RFI Development API and UI Testing Software Updated.pdf

FEDERAL BUREAU OF INVESTIGATION

FINANCE AND FACILITIES DIVISION | PROCUREMENT

SECTION

REQUEST FOR INFORMATION (RFI)

According to FAR 15.201, requests for information (RFIs) may be used when the government does not presently intend to award a contract but wants to obtain price, delivery, other market information, or capabilities for planning purposes. Responses to these notices are not offers and cannot be accepted by the government to form a binding contract. There is no required format for

RFIs.

REQUEST FOR INFORMATION

Development, API, and UI Testing Software

Due Date November 7, 2025 by 4PM ET

DISCLAIMER:

THIS NOTICE IS FOR INFORMATIONAL PURPOSES ONLY. THIS IS NOT A REQUEST

FOR PROPOSAL OR QUOTE. IT DOES NOT CONSTITUTE A SOLICITATION AND

SHALL NOT BE CONSTRUED AS A COMMITMENT BY THE GOVERNMENT.

RESPONSES IN ANY FORM ARE NOT OFFERS AND THE GOVERNMENT IS UNDER

NO OBLIGATION TO AWARD A CONTRACT AS A RESULT OF THIS

ANNOUNCEMENT. NO FUNDS ARE AVAILABLE TO PAY FOR PREPARATION OF

RESPONSES TO THIS ANNOUNCEMENT. ANY INFORMATION SUBMITTED BY

RESPONDENTS TO THIS TECHNICAL DESCRIPTION IS STRICTLY VOLUNTARY.

INTRODUCTION

Responses to this RFI may be used to formulate final requirements and/or to identify qualified vendors capable of meeting those requirements. The description below outlines preliminary requirements envisioned for Criminal Justice Information Services (CJIS) Division. The information gathered may be used to formulate acquisition strategies for competitive solicitations.

BACKGROUND

The United States Department of Justice (DOJ), Federal Bureau of Investigation (FBI), Criminal Justice Information Services (CJIS) Division is exploring available software and software suites that can fulfill the following requirements: application performance monitoring (APM), software development, automated software testing, application programming interface (API) testing, user interface (UI) testing, and security testing.

The requirements for this RFI pertain to several different Value Streams (VSs) within the CJIS Division. The Value Streams are as follows: Enterprise Technology Services Unit (ETSU), Law Enforcement Enhancement Portal (LEEP), National Crime Incident Center (NCIC), National Data Exchange (N-DEx), Next Generation Identification (NGI), National Instant Criminal Background System (NICS), Crime Data (CD), and Law Enforcement Online (LEO).

The systems all possess differing requirements. Proposed solutions must meet each requirement for an individual system. Refer to the following determined requirements:

ETSU

o The Enterprise Technology Services Unit (ETSU) requires an automated solution for end-to-end user interface testing to ensure application quality across desktop, web, and mobile platforms. This capability should allow for both low-code and code-based approaches to test creation, enabling testers of varying skill levels to contribute effectively. The solution must support robust object recognition, reusable test components, and seamless integration into continuous integration and delivery (CI/CD) pipelines to support rapid release cycles.

o ETSU requires a comprehensive API testing capability needed to validate the functionality, integration, and data integrity of services across the enterprise. This solution should support multiple protocols including REST, SOAP, and GraphQL, and allow for complex, data-driven test scenarios. It must provide features for parameterization, assertion logic, test reuse, and result reporting to enable consistent validation of APIs throughout the development lifecycle.

o To ensure system performance and reliability, particularly for mission-critical services, the organization requires the ability to conduct load and performance testing of its APIs. The solution must simulate real-world user traffic patterns at varying loads to detect performance bottlenecks, latency issues, and potential system failures under stress. It should include detailed analytics and reporting to support capacity planning and performance tuning prior to production deployment.

o A centralized and collaborative environment is needed to design, document, and manage APIs across development teams. The platform must support modern API specifications (e.g., OpenAPI) and enforce design standards and style guidelines to promote consistency and reusability. Version control, access management, and the ability to integrate with the software development lifecycle are essential to support governance and cross-team coordination.

o All testing and API design tools must integrate with existing DevOps infrastructure to support automated workflows and continuous quality assurance. The solution should provide command-line interfaces, APIs, or plugins to work with tools such as Atlassian tools and Git repositories. This integration ensures that testing, validation, and documentation activities can be automatically triggered and incorporated into the deployment pipeline, supporting agile delivery practices.

o The following are the specifications required from a software/software suite:

Web UI testing—The capability to test the Functionality of the links to websites and to verify the sites are displayed correctly without issues.

Cross Browser Testing—utilize multiple web browsers to simulate real users accessing webpages simultaneously.

Web Client Load Testing—Test multiple sessions at once.

API development and testing.

A cloud-based, collaborative platform designed for designing, documenting, version control and managing APIs to include importing API specifications using the OpenAPI or AsyncAPI so that updates stay synced. AWS gov cloud integration.

508 compliance testing Color contrast and text size analysis Keyboard navigation/keytrap identification Image alt text detection Text description for interactive elements Compliance with Windows Accessibility tools and JAWS Web Service Testing JavaFX-based Desktop Application Testing Performance Testing—Test multiple users and load, able to generate reports, give analytic data and provide clean reporting and test metrics.

Functional Testing—Human testing, test case automation and support data driven testing, able to reuse existing test cases with different data sets.

Bitbucket integration version control of test cases.

CI/CD integration (Atlassian Bamboo) Security Testing, authentication, and authorization testing.

o ETSU requires three (3) user testing licenses that allow for the following:

Desktop Testing (Automate UI testing across a wide range of desktop applications), Web Testing (Create reusable tests for all web applications), Offers Live Testing (Interactive, Manual), Visual Testing (Automated Screenshots and Comparisons), Automated Testing (Selenium and Appium Test Automation), and Record and Replay (Automation Testing made easy).

Record and playback scripts to Instantly create API tests and perform Load test.

Scripless Recording and Replay, Keyword Driven test to include UI, GUI, and objects testing.

Test coverage using both physical and virtual machines capable of running over 1500 browsers.

Object and visual recognition engine to detect objects and missing objects perversely recorded.

o ETSU requires six (6) user testing licenses that allow for the following:

All-in-one API testing platform that allows teams to create, manage, and execute automated functional, security, and performance tests for APIs. It should support various API protocols, including REST, SOAP, and GraphQL, and offers features like virtualized service mocking for faster integration testing.

Key Features:

Low code environment: allows teams to create complex API testing workflows with minimal scripting or coding.

Multi-protocol support: It supports various API protocols, making it versatile for different testing needs.

Virtualization: enables teams to simulate APIs before they are even built, allowing for early integration testing.

Automated testing: It facilitates the automation of functional, security, and load tests.

Comprehensive reporting: provides detailed test reports for analysis and tracking.

Integration with other tools: It integrates with other tools for monitoring and issue tracking.

o ETSU requires one (1) Enterprise-wide license that allows for one hundred (100) virtual users and provides the following:

A cloud-based, collaborative platform designed for designing, documenting, and managing APIs using the OpenAPI or AsyncAPI specifications. It allows teams to work together on API development, providing tools for design, testing, documentation, and deployment.

API Lifecycle Management on a Centralized Platform able to enhances its capabilities for API design, documentation, and developer portals.

Create, edit, and host OpenAPI and AsyncAPI definitions, collaborate on them with your team and integrate them with third-party services.

Anonymous users can browse and search the public API catalog. Logged in users can also view private APIs as well as create and edit API definitions.

LEEP

o The Law Enforcement Enhancement Portal (LEEP) requires the following:

Functional UI Testing Requirements We require a test automation solution that includes the following baseline capabilities:

Cross-platform Testing Support: Support for testing desktop (windows), web (modern browsers: chrome, edge, firefox), and mobile (ios, android) applications.

Scripted and scriptless test development: Capability to create and manage tests via both code (ie python, javascript) and keyword-driven/scriptless interfaces.

Test data management: Built in or intergrable support for external data source (CSV, Excel, databases) to support data-driven testing.

CI/CD integration Compatibility with ci/cd pipelines and devops tools like Jenkins, Azure Devops, gitlab, or github actions for test execution and reporting.

Reporting and Analytics Comprehensive test result reporting, including dashboards, logs, screenshots, and error traces for test failures.

API Testing Requirements We also require an API testing solution with the following core features:

Support for Multiple Protocols: Rest, SOAP, GraphQL, JMS, and JDBC, among others.

Automated API Test Creation: Features to automatically generate tests from API definitions (Swagger/OpenAPI, WSDL).

Data-Driven Testing: Capability to parameterize requests and use external data sources for test inputs and validations.

Assertion and Validation Support: Rich assertion library with support for schema validation, response times, and advanced content assertions.

API load testing/virtualization(optional but preferred): Built-in support or integrations for load testing APIs and mocking services when APIs are unavailable.

Security Testing: Ability to conduct automated security tests, including fuzz testing and vulnerability scanning.

CI/CD and Version Control integration: Support for integration into DevOps workflows and test versioning using git or other tools.

o Additional Considerations:

Scalability & Maintenance: The tool should support modular test design and reusable test components to promote long-term maintenance and scalability.

User management and roles: Support for role-based access control and centralized license management.

Open Architecture/Extensibility: APIs or SDKs for extending the tool's capabilities or integrating with custom internal systems.

o Teleporter Requirements:

Teleporter is a team supported within the LEEP VS. The team requires the following:

A tool that provides functional automated UI testing that allows users to create, execute, and manage automated tests for web applications

Tests can be stored as code in a git repository

Tests can be run via CICD pipelines.

Tests can execute against multiple browsers (Chrome, Edge, Firefox, Safari) targeting both desktops and mobile devices

NCIC

o The National Crime Incident Center (NCIC) requires an automated Application Programming Interface (API) testing and service virtualization tool.

The tool shall possess a User Interface (UI) that allows for the management of automated API tests and service virtualization by non-coder type personnel.

The tool shall support functional testing, performance testing, security testing, and mocking (the ability to simulate and interact with external services that may not yet exist).

The tool shall support data-driven testing:

From multiple sources to include, but not limited to, files, databases, and spreadsheets.

Allows for multiple-source combinations.

Allows for looping.

Allows for conditional logic.

The tool shall provide customizable reports in a printable format (e.g., PDF, HTML).

The tool shall possess the ability to validate/verify properties of test steps within a test case, an entire test case, a test suite, or project using either metadata or the actual data.

The tool shall possess a scripting language for test case implementation.

The tool shall be capable of integrating with other Continuous

Integration/Continuous Delivery (CI/CD) tools.

At a minimum, the tool shall support Representative State Transfer (REST) and Simple Object Access Protocol (SOAP) web service interfaces.

The tool shall be supported by the vendor.

o NCIC requires an automated UI testing tool.

The tool shall possess a UI that allows for the management of automated UI tests by non-coder type personnel.

The tool shall support functional testing and regression testing of desktop, web-based and mobile applications.

The tool shall support both scripted and scriptless testing.

The tool shall support record and playback functionality.

The tool shall support data-driven testing.

The tool shall be capable of integrating with other CI/CD tools.

The tool shall provide self-healing functionality for automated tests.

The tool shall be supported by the vendor.

o NCIC requires an automated tool capable of executing the API tests from the first major bullet above in a headless (non-UI) manner within a CI/CD pipeline.

The tool shall support scalable test execution.

The tool shall be capable of integrating with other CI/CD tools.

The tool shall be able to be optimized for server environments.

The tool shall be supported by the vendor.

N-DEx o The National Data Exchange (N-DEx) requires a holistic end-to-end application to appropriately test their interface, underlying databases, and APIs. The following are the specifications required from a software/software suite:

Functional, automated UI testing that allows users to create, execute, and manage automated tests for web, database, and REST/SOAP API

Git source control for both tests and underlying resources, files, and Java Selenium frameworks, in a single repository

Multiple functional tests, each test for a specific procedure/functionality.

Modular architecture such that tests can run other tests or components of tests REST and SOAP API definitions with functional tests that can create requests on those resources, including certificates/authorizations (basic, OAuth 2.0, and possible more) that may be needed on certain requests

Querying PostgreSQL databases Multiple environments with different URL, endpoint, and credential values that can easily be swapped Custom scripts capable of interacting with the test infrastructure itself

(properties, running other tests, etc.) as well as importing and accessing a Java JAR of custom Selenium frameworks and Java utilities

Functional tests that can utilize a combination of scripts, database queries, and API calls, in sequence

Access to a local file system with ability to read from and write to files Performance testing with up to 1000 virtual users, varying percentage of load on different scenarios, and customizable test duration (up to 20 hours), with the ability to export results

Scheduling automated test procedure in an automated fashion, with ability to review results

Manual steps, if needed, that pause automation for user intervention before proceeding with additional automation o N-DEx currently requires ten (10) concurrent users, one thousand (1,000) virtual users for performance (load) testing, and the ability to run 10 tests concurrently.

NGI

o Next Generation Identification (NGI) requires a software or software suite for performance testing. The software will need to inject data into the NGI system for testing purposes that mimics the amount of work that the operational contributes submit daily. The software will also be utilized for driving testing suites for both system-level testing and performance-level testing. The software will ultimately be utilized in our non-operational system to simulate the workloads that we expect to see on a day-to-day basis within the operational system.

o NGI currently requires up to 70 concurrent/virtual users and the ability to run 50 concurrent tests.

NICS

o The National Instant Criminal Background System (NICS) Section’s test strategy is transitioning from a focus on User Interface (UI) testing to more efficient and scalable API/Service-level testing. This shift is designed to optimize test execution, streamline maintenance, and enhance the system’s lifecycle management.

Historically, automated UI testing, primarily through WebUI/Selenium, has been used. While effective, UI testing is labor-intensive, difficult to maintain, and is generally regarded as one of the most expensive testing methods due to its complexity and need for regular updates. To address these challenges, the team has initiated a transition to Application Programming Interface (API)/Service-level testing.

The software/software suite will need to be capable of supporting the following tasks:

Functional Testing:

o SOAP, RESTful APIs o Database Accuracy Testing to verify data consistency and correctness.

o NICS Optical Character Recognition (OCR) Web Service

Automation Logic:

o NICS Predictable Learning Automation of the NICS (PLAN)

Automation Logic o Database Accuracy Testing o National Crime Information Center Warrant Mandate

Scenarios Functional Testing/Business Logic Validation:

o NICS Indices Web Service o CJIS Watch o State Point of Contact eXtensible markup language (XML) o Streamlining Workflows (e.g., Waiting For Dispositions) to increase the efficiency of test execution.

o Tunable Parameter Testing for validating system performance under varying conditions.

Performance Testing:

o Load Testing to assess the system’s scalability and ability to handle traffic under real-world conditions.

Continuous Integration/Continuous Delivery (CI/CD):

o Integration with Jenkins for automated testing in the continuous integration/continuous deployment pipeline.

o Parallel execution of tests and data-driven test cases to improve test coverage and speed.

o Feedback loops for faster detection of issues and proactive system health monitoring.

Additional Requirements:

o Hours of Testing – 8:00AM to 5:00 PM ET Daily o Concurrent Licenses/Floating Licenses o CI/CD Integration o Load/Performance Testing o Easily Maintain Scripts o API and Service Level Testing o Scalable o Government Hosted

CD

o Crime Data (CD) requires a software/software suite capable of the following:

Functional, automated UI testing that allows users to create, execute, and manage automated tests for web, database, and REST/SOAP API

Git source control for both tests and underlying resources and files in a single repository

Multiple functional tests, each test for a specific procedure/functionality Modular architecture such that tests can run other tests or components of tests REST and SOAP API definitions with functional tests that can create requests on those resources, including certificates/authorizations (basic, OAuth 2.0, and possible more) that may be needed on certain requests

Multiple environments with different URL, endpoint, and credential values that can easily be swapped

Custom scripts capable of interacting with the test infrastructure itself (properties, running other tests, etc.)

Functional tests that can utilize a combination of scripts and API calls, in sequence

Access to a local file system with ability to read from and write to files Performance testing with up to 1000 virtual users, varying percentage of load on different scenarios, and customizable test duration, with the ability to export results

Manual steps that pause automation for user intervention before proceeding with additional automation

Ease of Use: User-Friendly design, good online documentation, customization options

Ability to integrate into the build pipeline Ability to hook into a Bamboo job to run when our builds run o CD requires at least four (4) concurrent users, one thousand (1,000) virtual users for performance (load) testing, and the ability to run 4 tests concurrently.

LEO

o The Law Enforcement Online (LEO) requires holistic end-to-end application to appropriately test their interface and APIs. The following are the specifications required from a software/software suite:

Functional, automated UI testing that allows users to create, execute, and manage automated tests for web, database, and REST/SOAP API

Git source control for both tests and underlying resources, files, and Java Selenium frameworks, in a single repository

Multiple functional tests, each test for a specific procedure/functionality Modular architecture such that tests can run other tests or components of tests REST and SOAP API definitions with functional tests that can create requests on those resources, including certificates/authorizations (basic, OAuth 2.0, and possible more) that may be needed on certain requests

Multiple environments with different URL, endpoint, and credential values that can easily be swapped

Custom scripts capable of interacting with the test infrastructure itself (properties, running other tests, etc.)

Functional tests that can utilize a combination of scripts and API calls, in sequence

Access to a local file system with ability to read from and write to files

Performance testing with up to 1000 virtual users, varying percentage of load on different scenarios, and customizable test duration, with the ability to export results

Manual steps that pause automation for user intervention before proceeding with additional automation o LEO currently requires four (4) concurrent users, one thousand (1,000) virtual users for performance (load) testing, and the ability to run 4 tests concurrently.

Value Stream(s) may request demos, depending on the responses received. Demos requested may include multiple Value Streams, if it is deemed necessary.

CONTRACTOR QUALIFICATIONS

This RFI is exclusively open to small businesses that are based in the United States, serving the purpose of market research into prospective software solution providers. No foreign companies will be considered. Eligible respondents include developers and manufacturers of software and platforms that align with the categories outlined in the BACKGROUND section above.

The Government is requesting information from providers capable of delivering the product or proposed software solution for this anticipated requirement. Interested parties are invited to identify themselves and respond to this Request for Information (RFI).The Government requests the following information:

1. Company name, business size, Duns Number and Cage Code

2. Provide demonstrated evidence to show that your company can provide the requested services and/or products required (i.e. technical ability, personnel, and experience).

Information provided shall be succinct and related to the requested information in this RFI. All submissions shall be unclassified.

3. Address whether your company has a GSA Schedule and if they are capable of providing these services on schedule. If able to provide the services on schedule, provide the schedule and SIN.

4. Any other assumptions, comments, concerns, and/or questions relating to the contemplated services.

REQUIRED INFORMATION

Contractor Legal/DBA Name:

Address:

Point of Contact:

Telephone:

Email Address:

DUNS Number:

Cage Code:

Facility Clearance:

Applicable NAICS Codes:

Standard Business Size:

GSA Schedule:

Other Schedules/Vehicles (if available):

CONTEMPLATED REQUIREMENT

FBI's CJIS Division is issuing this Request for Information (RFI) to:

Gather industry information on the enclosed requirements.

Request information on any industry changes or improvements that the FBI should consider when looking to achieve products and capabilities that meet requirements and are compatible with the commercial environment.

Request information on potential barriers to obtaining solutions that meet objectives needed to accomplish stated requirements. The areas of interest for contemplated requirements and scenarios are addressed below.

This RFI is for planning purposes only and shall not be considered as a request for proposal or an obligation on the part of the FBI to acquire and products or services. No entitlement to payment of direct or indirect costs or charges by the FBI will arise as a result of contractor submission of responses to this RFI or the FBI’s use of such information. The FBI reserves the right to reject, in whole or in part, any contractor’s input resulting from this RFI. Responses to this RFI will not be returned. The FBI may request demonstrations or request to test products after the review of proposals are completed. All questions regarding the RFI shall be in writing prior to submission date. The cost of responding to this RFI shall be exclusively borne by the contractor and no costs will be reimbursed by the FBI.

WHAT SHOULD BE INCLUDED IN YOUR RESPONSE

1. All interested parties shall submit capability packages in response to this notice.

2. Do submit succinct, thoughtful responses to the requirements/questions listed in this RFI.

3. Do submit comments that address the FBI's requirements, assumptions, conditions or contemplated approaches to this future acquisition.

4. Do submit information and suggestions that may encourage new, different, or innovative approaches that would result in products, solutions, and direct savings to the FBI.

WHAT SHOULD NOT BE INCLUDED IN YOUR RESPONSE

1. Do not submit proposals or offers.

2. Do not submit past performance information or general descriptions of corporate experience.

3. Do not submit requests to be considered for award or to be notified of a future solicitation.

4. Do not submit requests to be added to a mailing list or distribution list.

5. Do not submit questions or comments not related to this RFI.

6. Do not respond via telephone.

RFI SUBMITTAL INSTRUCTIONS:

All submissions shall be submitted electronically in Microsoft Word/Excel/PowerPoint or PDF format. All information should be UNCLASSIFIED material only. Submissions shall not exceed fifteen (15) one-sided 8 ½ x 11 pages. The pages shall have one inch margins and font size must be at least 12 point font.

All responses to this RFI must be submitted by 4PM ET on November 7, 2025. No extensions will be granted. Email subject line shall read- “Development, API, and UI Testing Software RFI” and send submissions to:

Contracting Officer Point of Contact: Meredith Mcie Email: mkmcie@fbi.gov

DISCLAIMER and RESPONSES THERE IS NO COMMITMENT BY THE

GOVERNMENT TO ISSUE A SOLICITATION AS A RESULT OF THIS RFI. THIS IS

BEING ISSUED SOLEY FOR INFORMATIONAL AND PLANNING PURPOSES AND

DOES NOT CONSTITUTE A SOLICTIATION. IN ACCORDANCE WITH FAR

15.202(e), RESPONSES TO THIS NOTICE ARE NOT OFFERS AND CANNOT BE

ACCEPTED BY THE GOVERNMENT TO FORM A BINDING CONTRACT. THIS IS

NOT A REQUEST FOR PROPOSAL OR QUOTE. IT DOES NOT CONSTITUTE A

SOLICITATION AND SHALL NOT BE CONSTRUED AS A COMMITMENT BY THE

GOVERNMENT. RESPONSES IN ANY FORM ARE NOT OFFERS AND THE

GOVERNMENT IS UNDER NO OBLIGATION TO AWARD A CONTRACT AS A

RESULT OF THIS ANNOUNCEMENT. NO FUNDS ARE AVAILABLE TO PAY FOR

PREPARATION OF RESPONSES TO THIS ANNOUNCEMENT. ANY INFORMATION

SUBMITTED BY RESPONDENTS TO THIS TECHNICAL DESCRIPTION IS

STRICTLY VOLUNTARY.

NO PHONE CALLS WILL BE ACCEPTED. THE GOVERNMENT RESERVES THE

RIGHT TO REQUEST VIRTUAL DEMONSTRATIONS FROM THOSE

RESPONDENTS BEST REPRESENTING THE REQUIRED CAPABILITIES WITHIN

THEIR SUBMISSIONS. NOT ALL RESPONDENTS MAY RECEIVE A REQUEST FOR

DEMONSTRATION. NO OFFERS WILL BE MADE AS A RESULT OF ANY

DEMONSTRATIONS.