API v1

Build on certificate evidence.

Stable JSON contracts for search, enrichment, saved hunts, and endpoint observations. Provider coverage is returned with every search.

Authentication

Evidence endpoints can be explored anonymously under burst limits. Create a reveal-once personal key in the workspace for durable monthly metering. Saved-hunt and key-management endpoints use the Better Auth session cookie.

curl "http://localhost:3000/api/v1/search?q=example.com" \
  -H "Authorization: Bearer cs_live_your_key"

Make your first search

Query type is detected automatically. Set type explicitly when building deterministic automation.

curl "http://localhost:3000/api/v1/search?q=example.com&type=domain" \
  -H "Accept: application/json"

Try the endpoint in this build: open JSON response.

Endpoints

GET/api/v1/search

Search domains, fingerprints, issuers, and subjects

GET/api/v1/domains/{domain}

Domain summary and connected evidence

GET/api/v1/domains/{domain}/certificates

Configured certificate evidence for a domain

GET/api/v1/certificates/{sha256}

Parsed certificate record and provenance

GET/api/v1/api-keys

List personal keys and monthly usage

POST/api/v1/api-keys

Create a reveal-once personal key

GET/api/v1/hunts

List signed-in user's saved hunts

POST/api/v1/hunts

Save or update a normalized hunt

POST/api/v1/scans/tls

Explicit live TLS observation

Structured errors

Failures always include a stable machine-readable code and request identifier. Rate-limit responses also include retryAfter.

{
  "code": "invalid_query",
  "message": "Enter a domain, fingerprint, issuer, or subject.",
  "requestId": "8ec57f6c-..."
}

Rate limits and usage

Bearer API calls receive 100 development units per UTC month: exact and non-domain searches cost 1 unit, domain evidence costs 5, and active TLS observations cost 10. Provider failures are refunded. Console/API quota unification remains a paid-launch gate.

View planned quotas