domains

Get Domain Certificates

Return all certificates associated with the given domain name.

valid_only=true is a convenience alias for expired=false. When both expired and valid_only are supplied, expired takes precedence.

Every row carries first_seen (earliest CT observation) and last_seen (latest CT observation — observation-based: a stale value means the cert rolled out of our observation window, not that it was revoked).

get/v1/domains/{domain}/certificates

Request

  • Base URL: https://api.ctindex.io
  • URL: https://api.ctindex.io/v1/domains/{domain}/certificates
  • Auth: one of:
    • API key in header X-API-Key
    • HTTP bearer

Path parameters

domainstring required

Query parameters

pageinteger
limitinteger
cursorstring nullable

Opaque keyset cursor (task #615 / GH #263). Pass cursor='*' (the coalescing-proof start token) to start a cursor enumeration, then the next_cursor from each response until it is null (cursor-mode pages ALWAYS carry the next_cursor key; an explicit null marks the terminal page). Cursor pages are ordered newest-first by observation (monotone internal id) and are stable against concurrent inserts — new certificates never shift, repeat, or drop rows on later pages. When cursor is supplied, page is ignored. Omit cursor entirely for the classic offset pagination (unchanged). Legacy: cursor= (empty string) also starts enumeration but may be coalesced to null by some transports.

expiredboolean nullable

true → only expired certs, false → only currently valid, omit → all

valid_onlyboolean nullable

Convenience alias: true is equivalent to expired=false (valid certs only)

include_enrichmentboolean

When true, attach RDAP registration + live DNS + ASN/hosting context for the domain under enrichment (task #501). Opt-in; a slow/failed source degrades to a partial block and never fails the lookup.

include_signalsboolean

When true, attach derived attribution signals under enrichment.signals: issuer_diversity_score (0.0 single CA → 1.0 at 5+ distinct CAs), wildcard_breadth (distinct wildcard patterns, with wildcard_names), third_party_vendors (SaaS vendors inferred from the domain's TXT/SPF inventory), and weak_crypto_reasons (explicit reasons, e.g. RSA < 2048 or SHA-1 signatures). Implies enrichment computation. Requires a paid plan (Pro or higher); the free tier receives HTTP 403 tier_not_entitled.

as_ofstring nullable

ISO-8601 datetime — point-in-time view (task #613): only certificates first observed at or before as_of are returned, and each row's last_seen is capped at as_of. Inventory is observation-based (CT sightings), so this is 'what CertIndex knew then', not what was live then.

logged_at_afterstring nullable

ISO-8601 datetime — only certificates whose CT-log timestamp (logged_at, RFC 6962 SCT leaf time) is on or after this instant. This is the buyer-visible freshness probe (GH #308 Decision 4): domain listing, not a SHA-256 lookup. Rows with logged_at NULL are excluded by the predicate.

logged_at_beforestring nullable

ISO-8601 datetime — only certificates whose logged_at is on or before this instant. See logged_at_after.

Cookies

ctix_sessionstring nullable

Response

Successful Response

domainstring required
totalinteger required
pageinteger required
limitinteger required
has_moreboolean
next_cursorstring nullable
backfill_statusstring nullable
retry_after_secondsinteger nullable
hintstring nullable
progressobject nullable
typical_eta_secondsinteger nullable
eta_secondsinteger nullable
eta_basisstring nullable
coverageobject nullable
total_is_lower_boundboolean

True when total is a FLOOR rather than an exact count. An in-progress backfill (lower_bound_reason=backfill_in_progress) always sets this — the inventory is still growing. Other causes match the subdomain envelope: coverage_scope (scan did not finish or never ran), query_budget (this page did not fit). Completed active_only is exact within that window and does NOT set this flag.

lower_bound_reasonstring nullable

Why total is a lower bound. backfill_in_progress = an on-demand backfill is still running; re-query later. coverage_scope = the scan did not finish within the advertised product scope, did not establish what it reached, or never ran; retrying returns the identical count. query_budget = this page did not fit; repaginate. query_budget_and_backfill_in_progress = both truncated page and running backfill. Absent when total_is_lower_bound is false.

cold_tier_supplement_statusstring nullable

Tier 1 cold exact-name supplement for this page (GH #1462). ok = cold answered or confirmed no extra rows within the latency budget; unavailable = configured but unreachable (timeout, breaker, or misconfigured URL); pending = still in flight when the response was assembled. Omitted when cold was not consulted (filters on) or TIER1_COLD_QUERY_URL unset.

Changes

No recorded changes to this operation across all 1 revision of this API.