Domain

Upload BIMI assets

Ingests a Verified Mark Certificate (VMC), extracts and verifies the logotype SVG embedded in the certificate, and hosts the matched certificate + logo pair at per-domain asset URLs with a short content-derived version suffix ({domain}/bimi/logo-{v}.svg and {domain}/bimi/certchain-{v}.pem). Re-posting the same PEM returns the same URLs; a new PEM gets fresh URLs so caches never serve stale assets.

post/domains/{id}/bimi/assets

Request

  • Base URL: https://api.palisade.email
  • URL: https://api.palisade.email/domains/{id}/bimi/assets
  • Auth: one of:
    • HTTP bearer
    • HTTP basic

Path parameters

idstring uuid required

Headers

Palisade-Version'2025-04-30' | 'unstable' required

Request body

certificate_pemstring

The VMC as a PEM string. Alternative to the multipart certificate file part.

certificate_urlstring uri

An https URL to fetch the VMC PEM from. Alternative to the multipart certificate file part.

Response

Success

certificate_urlstring uri required
logo_urlstring uri required
logotype_verifiedboolean required

The SVG hosted at logo_url was recovered from the certificate's logotype extension and matches the digest the certificate asserts. This covers the logo only — it says nothing about whether the certificate chain validates. Read chain_verified for that.

svg_profile'tiny-ps' required
chain_verifiedboolean required

The hosted certificate chain was verified end to end: every signature checks out, no certificate in the path is expired, and the path terminates in a pinned BIMI trust anchor. Uploads that cannot reach this state are rejected, so a 200 response always carries true.

chain_lengthinteger required

How many certificates the hosted chain contains, counting the VMC leaf, intermediates and root.

chain_repairedboolean required

True when the uploaded PEM was missing certificates and Palisade completed the chain (fetching the intermediate from the certificate's Authority Information Access endpoint and appending the pinned root) before hosting it. The hosted chain, not the uploaded one, is what certificate_url serves.

trust_anchorstring required

Common name of the pinned VMC root the hosted chain terminates in.

san_verifiedboolean required

The leaf certificate's subjectAltName covers the domain the assets were attached to.

not_afterstring date-time required

When the VMC leaf expires. VMCs are one-year certificates, so this is worth tracking.

warningsstring[] required

Non-fatal observations about the certificate. "vmc-mark-type-oid-missing" means the leaf does not carry the VMC mark-type OIDs under 1.3.6.1.4.1.53087, which is certificate-authority dependent and does not block hosting.

Changes

No recorded changes to this operation across all 1 revision of this API.