DIGITALTRUST
Tools · API and AI

Our tools, in your application and your AI assistant.

A free public REST API and an MCP server for Claude, ChatGPT and other assistants. The same checks as the website, in JSON, with no sign-up.

See endpointsConnect an AI assistant
  • No authentication
  • 100 requests per hour per IP
  • OpenAPI 3.1 and MCP
How it works

GET or POST, JSON back.

Base URL
https://digitaltrust.pt/api/v1
Format
Every endpoint accepts GET with URL parameters and, when it has parameters, POST with a JSON body. The response is always JSON.
Authentication
None.
Rate limit
100 requests per hour per IP address, shared between the API and MCP. Beyond that, a 429 response.
Specification
/openapi.json (OpenAPI 3.1)
Private keys
Never. No endpoint accepts them. To generate a CSR or PFX, use the website tools, which run in the browser, or OpenSSL.

Response

{ "success": true,  "data": { … } }
{ "success": false, "error": { "code": "invalid_input", "message": "Enter a domain, for example company.eu." } }

Error codes: missing_parameter and invalid_json (400), not_found (404), invalid_input (422), rate_limited (429), upstream_error (502). Messages are in English; add lang=pt to the URL for Portuguese.

Endpoints

10 endpoints, the same 10 names in MCP.

GET · POST   /api/v1/ssl/check   MCP: check_ssl

Check a server TLS certificate

Connects to a public host and returns the certificate, chain, trust status, hostname match, days to expiry, negotiated protocol and supported TLS versions (1.0 to 1.3).

host *
string · Hostname, e.g. example.pt or mail.example.pt
port
integer · TLS port · default: 443
curl "https://digitaltrust.pt/api/v1/ssl/check?host=company.eu"

GET · POST   /api/v1/certificate/decode   MCP: decode_certificate

Decode X.509 certificates

Decodes one or more PEM certificates (a full chain is accepted) and returns subject, SANs, issuer, validity, validation type (DV, OV, EV, QWAC), key, fingerprints and OCSP URL.

certificate *
string · PEM certificate(s), starting with -----BEGIN CERTIFICATE-----
curl -X POST https://digitaltrust.pt/api/v1/certificate/decode \
  -H "Content-Type: application/json" \
  -d '{"certificate":"-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----"}'

GET · POST   /api/v1/csr/decode   MCP: decode_csr

Decode a certificate signing request

Decodes a PEM CSR and returns subject, SANs, key type and size, signature algorithm, signature validity, public key fingerprint and warnings that would make a CA reject it.

csr *
string · PEM CSR, starting with -----BEGIN CERTIFICATE REQUEST-----
curl -X POST https://digitaltrust.pt/api/v1/csr/decode \
  -H "Content-Type: application/json" \
  -d '{"csr":"-----BEGIN CERTIFICATE REQUEST-----\n...\n-----END CERTIFICATE REQUEST-----"}'

GET · POST   /api/v1/keys/match   MCP: match_public_keys

Check that a certificate and a CSR share the same key

Compares the SHA-256 fingerprints of the public keys in a certificate and a CSR. Private keys are never accepted by this API: compare them locally with "openssl pkey -in key.pem -pubout | openssl sha256".

certificate
string · PEM certificate
csr
string · PEM CSR
curl -X POST https://digitaltrust.pt/api/v1/keys/match \
  -H "Content-Type: application/json" \
  -d '{"certificate":"-----BEGIN CERTIFICATE-----...","csr":"-----BEGIN CERTIFICATE REQUEST-----..."}'

GET · POST   /api/v1/caa/check   MCP: check_caa

Check CAA records

Reads the CAA records that apply to a domain (walking up to the parent domain) and says which certificate authorities (Actalis, Asseco, GlobalSign, DigiCert, Sectigo, Let's Encrypt) may issue normal and wildcard certificates.

domain *
string · Domain, e.g. example.pt
curl "https://digitaltrust.pt/api/v1/caa/check?domain=company.eu"

GET · POST   /api/v1/caa/generate   MCP: generate_caa

Generate CAA records

Builds CAA records, in structured form and as zone-file lines, that authorise the chosen certificate authorities to issue for a domain.

domain *
string · Domain, e.g. example.pt
cas
array · Certificate authorities to authorise: actalis, asseco, globalsign, digicert, sectigo, letsencrypt, harica, or a CAA identifier such as actalis.it · default: actalis,asseco
wildcard
string · "same" lets the same CAs issue wildcards; "none" forbids wildcard certificates · default: 'same'
iodef
string · Email address for CA incident reports
curl "https://digitaltrust.pt/api/v1/caa/generate?domain=company.eu&cas=actalis,asseco&iodef=security%40company.eu"

GET · POST   /api/v1/email/check   MCP: check_email_security

Check email authentication of a domain

Returns MX, SPF, DKIM (when a selector is given), DMARC with its parsed tags, BIMI, MTA-STS (record and published policy) and TLS-RPT for a domain.

domain *
string · Domain, e.g. example.pt
dkim_selector
string · DKIM selector to test, e.g. default, google, selector1
curl "https://digitaltrust.pt/api/v1/email/check?domain=company.eu&dkim_selector=default"

GET   /api/v1/products   MCP: list_ssl_products

List SSL/TLS certificates and prices

Lists the SSL/TLS certificates sold by DigitalTrust (DV, OV, EV, QWAC, QWAC PSD2), with yearly prices in euros without VAT, coverage options, issuance time and the order page for each.

curl https://digitaltrust.pt/api/v1/products

GET · POST   /api/v1/order/url   MCP: build_order_url

Build a prefilled order link

Returns the price and a link to the DigitalTrust order page with the certificate already chosen. Orders are confirmed by a person on that page; this API does not place orders.

type *
string · Certificate type
coverage
string · Coverage · default: 'unico'
years
integer · Subscription length in years, paid upfront (discounts: 2y 15%, 3y 17%, 4y 20%, 5y 25%) · default: 1
curl "https://digitaltrust.pt/api/v1/order/url?type=ov&coverage=wildcard&years=1"
MCP · AI assistants

Ask your assistant: "is my website's certificate OK?"

The MCP server gives Claude, ChatGPT and other assistants direct access to the same tools. The assistant checks the server, reads the CT logs or DMARC and answers with real data.

Address
https://digitaltrust.pt/mcp
Transport
Streamable HTTP, no authentication
Claude
Settings → Connectors → Add custom connector, and paste the address.
Claude Code
claude mcp add --transport http digitaltrust https://digitaltrust.pt/mcp
Other clients
Any MCP client with HTTP transport. There is also the OpenAPI specification for assistants that use API actions.

The tools only read public data and do not place orders. To buy, the assistant returns the link to the order page, where a person confirms.

CallOrder SSL