> ## Documentation Index > Fetch the complete documentation index at: https://docs.pcnaid.com/llms.txt > Use this file to discover all available pages before exploring further. # API Reference > Authentication, request controls, and every route registered by the DelegatedSSL API Worker. # API Reference The DelegatedSSL API is a Hono application deployed at `https://api.delegatedssl.com`. JSON API routes are registered in `apps/api-worker/src/index.ts` and the route modules it mounts. ## Health check This unauthenticated request reaches the implemented shallow health route: ```bash theme={null} curl --request GET https://api.delegatedssl.com/health ``` `GET /health/deep` is also public and checks the database, Cloudflare DCV configuration, and rate limiter. It returns only generic dependency failure messages. ## Authentication All `/v1/*` routes require `Authorization: Bearer ` except the public verification-link routes and the two authentication bootstrap routes listed below. A bearer token can be an Auth0 access token or a DelegatedSSL API key beginning with `dssl_`. API keys support these stored scopes: | Scope | Route family | | - | - | | `domains:read` | Domain reads, certificate reads, and HTTPS site scans | | `domains:write` | Domain writes; it also satisfies domain reads | | `clients:read` | Client reads | | `clients:write` | Client writes; it also satisfies client reads | | `reports:read` | Weekly green reports | | `webhooks:write` | Webhook routes | Routes outside those families reject API-key authentication and require a user session. Any route-specific owner/admin/operator checks still apply after authentication. An authenticated domain query uses an empty JSON object when no filters are needed: ```bash theme={null} curl --request POST https://api.delegatedssl.com/v1/domains/query \ --header "Authorization: Bearer ${DELEGATEDSSL_TOKEN}" \ --header "Content-Type: application/json" --data '{}' ``` ## Public and service routes | Method | Path | Purpose | | - | - | - | | `GET` | `/health` | Shallow service health | | `GET` | `/health/deep` | Database, Cloudflare, and rate-limiter health | | `GET` | `/v1/verification-links/by-token/:token` | Open a non-expired client verification link | | `POST` | `/v1/verification-links/by-token/:token/verify` | Check DNS for the linked domain | | `POST` | `/v1/auth/oidc/token` | Confidential-client OIDC token exchange for the portal | | `POST` | `/stripe/webhook` | Signature-verified Stripe callback | | `POST` | `/webhooks/resend` | Signature-verified Resend/Svix callback | ## Authenticated route inventory The following table lists every path mounted below the `/v1/*` authentication middleware at source commit `b2add97`. It deliberately does not infer payloads or response bodies beyond the code reviewed for this Node. | Area | Implemented methods and paths | | - | - | | Session | `GET /v1/auth/session`; `POST /v1/auth/logout` | | Organizations | `GET /v1/orgs`; `GET /v1/orgs/current`; `POST /v1/orgs/current`; `POST /v1/orgs`; `PATCH /v1/orgs/current` | | Domains | `POST /v1/domains/query`; `GET /v1/domains/:id`; `POST /v1/domains`; `POST /v1/domains/bulk`; `PATCH /v1/domains/:id`; `DELETE /v1/domains/:id`; `GET /v1/domains/:id/delegation-record`; `POST /v1/domains/:id/verify-delegation`; `POST /v1/domains/:id/recheck`; `POST /v1/domains/:id/certificates/issue`; `POST /v1/domains/:id/certificates/query` | | Certificates | `GET /v1/certificates/:id`; `GET /v1/certificates/:id/bundle` | | Clients | `POST /v1/clients/query`; `GET /v1/clients/:id`; `POST /v1/clients`; `PATCH /v1/clients/:id`; `DELETE /v1/clients/:id` | | Verification links | `POST /v1/verification-links/query`; `POST /v1/verification-links`; `POST /v1/verification-links/create-or-remind`; `POST /v1/verification-links/:id/remind` | | Team | `GET /v1/team/members`; `POST /v1/team/invite`; `PATCH /v1/team/members/:id`; `DELETE /v1/team/members/:id` | | API keys | `GET /v1/api-keys`; `POST /v1/api-keys`; `POST /v1/api-keys/:id/rotate`; `POST /v1/api-keys/:id/revoke` | | Webhooks | `GET /v1/webhooks`; `POST /v1/webhooks`; `PATCH /v1/webhooks/:id`; `DELETE /v1/webhooks/:id`; `POST /v1/webhooks/:id/rotate-secret` | | Audit and usage | `POST /v1/audit/query`; `GET /v1/usage` | | Site scan and reports | `POST /v1/site-scan/https`; `POST /v1/reports/weekly-green` | | White label | `GET /v1/white-label/settings`; `PATCH /v1/white-label/settings`; `GET /v1/white-label/domain/status` | | Account security | `GET /v1/account/security/methods`; `GET /v1/account/security/factors`; `POST /v1/account/security/methods`; `POST /v1/account/security/methods/:id/verify`; `DELETE /v1/account/security/methods/:id` | | Organization administration | `GET /v1/org-admin/details`; `PATCH /v1/org-admin/details`; `GET /v1/org-admin/members`; `GET /v1/org-admin/members/:userId`; `POST /v1/org-admin/members/remove`; `GET /v1/org-admin/roles`; `GET /v1/org-admin/members/:userId/roles`; `POST /v1/org-admin/members/:userId/roles`; `POST /v1/org-admin/members/:userId/roles/unassign`; `GET /v1/org-admin/invitations`; `POST /v1/org-admin/invitations`; `DELETE /v1/org-admin/invitations/:id`; `GET /v1/org-admin/identity-providers`; `GET /v1/org-admin/identity-providers/:id`; `POST /v1/org-admin/identity-providers`; `PATCH /v1/org-admin/identity-providers/:id`; `DELETE /v1/org-admin/identity-providers/:id` | | Support | `POST /v1/support/tickets/query`; `POST /v1/support/tickets` | | Billing | `GET /v1/billing/plans`; `GET /v1/billing/subscription`; `POST /v1/billing/start-trial`; `POST /v1/billing/checkout` | ## Request controls The Worker rate-limits authenticated `/v1/*` traffic to 240 requests per 60-second window. It returns `Retry-After`, `X-RateLimit-Remaining`, and `X-RateLimit-Reset` headers from the limiter. For authenticated non-read requests, `Idempotency-Key` activates a 24-hour database-backed replay ledger. Reusing a key with a different method, path, or body is rejected. API-key creation and rotation responses opt out of response-body caching because they contain a one-time secret. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.