Docs
Security
Certificate Chain
Retrieve a site's full SSL certificate chain.
GET
/v1/cert-chain
certchain.read
Returns every certificate in a domain's TLS chain, from leaf certificate up to the root CA.
Authentication
This endpoint requires a valid API key sent as a Bearer token, and the key must carry the scope listed above. See Authentication and Scopes for details.
Query Parameters
| Name | Type | Required | Description |
|---|---|---|---|
| domain | string | Required | The domain to check. |
Headers
| Header | Required | Description |
|---|---|---|
| Authorization | Required | Bearer token — Bearer pk_live_... |
Request Example
curl -X GET "https://api.paqet.net/v1/cert-chain?domain=example.com" \
-H "Authorization: Bearer pk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
using var client = new HttpClient();
client.DefaultRequestHeaders.Authorization = new("Bearer", "pk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx");
var response = await client.GetAsync("https://api.paqet.net/v1/cert-chain?domain=example.com");
var json = await response.Content.ReadAsStringAsync();
Console.WriteLine(json);
const response = await fetch("https://api.paqet.net/v1/cert-chain?domain=example.com", {
method: "GET",
headers: {
"Authorization": "Bearer pk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
}
});
const data = await response.json();
console.log(data);
interface ApiResponse<T> {
success: boolean;
data?: T;
code?: string;
message?: string;
}
const response = await fetch("https://api.paqet.net/v1/cert-chain?domain=example.com", {
method: "GET",
headers: {
"Authorization": "Bearer pk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
}
});
const data: ApiResponse<unknown> = await response.json();
console.log(data);
import requests
headers = {"Authorization": "Bearer pk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"}
response = requests.get("https://api.paqet.net/v1/cert-chain?domain=example.com", headers=headers)
print(response.json())
package main
import (
"fmt"
"io"
"net/http"
)
func main() {
req, _ := http.NewRequest("GET", "https://api.paqet.net/v1/cert-chain?domain=example.com", nil)
req.Header.Set("Authorization", "Bearer pk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx")
resp, err := http.DefaultClient.Do(req)
if err != nil {
panic(err)
}
defer resp.Body.Close()
data, _ := io.ReadAll(resp.Body)
fmt.Println(string(data))
}
<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.paqet.net/v1/cert-chain?domain=example.com",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer pk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
]
]);
$response = curl_exec($curl);
curl_close($curl);
echo $response;
Response Example
200 OK
{
"success": true,
"data": {
"id": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
"summary": "3 certificates in chain",
"durationMs": 310,
"results": [
{ "subject": "CN=example.com", "issuer": "CN=DigiCert TLS RSA SHA256 2020 CA1", "position": 0 }
]
}
}
Error Responses
| Status | Code | Meaning |
|---|---|---|
| 401 | API_KEY_INVALID | The API key is missing, malformed, or doesn't match any active key. |
| 401 | API_KEY_REVOKED | The API key was manually revoked and can never be reactivated. |
| 401 | API_KEY_EXPIRED | The API key's expiration date has passed. |
| 403 | PLAN_EXPIRED | Your Enterprise subscription is no longer active. |
| 403 | ENTERPRISE_REQUIRED | The Public API is only available on the Enterprise plan. |
| 403 | SCOPE_REQUIRED | The API key doesn't have the scope required for this endpoint. |
| 429 | RATE_LIMIT_EXCEEDED | The API key has exceeded its request limit for the current window. |
| 422 | VALIDATION_ERROR | One or more request parameters failed validation. |
| 500 | INTERNAL_ERROR | An unexpected error occurred on Paqet's side. |
Rate Limits
This endpoint counts against your API key's standard request limit. See Rate Limits for current limits, response headers, and retry guidance.
Related APIs
Try this endpoint
Run it live from the Playground using your own API key.