API reference

Base URL & conventions

All requests go to https://api.autocertify.net. Authenticated resources live under the /v1/ prefix, and both requests and responses use application/json. Endpoints below are tagged Bearer token or Public.

Authentication

Send Authorization: Bearer <token>. Today the token is an access token issued to your session by Auth0 and verified against Auth0’s JWKS. Scoped, long-lived API keys (ac_live_…) for server-to-server automation are part of the developer preview. API access is a Business Pro and Scale capability.

Responses & errors

Successful calls return the resource (or a small result object) directly with a 2xx status. Errors return a single envelope; validation failures come back as 400 validation_error with per-field details.

{
  "status": 400,
  "code": "validation_error",
  "message": "apex must be a valid domain name.",
  "details": [
    { "field": "apex", "issue": "invalid_hostname" }
  ]
}

Idempotency

Certificate issuance accepts an Idempotency-Key header. Replaying a request with the same key returns the original result instead of issuing a second time — safe for retries.

curl -X POST https://api.autocertify.net/v1/domains/dom_8Qp3v1c7/certificates/issue \
  -H "Authorization: Bearer $AUTOCERTIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: 3f0c2a9e-1b7d-4e52-9a10-8c6b5d4e3f21" \
  -d '{}'

Pagination & filtering

List operations are POST …/query endpoints that take a page object with a limit, plus optional filters, and return items with a total.

{
  "q": "example.com",
  "status": "active",
  "validationStatus": "verified",
  "page": { "limit": 50 }
}

{
  "items": [
    {
      "id": "dom_8Qp3v1c7",
      "apex": "shop.example.com",
      "status": "active",
      "validationStatus": "verified",
      "tags": ["storefront"],
      "createdAt": "2026-02-04T18:22:10Z"
    }
  ],
  "total": 1
}

Rate limits

Per token, in a rolling 15-minute window. Exceeding a bucket returns 429.

• auth — 20 requests / 15 min (sign-up, session, logout).
• public — 60 requests / 15 min (public verification-link views and checks).
• site-scan — 120 requests / 15 min (domain scanning and health checks).

Authentication

Create an account and manage the current session. Sign-up is public; the rest use the session token.

{
  "email": "[email protected]",
  "password": "a-strong-passphrase",
  "domain": "shop.example.com"
}

{
  "userEmail": "[email protected]",
  "domain": "shop.example.com",
  "portalUrl": "https://app.autocertify.net",
  "authProvider": "auth0"
}

Domains

A Domain is a hostname you want to secure. It carries a status (pending, active or error), a validationStatus, its delegationRecord, an optional clientId, tags, and createdAt.

{
  "apex": "shop.example.com",
  "contactEmail": "[email protected]",
  "tags": ["storefront"]
}

{
  "id": "dom_8Qp3v1c7",
  "apex": "shop.example.com",
  "status": "pending",
  "validationStatus": "pending",
  "delegationRecord": {
    "type": "CNAME",
    "host": "_acme-challenge.shop.example.com",
    "value": "shop.example.com.a1b2c3d4.dcv.cloudflare.com",
    "ttl": 300
  },
  "tags": ["storefront"],
  "createdAt": "2026-02-04T18:22:10Z"
}

{
  "type": "CNAME",
  "host": "_acme-challenge.shop.example.com",
  "value": "shop.example.com.a1b2c3d4.dcv.cloudflare.com",
  "ttl": 300
}

{
  "status": "verified",
  "checkedAt": "2026-02-04T18:41:52Z",
  "message": "Delegation confirmed. Certificate issuance has started.",
  "certificate": {
    "certificateId": "crt_5Nb2Kq9w",
    "status": "pending",
    "nextRenewalAt": null,
    "message": "Issuance started via Cloudflare for SaaS."
  }
}

Certificates

Certificates are DV, publicly-trusted, and issued via Cloudflare for SaaS (not Let’s Encrypt). A Certificate has a status (pending, active or error), an issuer of Cloudflare for SaaS Managed CA, and notBefore / notAfter / nextRenewalAt timestamps.

curl -X POST https://api.autocertify.net/v1/domains/dom_8Qp3v1c7/certificates/issue \
  -H "Authorization: Bearer $AUTOCERTIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: 3f0c2a9e-1b7d-4e52-9a10-8c6b5d4e3f21" \
  -d '{}'

{
  "certificateId": "crt_5Nb2Kq9w",
  "status": "pending",
  "nextRenewalAt": null,
  "message": "Issuance started via Cloudflare for SaaS."
}

{
  "status": 400,
  "code": "wildcard_not_supported",
  "message": "Wildcard certificates are not supported. Issue a certificate per hostname instead."
}

{
  "id": "crt_5Nb2Kq9w",
  "domainId": "dom_8Qp3v1c7",
  "status": "active",
  "issuer": "Cloudflare for SaaS Managed CA",
  "notBefore": "2026-02-04T18:43:07Z",
  "notAfter": "2026-05-05T18:43:07Z",
  "nextRenewalAt": "2026-04-21T00:00:00Z"
}

{
  "status": 409,
  "code": "bundle_export_unavailable",
  "message": "Certificate material is managed by Cloudflare for SaaS and cannot be exported as PEM. The certificate is installed and served automatically."
}

Verification links

Invite a developer or DNS admin to add the delegation record without giving them account access. The recipient opens a public link, sees the exact record, and re-checks it themselves.

Webhooks

Register endpoints to receive signed events instead of polling. Deliveries are signed with HMAC-SHA256 and retried with exponential backoff up to 6 attempts. See the Webhooks guide for the payload format and a signature-check example.

{
  "url": "https://hooks.example.com/autocertify",
  "events": ["certificate.active", "certificate.renewal_failed"]
}

{
  "id": "wh_3Jd8s2Rf",
  "url": "https://hooks.example.com/autocertify",
  "events": ["certificate.active", "certificate.renewal_failed"],
  "secret": "whsec_9f2Ka7Qm4Zt1Rb6Vn0Xy",
  "createdAt": "2026-02-04T18:10:00Z"
}

API keys

Scoped keys for server-to-server access. Keys look like ac_live_… and are sent as Authorization: Bearer ac_live_…. The full key is returned only once, at creation. Use an Auth0 session JWT instead for user-facing sessions.