single authoritative current approval verdict.
- **Stable comparisons:** selected business fields, dated status entries and normalized package variants participate in the hash. Feed export timestamps, fetch timestamps, package version counters and unrelated provider text do not. A fresh export alone does not trigger a change.

This is public metadata monitoring. It does not assess security controls, grant certification, determine agency purchasing eligibility, read private authorization packages or fetch provider trust-center content. Contact fields and media are not collected. Verify consequential procurement or compliance decisions against the official marketplace and the responsible authority.

### Pricing and bounded operation

The base price is **$0.005 per saved offering observation**, plus the published start event. The Store shows any applicable plan discount. Filtered, unchanged-skipped and failed records are not paid results.

- `fedrampIds`: up to 50 exact IDs.
- `maxResults`: 1-100 saved rows; default 3.
- `maxRunSeconds`: default 240, with an additional 25-second reserve against the platform timeout.
- Use the platform spending limit to bound cost. Saved count and spending stops are explicit.

`SUMMARY` and the HTML **Run report** show failed sources, feed timestamps, exclusions, available/matching offerings and history outcome. `selectedWindowComplete` describes the selected watchlist or filtered window, not all FedRAMP products. An intentional result cap can have `status: "ok"` with `selectedWindowComplete: false`; source, deadline or spending failures make coverage incomplete. If all output fails, the Actor fails rather than silently succeeding with no usable data.

### References and support

- [Official FedRAMP marketplace](https://www.fedramp.gov/marketplace/products/)
- [Official public data repository and update notes](https://github.com/FedRAMP/marketplace-fedramp-gov-data)
- [FedRAMP certification data-sharing rules](https://www.fedramp.gov/2026/providers/rev5/rules/certification-data-sharing/)
- [Published FedRAMP schemas](https://www.fedramp.gov/schemas/)

Use this Actor's **Issues** tab or **bmay@mayd-it.com** for support or data correction requests. Include an offering ID and run URL; keep credentials and private assessment documents out of your message.

# Actor input Schema

## `fedrampIds` (type: `array`):

Optional exact official offering IDs, at most 50. With no IDs or keywords, checks three named sample offerings. Missing IDs are reported as source failures, never inferred delistings.

## `keywords` (type: `array`):

Optional literal case-insensitive OR terms in published provider/service names. With no IDs, searches the three fetched official feeds and saves a bounded sorted sample.

## `maxResults` (type: `integer`):

Stops after this many confirmed dataset rows. Unchanged rows skipped by onlyChanges do not count.

## `comparePrevious` (type: `boolean`):

Enable a private named history. First observations are new; history advances only after output is saved. Use one writer per snapshot namespace.

## `onlyChanges` (type: `boolean`):

Implies comparison. Unchanged observations are counted in SUMMARY and produce no paid dataset row.

## `snapshotName` (type: `string`):

1-80 letters, numbers, hyphens or underscores. Changing filters creates a separate scope. Use a new namespace to reset history.

## `maxRunSeconds` (type: `integer`):

Own time budget, also bounded by the platform timeout with a 25-second reserve.

## Actor input object example

```json
{
  "fedrampIds": [
    "F1607067912",
    "FR2335047392",
    "FR2617641654"
  ],
  "maxResults": 3,
  "comparePrevious": false,
  "onlyChanges": false,
  "snapshotName": "default",
  "maxRunSeconds": 240
}
```

# Actor output Schema

## `results` (type: `string`):

Successful public metadata observations only. Failures are never synthetic paid rows.

## `runReport` (type: `string`):

Readable coverage, limits and history outcome from this run.

## `summary` (type: `string`):

Saved/observed counts, failed sources, unreached offerings and time/spending stops.

## `csvExport` (type: `string`):

Download the current run observations for spreadsheets.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "fedrampIds": [
        "F1607067912",
        "FR2335047392",
        "FR2617641654"
    ],
    "maxResults": 3
};

// Run the Actor and wait for it to finish
const run = await client.actor("maydit/fedramp-marketplace-monitor").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {
    "fedrampIds": [
        "F1607067912",
        "FR2335047392",
        "FR2617641654",
    ],
    "maxResults": 3,
}

# Run the Actor and wait for it to finish
run = client.actor("maydit/fedramp-marketplace-monitor").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "fedrampIds": [
    "F1607067912",
    "FR2335047392",
    "FR2617641654"
  ],
  "maxResults": 3
}' |
apify call maydit/fedramp-marketplace-monitor --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,maydit/fedramp-marketplace-monitor"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/mq3bfFzV7OTD9MyvT/builds/TAougPpzMly7lHjm5/openapi.json