web.ssl_cert

stable 2 credits

TLS certificate of a host: issuer, validity window, SANs, protocol, verification result.

GET /v1/web/ssl_cert

What you get#

One Web record in Onekey's unified shape, in data. If the record does not exist you get a 404 not_found and are not charged.

What it costs#

2 credits for a fresh fetch, charged only when it succeeds.
Free when served from cache (0.2 credit for a cached response over 100 KB).
Free if the request is invalid (never charged) or the source fails or reports not found (refunded).

Parameters#

Name	Type	Required	Default	What it is	Constraints
`url`	string	yes	(required)	Absolute http(s) URL of the page (ports 80/443 only; private/internal hosts are refused)	max 2048 chars; must match `https?://[A-Za-z0-9](?:[A-Za-z0-9.-]{0,251}[A-Za-z0-9])?(?::(?:80\|443))?(?:[/?][\x21-\x5b\x5d-\x7e]*)?`; trimmed

Request#

curl "https://api.onekey.dev/v1/web/ssl_cert?url=https%3A%2F%2Fwww.python.org%2F" \
  -H "x-api-key: YOUR_API_KEY"

Try it

Add your key to run this call right here. No key? Get one free. The key stays in this tab.

Recorded response#

A real Web response, recorded and returned in Onekey's shape. Fields the platform does not provide are null.

json

{
  "success": true,
  "data": {
    "entity": {
      "name": "www.python.org"
    },
    "ext": {
      "host": "www.python.org",
      "issuer": "GlobalSign Atlas R3 DV TLS CA 2025 Q4",
      "issuerOrganization": "GlobalSign nv-sa",
      "notBefore": "2026-01-13T13:03:46Z",
      "notAfter": "2027-02-14T13:03:45Z",
      "daysRemaining": 138,
      "valid": true,
      "expired": false,
      "verified": true,
      "verifyError": null,
      "san": [
        "www.python.org",
        "*.python.org",
        "python.org"
      ],
      "protocol": "TLSv1.3",
      "cipher": "TLS_AES_128_GCM_SHA256",
      "serialNumber": "01FC68FD084537B393B8D6C708974969"
    }
  },
  "metadata": {
    "platform": "web",
    "endpoint": "ssl_cert",
    "cached": false,
    "stale": false,
    "age_s": 0,
    "fetched_at": "2026-01-01T12:00:00+00:00",
    "credits_charged": 2,
    "request_id": "7f3a9c2e5b1d4c8fa2e6d0b9c4f18e37"
  },
  "error": null
}

Field mapping#

How this endpoint's source fields become Onekey's unified schema. Fields the source lacks come back as null.

Source path	Onekey field	Transform
`subject`	`entity.name`	-
`host`	`ext.host`	-
`issuer`	`ext.issuer`	-
`issuerOrganization`	`ext.issuerOrganization`	-
`notBefore`	`ext.notBefore`	`toIsoDate`
`notAfter`	`ext.notAfter`	`toIsoDate`
`daysRemaining`	`ext.daysRemaining`	`toNumber`
`valid`	`ext.valid`	`toBoolean`
`expired`	`ext.expired`	`toBoolean`
`verified`	`ext.verified`	`toBoolean`
`verifyError`	`ext.verifyError`	-
`san`	`ext.san`	-
`protocol`	`ext.protocol`	-
`cipher`	`ext.cipher`	-
`serialNumber`	`ext.serialNumber`	-

Caching and freshness#

Fresh for about 10 minutes. Repeat calls in that window are served from cache and are free.
Between 10 minutes and 1 hour the cached copy is still served instantly and marked stale: true while Onekey refreshes it in the background.
If the source is down when a refresh is needed, the last copy can be served for up to 1 hour more (marked stale).
A "not found" is remembered for 2 minutes and is free.
The cache is shared across all customers, which is what keeps repeat calls cheap.

What can go wrong#

Status	Code	What to do
401	`unauthorized`	Check the `x-api-key` header.
402	`insufficient_credits`	Add credits; your balance must cover the price.
404	`not_found`	That record does not exist. Free; do not retry.
422	`invalid_params`	Fix the parameters using the table above. Free.
429	`rate_limited`	Wait `Retry-After` seconds, then retry.
502	`upstream_error`	The source failed. Refunded; retry with backoff.

See Errors for the full list and retry guidance.

Status: stable (verified against the live source).