The API is the product. The pages just render it.
Everything a person sees here, a program can fetch: the public offering information, the package index at your tier, every file with its hash, version history, snapshots, and your own access log. The machine-readable form is /v1/openapi.json.
$ export KEY=rgt_live_… # a party key, minted on your access page $ curl -s -H "Authorization: Bearer $KEY" \ https://trust.rampguide.com/v1/t/acme/index.json | jq '.files[] | {path, tier, sha256}' $ curl -sL -H "Authorization: Bearer $KEY" -o sdr.json \ https://trust.rampguide.com/v1/t/acme/files/fedramp/sdr.json $ shasum -a 256 sdr.json 7396608116c9… sdr.json # the sha256 index.json promised
Session cookie
For people. Set by passkey sign-in at /sign-in; browsers send it automatically. One hour idle, twelve hours absolute.
Party API key
For an agency's or assessor's own systems. A party administrator mints one on their access page; it is scoped to one trust center and one tier, expires within a year, and every use is logged. Send it as Authorization: Bearer rgt_live_….
Publish key
For the provider's build pipeline only. It can publish and nothing else, and the trust center verifies every uploaded file against the manifest.
A file request answers 302 to a URL that works for sixty seconds, with a JSON body carrying the file's SHA-256, size, and tier; the same file is available inline at /raw/ for viewers. Either answer is the logged access event.
| Route | Does | Who |
|---|
| Rule | What it requires |
|---|