API Reference

The DelegatedSSL API is a Hono application deployed at https://api.delegatedssl.com. JSON API routes are registered in apps/api-worker/src/index.ts and the route modules it mounts.

Health check

This unauthenticated request reaches the implemented shallow health route:

curl --request GET https://api.delegatedssl.com/health

GET /health/deep is also public and checks the database, Cloudflare DCV configuration, and rate limiter. It returns only generic dependency failure messages.

Authentication

All /v1/* routes require Authorization: Bearer <token> except the public verification-link routes and the two authentication bootstrap routes listed below. A bearer token can be an Auth0 access token or a DelegatedSSL API key beginning with dssl_. API keys support these stored scopes:

Scope	Route family
`domains:read`	Domain reads, certificate reads, and HTTPS site scans
`domains:write`	Domain writes; it also satisfies domain reads
`clients:read`	Client reads
`clients:write`	Client writes; it also satisfies client reads
`reports:read`	Weekly green reports
`webhooks:write`	Webhook routes

Routes outside those families reject API-key authentication and require a user session. Any route-specific owner/admin/operator checks still apply after authentication. An authenticated domain query uses an empty JSON object when no filters are needed:

curl --request POST https://api.delegatedssl.com/v1/domains/query \
  --header "Authorization: Bearer ${DELEGATEDSSL_TOKEN}" \
  --header "Content-Type: application/json" --data '{}'

Public and service routes

Method	Path	Purpose
`GET`	`/health`	Shallow service health
`GET`	`/health/deep`	Database, Cloudflare, and rate-limiter health
`GET`	`/v1/verification-links/by-token/:token`	Open a non-expired client verification link
`POST`	`/v1/verification-links/by-token/:token/verify`	Check DNS for the linked domain
`POST`	`/v1/auth/oidc/token`	Confidential-client OIDC token exchange for the portal
`POST`	`/stripe/webhook`	Signature-verified Stripe callback
`POST`	`/webhooks/resend`	Signature-verified Resend/Svix callback

Authenticated route inventory

The following table lists every path mounted below the /v1/* authentication middleware at source commit b2add97. It deliberately does not infer payloads or response bodies beyond the code reviewed for this Node.

Area	Implemented methods and paths
Session	`GET /v1/auth/session`; `POST /v1/auth/logout`
Organizations	`GET /v1/orgs`; `GET /v1/orgs/current`; `POST /v1/orgs/current`; `POST /v1/orgs`; `PATCH /v1/orgs/current`
Domains	`POST /v1/domains/query`; `GET /v1/domains/:id`; `POST /v1/domains`; `POST /v1/domains/bulk`; `PATCH /v1/domains/:id`; `DELETE /v1/domains/:id`; `GET /v1/domains/:id/delegation-record`; `POST /v1/domains/:id/verify-delegation`; `POST /v1/domains/:id/recheck`; `POST /v1/domains/:id/certificates/issue`; `POST /v1/domains/:id/certificates/query`
Certificates	`GET /v1/certificates/:id`; `GET /v1/certificates/:id/bundle`
Clients	`POST /v1/clients/query`; `GET /v1/clients/:id`; `POST /v1/clients`; `PATCH /v1/clients/:id`; `DELETE /v1/clients/:id`
Verification links	`POST /v1/verification-links/query`; `POST /v1/verification-links`; `POST /v1/verification-links/create-or-remind`; `POST /v1/verification-links/:id/remind`
Team	`GET /v1/team/members`; `POST /v1/team/invite`; `PATCH /v1/team/members/:id`; `DELETE /v1/team/members/:id`
API keys	`GET /v1/api-keys`; `POST /v1/api-keys`; `POST /v1/api-keys/:id/rotate`; `POST /v1/api-keys/:id/revoke`
Webhooks	`GET /v1/webhooks`; `POST /v1/webhooks`; `PATCH /v1/webhooks/:id`; `DELETE /v1/webhooks/:id`; `POST /v1/webhooks/:id/rotate-secret`
Audit and usage	`POST /v1/audit/query`; `GET /v1/usage`
Site scan and reports	`POST /v1/site-scan/https`; `POST /v1/reports/weekly-green`
White label	`GET /v1/white-label/settings`; `PATCH /v1/white-label/settings`; `GET /v1/white-label/domain/status`
Account security	`GET /v1/account/security/methods`; `GET /v1/account/security/factors`; `POST /v1/account/security/methods`; `POST /v1/account/security/methods/:id/verify`; `DELETE /v1/account/security/methods/:id`
Organization administration	`GET /v1/org-admin/details`; `PATCH /v1/org-admin/details`; `GET /v1/org-admin/members`; `GET /v1/org-admin/members/:userId`; `POST /v1/org-admin/members/remove`; `GET /v1/org-admin/roles`; `GET /v1/org-admin/members/:userId/roles`; `POST /v1/org-admin/members/:userId/roles`; `POST /v1/org-admin/members/:userId/roles/unassign`; `GET /v1/org-admin/invitations`; `POST /v1/org-admin/invitations`; `DELETE /v1/org-admin/invitations/:id`; `GET /v1/org-admin/identity-providers`; `GET /v1/org-admin/identity-providers/:id`; `POST /v1/org-admin/identity-providers`; `PATCH /v1/org-admin/identity-providers/:id`; `DELETE /v1/org-admin/identity-providers/:id`
Support	`POST /v1/support/tickets/query`; `POST /v1/support/tickets`
Billing	`GET /v1/billing/plans`; `GET /v1/billing/subscription`; `POST /v1/billing/start-trial`; `POST /v1/billing/checkout`

Request controls

The Worker rate-limits authenticated /v1/* traffic to 240 requests per 60-second window. It returns Retry-After, X-RateLimit-Remaining, and X-RateLimit-Reset headers from the limiter. For authenticated non-read requests, Idempotency-Key activates a 24-hour database-backed replay ledger. Reusing a key with a different method, path, or body is rejected. API-key creation and rotation responses opt out of response-body caching because they contain a one-time secret.

Start here

Documentation hubs

Legal

Shared legal

API Reference

API Reference

Health check

Authentication

Public and service routes

Authenticated route inventory

Request controls

​API Reference

​Health check

​Authentication

​Public and service routes

​Authenticated route inventory

​Request controls

API Reference

Health check

Authentication

Public and service routes

Authenticated route inventory

Request controls