TLS Check API

Getting started

Subscribe, copy your secret key, and check your first hostname certificate.

The Syndaq TLS Check API returns certificate metadata for a hostname: validity, issuer, subject, dates, SANs, protocol, and fingerprint.

v1 scope: hostname certificate metadata from a TLS connection. It is not a full TLS posture audit, vulnerability scan, or CAA/DNSSEC review.

What you need

  1. A TLS Check plan from the Syndaq API catalog.
  2. A secret key (tl_sec_) from the Syndaq client area after your order is provisioned.

TLS lookups are server-side only. Send your secret key from your backend or trusted worker. Do not embed it in client-side code, mobile apps, or public repositories.

Base URL

All TLS Check endpoints are served from:

https://api.syndaq.com/v1/tls/

Quick start

Replace tl_sec_YOUR_SECRET_KEY with the secret shown in Services for your TLS Check subscription.

curl -sS "https://api.syndaq.com/v1/tls/lookup/example.com" \
  -H "Authorization: Bearer tl_sec_YOUR_SECRET_KEY"

You can also pass the hostname as a query parameter:

curl -sS "https://api.syndaq.com/v1/tls/lookup?host=example.com" \
  -H "Authorization: Bearer tl_sec_YOUR_SECRET_KEY"

A successful response includes valid, issuer, subject, not_before, not_after, days_remaining, san, protocol, and fingerprint_sha256.

How lookups work

StepWhat happens
1Authenticate with your secret key.
2Send a hostname (and optional port; default 443).
3Receive JSON with certificate fields (including a cached flag when Syndaq already holds a recent result).

Invalid hosts return HTTP 400. Private or reserved IP targets return a clear error.

Manage your subscription

Sign in to the Syndaq client area and open Services. Select your TLS Check service to:

  • View usage and remaining monthly quota
  • Copy or rotate your secret key
  • Configure optional IP allowlists for API access

Next steps