# VulcanGov Trust Center API (CDS-TRC-PAC)

Base URL: https://trust.vulcangov.app
FedRAMP ID: FR2619254906

Authentication: complete the one-time-code flow at /portal, then send the session
token as `Authorization: Bearer <token>` (the same value set in the tc_session
cookie). Sessions last 12 hours; re-provision at any time (no approval step).

GET /api/v1/artifacts
    JSON index of all FedRAMP Certification Data artifacts:
    id, title, class, format, updated, sha256, bytes.

GET /api/v1/artifacts/{id}
    The artifact itself, any format — JSON artifacts return application/json,
    human-readable artifacts (PDF/HTML) return their native content type
    (programmatic retrieval of human-readable materials per CDS-TRC-PAC/HMR).
    Artifacts over ~4 MB (the `bytes` field in the index) are delivered by a
    302 to a short-lived signed URL (valid 300 s) instead of inline; clients
    must follow redirects (curl -L). The redirect target is S3 — do not send
    your Bearer token there (curl and most HTTP libraries drop it on a
    cross-host redirect automatically). Access is logged identically.

GET /api/v1/my-access
    The calling party's own access history (CDS-TRC-ACL).