API
Documented programmatic access to all certification data (CDS-TRC-PAC), human-readable materials included. Machine-readable description: https://trust.fedcrediq.com/api/openapi.json.
Authentication
Public endpoints need nothing. Certification-data endpoints accept either an API key in the X-Api-Key header (create one under your account after signing in) or your sign-in session. Keys are per user; every call is logged under that user.
curl -H 'X-Api-Key: tck_…' https://trust.fedcrediq.com/api/package curl -H 'X-Api-Key: tck_…' https://trust.fedcrediq.com/api/package/<version>/sdr.json
Endpoints
| Method and path | Auth | Returns |
|---|---|---|
GET /public/cpo.json, /public/cpo.md | none | Public package overview (current version) |
GET /announcements.json | none / key | Public announcements; with auth, also notices for necessary parties |
GET /secure-configuration-guide.json | none | Secure configuration guide, machine-readable |
GET /api/package | key | Current version: manifest with artifact names, sizes, SHA-256, download paths |
GET /api/package/versions | key | All versions (historical snapshots, CDS-CSO-HAD) |
GET /api/package/{version} | key | That version's manifest |
GET /api/package/{version}/{artifact} | key | The artifact (JSON or Markdown as published) |
GET /api/me | key | Who the key belongs to |
GET /api/me/access | key | Your recent access events |
Rate limit: 300 requests per 5 minutes per source address. Errors are JSON {"error": …} with the HTTP status.