domains

Get Domain Latest

Return the most recently issued certificate for the domain.

get/v1/domains/{domain}/latest

Request

  • Base URL: https://api.ctindex.io
  • URL: https://api.ctindex.io/v1/domains/{domain}/latest
  • Auth: one of:
    • API key in header X-API-Key
    • HTTP bearer

Path parameters

domainstring required

Query parameters

include_enrichmentboolean

When true, attach RDAP registration + live DNS + ASN/hosting context for the domain under enrichment (task #501). Opt-in; a slow/failed source degrades to a partial block and never fails the lookup.

include_signalsboolean

When true, attach derived attribution signals under enrichment.signals: issuer_diversity_score, wildcard_breadth, third_party_vendors (from the domain's TXT/SPF inventory), and weak_crypto_reasons. Implies enrichment computation. Requires a paid plan (Pro or higher); the free tier receives HTTP 403 tier_not_entitled.

Cookies

ctix_sessionstring nullable

Response

Successful Response

sha256string required
subject_cnstring nullable
subject_ostring nullable
sansstring[]
issuer_cnstring nullable
issuer_ostring nullable
not_beforestring date-time nullable
not_afterstring date-time nullable
is_wildcardboolean
is_precertboolean

True when this row is a CT precertificate (poison-extension log entry), False for a final leaf certificate. Precert and final-leaf twins have different SHA-256 hashes and are returned as separate rows; present on every list and detail row. Exception (GH #262): get_expiring_certs collapses twin pairs to the final leaf by default.

precert_sha256string nullable

SHA-256 fingerprint of the CT precertificate twin that was collapsed into this final-leaf row (get_expiring_certs default twin collapsing, GH #262). Omitted when no twin was collapsed.

key_typestring nullable
key_sizeinteger nullable
signature_algorithmstring nullable
is_weak_cryptoboolean nullable
key_fields_sourcestring nullable
first_seenstring date-time nullable

When CertIndex wrote this certificate to its database (batch-write timestamp). Multiple unrelated certificates often share an identical first_seen within the same ingestion batch. It is not the CT-log append time and is never substituted for a missing logged_at. Compare with logged_at to measure detection latency.

logged_atstring date-time nullable

Timestamp from the CT log entry itself (MerkleTreeLeaf TimestampedEntry.timestamp, RFC 6962 §3.4) — when the log committed this certificate, NOT when CertIndex ingested it. Null for rows indexed before this field shipped, for crt.sh-sourced rows (reconciled_from_crtsh=true), and for any path that could not supply it. A null value means the CT-log timestamp is unavailable for that row; it does not mean the certificate was observed at first_seen, and first_seen is never synthesized into logged_at. Compare with first_seen (CertIndex write time) to measure detection latency. See logged_at_coverage disclosure block.

reconciled_from_crtshboolean nullable
last_seenstring date-time nullable
match_classstring nullable

Attribution class when match_class_filter was supplied on search: first_party, lookalike_candidate, third_party_integration, substring_collision, or shared_hosting. Null on unfiltered search.

match_reasonstring nullable

Semicolon-separated rule=value audit string for match_class. Null on unfiltered search.

from_cold_tierboolean nullable

True when this certificate was served exclusively from the Tier 1 cold ClickHouse index (historical data not present in the hot Neon index). Absent/null for certificates served from the primary index. Cold-sourced rows carry key_fields_source='unavailable' and no raw_pem.

raw_pemstring nullable
log_idstring nullable
leaf_indexinteger nullable

Changes

No recorded changes to this operation across all 1 revision of this API.