Public API for the free tools

Every free tool on this site is also a JSON endpoint under /api/public/. Anonymous use is allowed within the limits below, responses carry Access-Control-Allow-Origin: * so a browser page on any origin can call them, and results are cached for a few minutes per target. Need more? API keys lift the limits, keep results under a minute old and come with a yearly allowance of queries, priced below.

Endpoints

Method	Path	Returns
`GET`	`/api/public/cert/{host}?port=443`	The certificate report: grade, leaf, chain, trust, tls, hsts, revocation, caa, ct and issues. Cached 15 minutes.
`GET`	`/api/public/headers/{host}`	The security headers grade with present, missing, warnings, upcoming, additional and raw headers. Cached 10 minutes.
`GET`	`/api/public/dns/{name}?type=A`	A DNS answer in the dns.google JSON shape (Status, AD, Question, Answer, Authority). `type` takes a name, a number or `ANY`. Cached 5 minutes.
`GET`	`/api/public/observatory/{host}`	The MDN HTTP Observatory score and grade with every test's result, modifier, description and fix. Cached 15 minutes; a scan can take up to 45 seconds.
`GET`	`/api/public/domain/{domain}`	The RDAP registration summary: registrar, statuses, dates, name servers, DNSSEC, abuse contact. Cached 24 hours.
`GET`	`/api/public/api-tiers`	The API key tiers on sale: name, queries per year and price in pence. No limits apply.

Add ?fresh=1 to bypass the cache for one request (one per target per minute).

Example

curl -i https://certmoni.com/api/public/cert/certmoni.com

{
  "host": "certmoni.com", "port": 443, "checkedAt": "2026-10-11T12:00:00.000Z",
  "reachable": true, "grade": "A",
  "leaf": { "subject": "CN=certmoni.com", "notAfter": "…", "daysLeft": 61, "keyType": "EC", … },
  "trust": { "chainComplete": true, "trusted": true, "hostnameMatch": true, "selfSigned": false, "expired": false, "error": null },
  "tls": { "protocols": { "tls1_3": true, "tls1_2": true, "tls1_1": false, "tls1_0": false, "ssl3": false }, "forwardSecrecy": true, … },
  "hsts": { "present": true, "maxAge": 31536000, "includeSubDomains": true, "preload": false },
  "issues": [ { "level": "info", "code": "…", "text": "…" } ]
}

Semantics

Fail-soft. A host that cannot be reached is still a 200 with "reachable": false and an error string, so a dashboard never breaks because a target is down.
400 for a malformed target, a private or loopback address, or an unknown DNS type. The body is {"error": "…"}.
429 when a limit is hit, with a Retry-After header in seconds and the same JSON error body. Honour it and back off.
401 when an Authorization header carries an unknown or revoked API key; 402 when the key is valid but the account has no queries left. Anonymous requests never see either.
Headers. X-Cache: HIT or MISS, Cache-Control: public, max-age=<seconds left>, X-RateLimit-Limit and X-RateLimit-Remaining; keyed requests also get X-Quota-Limit, X-Quota-Remaining and X-Quota-Reset.
Stability. Fields are only ever added, never renamed or removed, within a major version. Read defensively: treat any missing field as unknown.

Anonymous limits

Limit	Per IP address
Requests (cache hits included)	60 per 10 minutes
Fresh scans (cache misses)	15 per 10 minutes
Forced rescans (`fresh=1`)	1 per target per minute

API keys

An API key is for anyone building these checks into a product, a dashboard or an automated pipeline. Send it as Authorization: Bearer cmk_… on any endpoint above. Keyed requests are limited per key rather than per IP address (600 requests per 10 minutes), a cached result is only reused if it is under a minute old, and each request, cache hit or not, costs one query from a yearly allowance bought in advance. Queries are consumed from the allowance that expires soonest, so nothing you paid for is wasted while an older block still holds.

Tier	Allowance	Price	Per query
API 1,000	1,000 queries	£10 a year	1.00p
API 10,000	10,000 queries	£50 a year	0.50p
API 100,000	100,000 queries	£250 a year	0.25p

Allowances last one year from purchase, are paid by PayPal, and stack: buy another block at any time. To get a key, create a CertMoni account (free, no card) and open API keys in the app; the key is shown once, usage is listed by day and tool, and a key can be revoked at any moment. Keys are not tied to monitored certificates: an account with a free trial and no paid monitoring can buy and use API queries.

curl -H "Authorization: Bearer cmk_…" https://certmoni.com/api/public/observatory/example.com

Fair use

The endpoints exist so you can show these checks in your own tools. Please identify your client with a User-Agent, cache on your side at least as long as Cache-Control says, and do not point them at hosts you do not run. Private network targets are refused by design. Questions: hello@certmoni.com.