API Reference

import { createClient } from "@supabase/supabase-js";

const supabase = createClient(SUPABASE_URL, SUPABASE_ANON_KEY);

// GitHub
await supabase.auth.signInWithOAuth({
  provider: "github",
  options: { redirectTo: `${window.location.origin}/auth/callback` },
});

curl https://app.certack.com/api/auth/welcome

curl -X POST https://app.certack.com/api/auth/welcome \
  -H "Authorization: Bearer YOUR_JWT"

const supabase = createClient(SUPABASE_URL, SUPABASE_ANON_KEY);
await supabase.auth.signOut();
window.location.href = "/auth/login";

{
  "sites": [
    {
      "id": "a1b2c3d4-...",
      "domain": "example.com",
      "check_types": ["ssl", "dns", "domain"],
      "alert_days": 14,
      "monitoring_enabled": true
    }
  ],
  "plan": "pro",
  "userId": "user-uuid-..."
}

curl https://app.certack.com/api/sites \
  -H "Authorization: Bearer sp_YOUR_KEY"

curl -X POST https://app.certack.com/api/sites \
  -H "Authorization: Bearer sp_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"domain":"example.com","check_types":["ssl","dns","domain"]}'

curl -X PATCH "https://app.certack.com/api/sites?id=SITE_ID" \
  -H "Authorization: Bearer sp_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"alert_days": 7}'

curl -X DELETE "https://app.certack.com/api/sites?id=SITE_ID" \
  -H "Authorization: Bearer sp_YOUR_KEY"

curl https://app.certack.com/api/api-keys \
  -H "Authorization: Bearer sp_YOUR_KEY"

curl -X POST https://app.certack.com/api/api-keys \
  -H "Authorization: Bearer sp_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name": "my-agent-key"}'

curl -X DELETE "https://app.certack.com/api/api-keys?id=KEY_ID" \
  -H "Authorization: Bearer sp_YOUR_KEY"

{
  "valid": true,
  "issuer": "CN=WR3, O=Google Trust Services",
  "expires_at": "2026-09-15T00:00:00.000Z",
  "days_remaining": 98,
  "san": ["example.com", "www.example.com"],
  "chain_complete": true,
  "chain_error": null,
  "protocol_version": "TLSv1.3",
  "cipher_name": "TLS_AES_256_GCM_SHA384",
  "cipher_strength": 256,
  "tls_grade": "A+",
  "hsts": { "enabled": true, "max_age": 31536000, "include_sub_domains": true, "preload": true },
  "ocsp_stapling": true,
  "mixed_content": null,
  "error": null
}

curl -X POST https://app.certack.com/api/check-ssl \
  -H "Authorization: Bearer sp_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"domain": "example.com"}'

curl -X POST https://app.certack.com/api/check-dns \
  -H "Authorization: Bearer sp_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"domain": "example.com"}'

curl -X POST https://app.certack.com/api/check-domain \
  -H "Authorization: Bearer sp_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"domain": "example.com"}'

curl "https://app.certack.com/api/checks?site_id=SITE_ID&check_type=ssl&limit=10" \
  -H "Authorization: Bearer sp_YOUR_KEY"

curl -X POST https://app.certack.com/api/checks \
  -H "Authorization: Bearer sp_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"site_id":"SITE_ID","check_type":"ssl","result":{"valid":true}}'

{
  "alerts": [
    {
      "id": "alert-uuid-...",
      "type": "ssl",
      "severity": "critical",
      "message": "SSL certificate expires in 3 days",
      "suggestion": "Renew your SSL certificate immediately",
      "is_resolved": false,
      "site_id": "site-uuid-...",
      "created_at": "2026-06-06T08:00:01.000Z"
    }
  ],
  "total": 1,
  "limit": 50,
  "offset": 0
}

curl "https://app.certack.com/api/alerts?severity=critical&limit=10" \
  -H "Authorization: Bearer sp_YOUR_KEY"

curl -X PATCH "https://app.certack.com/api/alerts?id=ALERT_ID" \
  -H "Authorization: Bearer sp_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"is_resolved": true}'

curl "https://app.certack.com/api/cert-history?site_id=SITE_ID" \
  -H "Authorization: Bearer sp_YOUR_KEY"

curl -X POST https://app.certack.com/api/renewal \
  -H "Authorization: Bearer sp_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"site_id": "SITE_ID"}'

curl -X PATCH https://app.certack.com/api/settings/notifications \
  -H "Authorization: Bearer sp_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"email": true, "slack_webhook_url": "https://hooks.slack.com/services/..."}'

curl "https://app.certack.com/api/public/check-ssl?domain=google.com"

# Upgrade to the Team plan, billed yearly
curl -X POST https://app.certack.com/api/checkout \
  -H "Authorization: Bearer sp_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"planId":"team","billing":"yearly"}'

curl https://app.certack.com/api/billing/status \
  -H "Authorization: Bearer sp_YOUR_KEY"

# Cancel by deleting the account (also cancels subscription)
curl -X DELETE https://app.certack.com/api/account \
  -H "Authorization: Bearer sp_YOUR_KEY"

{
  "id": "evt_abc123",
  "type": "checkout.completed",
  "product": { "id": "prod_team_monthly" },
  "customer": { "id": "cust_xyz", "email": "you@example.com" },
  "metadata": { "planId": "team", "billing": "monthly", "userId": "user-uuid" }
}

curl https://app.certack.com/api/account \
  -H "Authorization: Bearer sp_YOUR_KEY"

curl -X PATCH https://app.certack.com/api/account \
  -H "Authorization: Bearer sp_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"full_name":"Jane Doe"}'

curl -X DELETE https://app.certack.com/api/account \
  -H "Authorization: Bearer sp_YOUR_KEY"

curl -X POST "https://app.certack.com/api/cron" \
  -H "Authorization: Bearer YOUR_CRON_SECRET"

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": { "name": "check_ssl", "arguments": { "domain": "example.com" } }
}

{
  "source": "Certack",
  "timestamp": "2026-06-23T08:00:01.000Z",
  "alerts": [
    {
      "domain": "example.com",
      "type": "ssl.expiring",
      "severity": "critical",
      "message": "SSL certificate expires in 3 days",
      "suggestion": "Renew your SSL certificate immediately to avoid service disruption"
    }
  ]
}

{
  "source": "Certack",
  "timestamp": "2026-06-23T10:30:00.000Z",
  "alerts": [
    {
      "domain": "example.com",
      "type": "dns.changed",
      "severity": "warning",
      "message": "DNS A record changed from 1.2.3.4 to 5.6.7.8",
      "suggestion": "Verify this DNS change was intentional — unexpected changes may indicate DNS hijacking"
    }
  ]
}

import express from "express";

const app = express();
app.use(express.json());

app.post("/webhook/certack", (req, res) => {
  const { source, timestamp, alerts } = req.body;

  // Verify the source
  ifsource !== "Certack") {
    return res.status(400).send("Invalid source");
  }

  // Process each alert
  forconst alert of alerts) {
    switchalert.type) {
      case "ssl.expiring":
      case "ssl.expired":
        // Page the on-call engineer
        console.log(`[${alert.severity}] ${alert.domain}: ${alert.message}`);
        break;
      case "dns.changed":
        // Log for security review
        console.log(`DNS change on ${alert.domain}: ${alert.message}`);
        break;
      default:
        console.log(`Unknown event: ${alert.type}`);
    }
  }

  // Always respond with 2xx to acknowledge receipt
  res.status(200).send("OK");
});

app.listen(3000, () => console.log("Webhook receiver on :3000"));

from flask import Flask, request, jsonify
import logging

app = Flask(__name__)

@app.route("/webhook/certack", methods=["POST"])
def certack_webhook():
    data = request.json
    if data.get"source") != "Certack":
        return jsonify({"error": "Invalid source"}), 400

    for alert in data.get"alerts", []):
        event_type = alert["type"]
        domain = alert["domain"]
        message = alert["message"]

        if event_type in"ssl.expiring", "ssl.expired"):
            # Page the on-call engineer
            logging.critical(f"[{alert['severity']}] {domain}: {message}")
        elif event_type == "dns.changed":
            # Log for security review
            logging.warning(f"DNS change on {domain}: {message}")

    return jsonify({"status": "ok"}), 200

if __name__ == "__main__":
    app.run(port=3000)

{
  "source": "Certack",
  "timestamp": "2026-06-23T12:00:00.000Z",
  "alerts": [
    {
      "domain": "test.example.com",
      "type": "ssl.expiring",
      "severity": "info",
      "message": "This is a test webhook from Certack",
      "suggestion": "If you received this, your webhook is configured correctly"
    }
  ]
}

# .github/workflows/verify-ssl.yml
name: Verify SSL Certificate
on:
  deployment_status:
    states: [success]

jobs:
  verify-ssl:
    runs-on: ubuntu-latest
    steps:
      - name: Check SSL certificate
        run: |
          RESPONSE=$(curl -s \
            "https://app.certack.com/api/public/check-ssl?domain=${{ secrets.DOMAIN }}")
          VALID=$(echo "$RESPONSE" | jq -r '.valid')
          DAYS=$(echo "$RESPONSE" | jq -r '.days_remaining')

          if [ "$VALID" != "true" ]; then
            echo "::error::SSL certificate is invalid!"
            exit 1
          fi

          if [ "$DAYS" -lt 7 ]; then
            echo "::warning::SSL certificate expires in $DAYS days"
          fi

          echo "✅ SSL valid, $DAYS days remaining"

import requests
import json
from datetime import datetime

BASE = "https://app.certack.com"
HEADERS = {"Authorization": "Bearer sp_YOUR_KEY"}
SLACK_WEBHOOK = "https://hooks.slack.com/services/..."

# Get all monitored sites
sites = requests.getf"{BASE}/api/sites", headers=HEADERS).json()["sites"]

issues = []
for site in sites:
    domain = site["domain"]

    # Run SSL check
    ssl = requests.post(f"{BASE}/api/check-ssl",
        headers=HEADERS, json={"domain": domain}).json()

    if not ssl.get"valid") or ssl.get"days_remaining", 999) < 14:
        issues.append{
            "domain": domain,
            "valid": ssl.get"valid"),
            "days_remaining": ssl.get"days_remaining"),
            "error": ssl.get"error"),
        })

# Send Slack notification if issues found
if issues:
    blocks = [{"type": "section", "text": {"type": "mrkdwn",
        "text": f":warning: *{len(issues)} site(s) need attention*"}}]
    for issue in issues:
        status = "❌ Invalid" if not issue["valid"] else f"⚠️ {issue['days_remaining']} days left"
        blocks.append{"type": "section", "text": {"type": "mrkdwn",
            "text": f"*{issue['domain']}* — {status}"}})

    requests.post(SLACK_WEBHOOK, json={"blocks": blocks})
    printf"Sent alert for {len(issues)} issues")
else:
    printf"All {len(sites)} sites OK at {datetime.now()}")

import requests

BASE = "https://app.certack.com"
HEADERS = {"Authorization": "Bearer sp_YOUR_KEY"}

# Domains under maintenance
MAINTENANCE_DOMAINS = ["staging.example.com", "api-staging.example.com"]

# Get all unresolved alerts
alerts = requests.get
    f"{BASE}/api/alerts",
    headers=HEADERS,
    params={"resolved": "false"}
).json()["alerts"]

# Acknowledge alerts for domains under maintenance
for alert in alerts:
    if alert["domain"] in MAINTENANCE_DOMAINS:
        requests.patch(
            f"{BASE}/api/alerts",
            headers=HEADERS,
            json={
                "id": alert["id"],
                "resolved": True,
                "note": "Auto-acked: scheduled maintenance window"
            }
        )
        printf"Acked alert #{alert['id']} for {alert['domain']}")

// Deploy this as a serverless function
// Set CERTACK_WEBHOOK_SECRET and PAGERDUTY_INTEGRATION_KEY as env vars

export default async function handler(req: Request): Promise<Response> {
  const body = await req.json();

  // Verify source
  ifbody.source !== "Certack") {
    return new Response("Invalid source", { status: 400 });
  }

  // Forward each critical alert to PagerDuty
  forconst alert of body.alerts) {
    ifalert.severity !== "critical") continue;

    await fetch("https://events.pagerduty.com/v2/enqueue", {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({
        routing_key: process.env.PAGERDUTY_INTEGRATION_KEY,
        event_action: "trigger",
        payload: {
          summary: `[${alert.type}] ${alert.message}`,
          severity: "critical",
          source: alert.domain,
          custom_details: {
            domain: alert.domain,
            suggestion: alert.suggestion,
          },
        },
      }),
    });
  }

  return new Response("OK", { status: 200 });
}

# Add Certack monitoring for a new service
resource "http_request" "certack_site" {
  url = "https://app.certack.com/api/sites"
  method = "POST"

  headers = {
    Authorization = "Bearer sp_YOUR_KEY"
    Content-Type  = "application/json"
  }

  body = jsonencode({
    domain       = "api.example.com"
    check_types  = ["ssl", "dns", "domain"]
    alert_days   = 14
  })

  # Re-run when domain changes
  triggers = {
    domain = "api.example.com"
  }
}

# Output the site ID
output "certack_site_id" {
  value = jsondecode(http_request.certack_site.response_body).site.id
}

{
  "error": "Unauthorized"
}

import requests

BASE = "https://app.certack.com"
HEADERS = {
    "Authorization": "Bearer sp_YOUR_KEY",
    "Content-Type": "application/json",
}

# List sites
sites = requests.getf"{BASE}/api/sites", headers=HEADERS).json()

# Add a site
new_site = requests.post(f"{BASE}/api/sites", headers=HEADERS, json={
    "domain": "example.com",
    "check_types": ["ssl", "dns", "domain"],
}).json()

# Run SSL check
ssl = requests.post(f"{BASE}/api/check-ssl", headers=HEADERS, json={
    "domain": "example.com",
}).json()
printf"SSL valid: {ssl['valid']}, Days left: {ssl['days_remaining']}")

# Get critical alerts
alerts = requests.getf"{BASE}/api/alerts", headers=HEADERS, params={
    "severity": "critical",
}).json()
for alert in alerts["alerts"]:
    printf"[{alert['severity']}] {alert['message']}")

package main

import
    "bytes"
    "encoding/json"
    "fmt"
    "net/http"
)

const base = "https://app.certack.com"
const apiKey = "sp_YOUR_KEY"

func main() {
    // Add a site
    payload, _ := json.Marshal(map[string]any{
        "domain":      "example.com",
        "check_types": []string{"ssl", "dns", "domain"},
    })
    req, _ := http.NewRequest("POST", base+"/api/sites", bytes.NewReader(payload))
    req.Header.Set("Authorization", "Bearer "+apiKey)
    req.Header.Set("Content-Type", "application/json")
    resp, _ := http.DefaultClient.Do(req)
    defer resp.Body.Close()
    fmt.Println("Status:", resp.StatusCode)

    // Public SSL check (no auth)
    resp, _ = http.Get(base + "/api/public/check-ssl?domain=google.com")
    defer resp.Body.Close()
    var result map[string]any
    json.NewDecoder(resp.Body).Decode(&result)
    fmt.Println("Valid:", result["valid"])
}

const BASE = "https://app.certack.com";
const headers = {
  Authorization: "Bearer sp_YOUR_KEY",
  "Content-Type": "application/json",
};

// Add a site
const { site } = await fetch(`${BASE}/api/sites`, {
  method: "POST",
  headers,
  body: JSON.stringify({
    domain: "example.com",
    check_types: ["ssl", "dns", "domain"],
  }),
}).then(r => r.json());

// Run SSL check
const ssl = await fetch(`${BASE}/api/check-ssl`, {
  method: "POST",
  headers,
  body: JSON.stringify({ domain: "example.com" }),
}).then(r => r.json());
console.log(`SSL valid: ${ssl.valid}, Days left: ${ssl.days_remaining}`);

// Get alerts
const { alerts } = await fetch(
  `${BASE}/api/alerts?severity=critical`,
  { headers }
).then(r => r.json());
alerts.forEach((a: any) => console.log(`[${a.severity}] ${a.message}`));