openapi: 3.2.0
info:
  title: Anecdotes FedRAMP 20x Trust Center Gated API
  version: 1.0.0
  description: 'The FedRAMP 20x API exposes the contents of the Anecdotes Trust Center (https://trust.anecdotes.ai/)

    programmatically. It is divided into three tiers: public endpoints that require no authentication,

    an authorization tier that exchanges a static API key for a short-lived JWT, and gated endpoints that

    return the authorization package, Key Security Indicators (KSIs) and the evidence behind them.


    Derived by API Evangelist from the provider''s own published Postman collection

    (FEDRAMP-20X-API.postman_collection.json, retrieved from the public /fedramp20x/v1/public/info

    endpoint) and the documented endpoint tables at

    https://help.anecdotes.ai/technical-setup/fedramp-20x-trust-center-and-api.

    Paths, methods, parameters, headers and content types are transcribed from those sources only;

    no response schemas were invented where the provider did not publish one.'
  contact:
    name: Anecdotes
    url: https://help.anecdotes.ai/technical-setup/fedramp-20x-trust-center-and-api
    email: security@anecdotes.ai
servers:
- url: https://api.anecdotes.ai
  description: Production
security:
- Bearer: []
tags:
- name: Gated
  description: Authorization package, KSI and evidence endpoints. Require an approved FedRAMP user JWT.
paths:
  /fedramp20x/v1/authorization-package:
    get:
      tags:
      - Gated
      operationId: getAuthorizationPackage
      summary: Get authorization package
      description: Returns the comprehensive compliance posture, including Key Security Indicators and their evidence mappings.
      parameters:
      - name: include_evidence_ids
        in: query
        required: false
        description: Include evidence IDs for each KSI.
        schema:
          type: boolean
          default: true
      responses:
        '200':
          description: Authorization package.
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
            application/pdf:
              schema:
                type: string
                format: binary
        '401':
          description: Unauthorized - JWT missing, invalid or expired.
        '403':
          description: Forbidden - the caller is not an approved FedRAMP user.
  /fedramp20x/v1/ksi/{ksi_code}:
    get:
      tags:
      - Gated
      operationId: getKsi
      summary: Get KSI
      description: Retrieve a specific Key Security Indicator by code. The response includes metrics.analysis_rules_coverage.
      parameters:
      - name: ksi_code
        in: path
        required: true
        description: KSI code, for example FRR-IAM-01.
        schema:
          type: string
        example: FRR-IAM-01
      responses:
        '200':
          description: KSI detail.
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
            application/pdf:
              schema:
                type: string
                format: binary
        '401':
          description: Unauthorized - JWT missing, invalid or expired.
        '404':
          description: KSI not found.
  /fedramp20x/v1/evidence/{evidence_id}:
    get:
      tags:
      - Gated
      operationId: getFedrampEvidence
      summary: Get evidence
      description: Retrieve a specific evidence artifact. File-backed evidence is downloaded with Accept application/octet-stream.
      parameters:
      - $ref: '#/components/parameters/EvidenceId'
      - name: version
        in: query
        required: false
        description: Full ISO 8601 datetime. Omit for the latest version.
        schema:
          type: string
          format: date-time
      - name: page
        in: query
        required: false
        description: Page number, 1-indexed. JSON responses only.
        schema:
          type: integer
          minimum: 1
          default: 1
      - name: page_size
        in: query
        required: false
        description: Items per page. JSON responses only.
        schema:
          type: integer
          minimum: 1
          maximum: 1000
          default: 100
      responses:
        '200':
          description: Evidence artifact.
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
            application/octet-stream:
              schema:
                type: string
                format: binary
        '401':
          description: Unauthorized - JWT missing, invalid or expired.
        '404':
          description: Evidence not found.
  /fedramp20x/v1/evidence/{evidence_id}/history:
    get:
      tags:
      - Gated
      operationId: getFedrampEvidenceHistory
      summary: Get evidence history
      description: List the collection history for an evidence artifact. The response carries metadata, a data array of evidence_instance_id / collection_date / is_latest, and pagination.
      parameters:
      - $ref: '#/components/parameters/EvidenceId'
      - name: limit
        in: query
        required: false
        description: Maximum number of history entries to return.
        schema:
          type: integer
          minimum: 1
          maximum: 10000
          default: 100
      - name: from_date
        in: query
        required: false
        description: Only versions collected on or after this ISO 8601 date.
        schema:
          type: string
          format: date-time
      - name: to_date
        in: query
        required: false
        description: Only versions collected on or before this ISO 8601 date.
        schema:
          type: string
          format: date-time
      responses:
        '200':
          description: Evidence collection history.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EvidenceHistory'
        '401':
          description: Unauthorized - JWT missing, invalid or expired.
        '404':
          description: Evidence not found.
components:
  parameters:
    EvidenceId:
      name: evidence_id
      in: path
      required: true
      description: Evidence artifact identifier.
      schema:
        type: string
      example: '659414963'
  schemas:
    EvidenceHistory:
      type: object
      properties:
        metadata:
          type: object
          additionalProperties: true
        data:
          type: array
          items:
            type: object
            properties:
              evidence_instance_id:
                type: string
              collection_date:
                type: string
                format: date-time
              is_latest:
                type: boolean
        pagination:
          type: object
          additionalProperties: true
  securitySchemes:
    ApiKey:
      type: apiKey
      in: header
      name: x-anecdotes-api-key
      description: Static API key. Used only for the exchange endpoint.
    Bearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: Short-lived JWT (1 hour) obtained from /identity/v1/apikey/exchange.
externalDocs:
  description: FedRAMP 20x - Trust Center and API
  url: https://help.anecdotes.ai/technical-setup/fedramp-20x-trust-center-and-api
x-evidence:
  method: derived
  generated: '2026-07-31'
  sources:
  - https://help.anecdotes.ai/technical-setup/fedramp-20x-trust-center-and-api
  - postman/anecdotes-fedramp-20x.postman_collection.json
  verified_live:
  - url: https://api.anecdotes.ai/fedramp20x/v1/public/info?evidence_id=builder_2795822335733
    http_status: 200
    content_type: application/json
    fetched: '2026-07-31'