# crt.sh — Wrapped API

> **You are on:** `https://api.paywithlocus.com/api` | [llms.txt](https://paywithlocus.com/llms.txt) | [docs](https://docs.paywithlocus.com)
>
> Locus runs on multiple environments -- make sure every URL you call matches your expected environment.
> | Environment | Landing | API | Docs |
> |---|---|---|---|
> | Production | paywithlocus.com | api.paywithlocus.com | docs.paywithlocus.com |
> | Beta | beta.paywithlocus.com | api.beta.paywithlocus.com | docs.paywithlocus.com |
> | Stage | stage.paywithlocus.com | api.stage.paywithlocus.com | docs.paywithlocus.com |
>
> If the API URL above doesn't match your expected environment, re-fetch this file from the correct domain.

> Search for SSL/TLS certificates across public transparency logs by domain, fingerprint, serial number, or public key, and retrieve detailed certificate information including issuer, validity dates, and certificate chain details. Monitor certificate issuance for domains you care about to track security changes and detect unauthorized certificates.

**Category:** Developer Tools | **Website:** [crt.sh/](https://crt.sh/) | **Docs:** [parse.bot/marketplace/3500aed0-9e19-44cc-9f39-eb92e00dc72e/crt-sh-api](https://parse.bot/marketplace/3500aed0-9e19-44cc-9f39-eb92e00dc72e/crt-sh-api)

Pay-per-use API proxy. Each call is automatically billed to your wallet in USDC.

## Access

**Base URL:** `https://api.paywithlocus.com/api/wrapped/parse-crt-sh-api-3500aed0/`
**Auth:** `Authorization: Bearer <LOCUS_API_KEY>`

## Endpoints

### get_ca_details

Retrieve details for a Certificate Authority by its crt.sh CA ID. Returns the CA name and raw certificate information parsed from the HTML page. The ca_id can be obtained from the issuer_ca_id field in search_certificates results.

**Estimated cost:** Metered

| Field | Type | Required | Description |
|-------|------|----------|-------------|
| `ca_id` | string | Yes | The crt.sh CA ID (numeric string, e.g. '16418'). Obtainable from search_certificates results field issuer_ca_id. |

```bash
curl -X POST https://api.paywithlocus.com/api/wrapped/parse-crt-sh-api-3500aed0/get_ca_details \
  -H "Authorization: Bearer YOUR_LOCUS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"ca_id":"<string>"}'
```

### get_certificate_detail

Retrieve full details for a specific certificate by its crt.sh ID. Returns decoded X.509 information, fingerprints, transparency log entries, and revocation status parsed from the HTML detail page. The cert_id can be obtained from search_certificates results.

**Estimated cost:** Metered

| Field | Type | Required | Description |
|-------|------|----------|-------------|
| `cert_id` | string | Yes | The crt.sh certificate ID (numeric string, e.g. '26787376238'). Obtainable from search_certificates results. |

```bash
curl -X POST https://api.paywithlocus.com/api/wrapped/parse-crt-sh-api-3500aed0/get_certificate_detail \
  -H "Authorization: Bearer YOUR_LOCUS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"cert_id":"<string>"}'
```

### search_by_fingerprint

Search for a certificate by its SHA-256 or SHA-1 fingerprint. Parses the HTML detail page to return certificate IDs, summary, fingerprints, and transparency log entries. The fingerprint can be obtained from get_certificate_detail results.

**Estimated cost:** Metered

| Field | Type | Required | Description |
|-------|------|----------|-------------|
| `fingerprint` | string | Yes | Certificate fingerprint - SHA-256 (64 hex characters) or SHA-1 (40 hex characters). Case-insensitive. |

```bash
curl -X POST https://api.paywithlocus.com/api/wrapped/parse-crt-sh-api-3500aed0/search_by_fingerprint \
  -H "Authorization: Bearer YOUR_LOCUS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"fingerprint":"<string>"}'
```

### search_by_serial

Search for certificates by their serial number using the crt.sh JSON API. Returns all certificates matching the given serial number hex string.

**Estimated cost:** Metered

| Field | Type | Required | Description |
|-------|------|----------|-------------|
| `serial` | string | Yes | Certificate serial number as a hex string (e.g. '27fd65644d90aa4763b6cfb53d6dcca3'). |

```bash
curl -X POST https://api.paywithlocus.com/api/wrapped/parse-crt-sh-api-3500aed0/search_by_serial \
  -H "Authorization: Bearer YOUR_LOCUS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"serial":"<string>"}'
```

### search_by_spki

Search for certificates sharing a specific SPKI (Subject Public Key Info) SHA-256 fingerprint. Parses the HTML results page since JSON output is not supported for this query type. Returns an empty items array when no certificates match.

**Estimated cost:** Metered

| Field | Type | Required | Description |
|-------|------|----------|-------------|
| `spki` | string | Yes | SPKI SHA-256 hash (64-character lowercase hex string). |

```bash
curl -X POST https://api.paywithlocus.com/api/wrapped/parse-crt-sh-api-3500aed0/search_by_spki \
  -H "Authorization: Bearer YOUR_LOCUS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"spki":"<string>"}'
```

### search_certificates

Search for certificates by identity (domain, email, organization, etc.) using the crt.sh JSON API. Returns an array of matching certificate records wrapped in an items key. Supports wildcard queries with the % character.

**Estimated cost:** Metered

| Field | Type | Required | Description |
|-------|------|----------|-------------|
| `exclude` | string | No | Exclude certain results. Accepted value: 'expired'. |
| `group` | string | No | Group results. Accepted values: 'none' to disable grouping, 'icaid' to group by issuer CA. |
| `limit` | integer | No | Maximum number of results to return. |
| `match` | string | No | Match type for the query. Accepted values: 'LIKE', 'ILIKE', 'single', 'any', '='. |
| `query` | string | Yes | Search query (domain, email, organization, etc.). Use % as wildcard (e.g. '%.example.com'). |

```bash
curl -X POST https://api.paywithlocus.com/api/wrapped/parse-crt-sh-api-3500aed0/search_certificates \
  -H "Authorization: Bearer YOUR_LOCUS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"exclude":"<string>","group":"<string>","limit":"<integer>","match":"<string>","query":"<string>"}'
```