Client API: SSL

Certificate inventory and issuance, plus HTTP-01 / DNS challenge workflows for domain validation.

Base URL: https://api.coritan.com/api/v1. Paths below are complete.

To try these requests in the browser, open the interactive Client API reference.

GET /api/v1/ssl/certificates

List SSL certificates for the authenticated user.

Authentication: an access token, sent as Authorization: Bearer <token>.

Fields of a 200 response:

POST /api/v1/ssl/certificates

Order a certificate for names this account holds.

One name without a wildcard is checked the way challenge_method says, or the way the job picks. A wildcard (*.example.com) or any extra_domains is checked through Coritan DNS, so challenge_method may only be dns01 and every name must be in one active DNS zone of this account; 422 says which name is not. A wildcard needs a plan with wildcard certificates while plans apply to the account (402 otherwise).

route_id installs the certificate on that website: the account's own website, or one with no owner under the account's zone or domain (404 otherwise). On a certificate with more than one name, the website's own name must be one of them and becomes the first; a name that is another account's website is refused. 409 while an order for the same first name is queued, 429 when its registered domain has used its weekly issuance limit.

Authentication: an access token, sent as Authorization: Bearer <token>.

application/json (required)

DELETE /api/v1/ssl/certificates/{domain}

Revoke/deactivate an SSL certificate for a domain.

Authentication: an access token, sent as Authorization: Bearer <token>.

POST /api/v1/ssl/certificates/{domain}/renew

Request certificate renewal for a domain.

Authentication: an access token, sent as Authorization: Bearer <token>.

GET /api/v1/ssl/certificates/{domain}/status

Get SSL certificate status for a domain.

The certificate is the newest for the name itself, else for the parent's wildcard (every claimed platform name carries one), else for the zone's own wildcard, which carries the apex as a SAN (certificate_lookup).

Authentication: an access token, sent as Authorization: Bearer <token>.

Fields of a 200 response:

POST /api/v1/ssl/challenges/start

Start an SSL challenge for a domain. Returns method-specific instructions.

Methods:

• auto: automatically selects the best method
• dns_automatic: uses platform-managed DNS (requires DNS zone)
• dns_manual: returns TXT record for user to add to their external DNS
• http: verifies domain is pointed to this server, issues via HTTP-01

Authentication: an access token, sent as Authorization: Bearer <token>.

application/json (required)

POST /api/v1/ssl/challenges/{domain}/complete

Finalize verification and trigger certificate issuance. For HTTP method: verifies domain points to server, then issues via HTTP-01. For dns_manual: verifies TXT record exists, then issues via DNS-01.

Authentication: an access token, sent as Authorization: Bearer <token>.

GET /api/v1/ssl/challenges/{domain}/status

Check the current verification status for a domain. Performs real-time DNS/IP resolution checks.

Authentication: an access token, sent as Authorization: Bearer <token>.