Skip to main content

​
API Reference

The AutoCertify API is built with Express and TypeScript. It uses JSON for request and response bodies.

​
Authentication

Production API calls require a valid Auth0 OIDC token. Include your token in the Authorization header:
The API validates the token against the configured issuer (AUTH_ISSUER) and audience (AUTH_CLIENT_ID). For automated E2E testing and QA, a scoped credential endpoint is available. This uses the E2E_LOGIN_SECRET and is not an authentication bypass.

​
Rate Limiting

Rate limiting is enforced globally using a durable Postgres-backed store. This ensures limits are properly enforced across all running API instances.

​
Core Services

Note: Specific endpoint paths (e.g., GET /v1/domains) and payloads are not yet documented in this reference. The following functional areas are supported by the API:
  • Domains: Bulk creation and querying of domains.
  • API Keys: Manage programmatic access keys.
  • Webhooks: Configure endpoints to receive lifecycle events.
  • Audit: Query audit events across your organization.
  • Team Management: Manage user roles and access within your organization.
  • Support: Backend APIs for the portal support chat.
  • Public Signup: A passwordless endpoint that creates a workspace, adds the first domain, and returns the necessary DNS delegation record.
  • Developer Invites: Verification routes (/verify/:token) for web developers to add DNS records without requiring full portal authentication.