API

The endpoints Domainly exposes for third parties to call directly.

Every request needs an API token sent as Authorization: Bearer <token>.

POST /api/v1/verify

Confirms whether a is still valid for a domain, without revealing anything about the underlying . This is what a third party calls after a domain owner hands them a certificate. A certificate only works once — a successful call here consumes it, so don't check the same certificate more than once.

Request body

{
  "domain": "example.com",
  "certificate": "<certificate secret>"
}

Response

200 OK
The certificate matches the domain and is still live. This consumes the certificate — it cannot be checked again.
{
  "status": "verified"
}
401 Unauthorized
The request is missing a valid Authorization: Bearer <API token> header.
{
  "error": "unauthorized"
}
404 Not Found
The certificate doesn't match the domain, doesn't exist, has already been used, has expired, or the domain's claim was revoked.
{
  "error": "not_found"
}
400 Bad Request
The request body is missing a field or malformed.
{
  "error": "invalid_request"
}