POST AI agent ready /v1/ssl

SSL Check API - Free Security Headers Scanner

Checks whether a domain supports HTTPS and inspects security-related response headers such as Strict-Transport-Security, Content-Security-Policy, and X-Frame-Options.

Endpoint

Code examples

curl -X POST https://api.botoi.com/v1/ssl \
  -H "Content-Type: application/json" \
  -d '{"domain":"cloudflare.com"}'

When to use this API

Audit security headers across your subdomains

Run this check against every subdomain in your infrastructure (api.example.com, app.example.com, cdn.example.com). Generate a report of which subdomains are missing HSTS, CSP, or X-Frame-Options headers.

Monitor third-party vendor security posture

Before integrating with a third-party service, check their domain for HTTPS support and security headers. Include the results in your vendor risk assessment. Schedule monthly rechecks to detect regressions.

Frequently asked questions

What security headers does this endpoint check?

It checks Strict-Transport-Security (HSTS), Content-Security-Policy (CSP), X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy. Missing headers appear as null values.

Does this check the SSL certificate validity?

It verifies that the domain is reachable over HTTPS (https_reachable). If the SSL certificate is expired or invalid, the HTTPS connection will fail and https_reachable will be false.

What does https_reachable: false mean?

It means the domain could not be reached over HTTPS. This could indicate an expired certificate, a misconfigured server, or a domain that only serves content over HTTP.

Can I check subdomains?

Yes. Pass the full subdomain (e.g. "api.cloudflare.com") as the domain parameter to check its specific SSL and header configuration.

Get your API key

Free tier includes 5 requests per minute with no credit card required. Upgrade for higher limits.