LIVE

pay per request SSL check

SSL Inspector

Leaf TLS facts for agents. USDC on Base. No API keys.

LIVE $0.005 USDC GET /v1/tools/ssl-check

When to use

SSL check (pay per request): inspect the leaf TLS certificate for a public hostname (validity, issuer, SANs, fingerprint, expiry). Use when you need live cert facts and must not guess. Expired or hostname-mismatched certs still return JSON flags.

Try

Opens the live endpoint. Unpaid browser requests show the paywall; agents should send Accept: application/json.

/v1/tools/ssl-check?domain=example.com

Full URL: https://api.fetchx402.com/v1/tools/ssl-check?domain=example.com

Request

GET /v1/tools/ssl-check · x402 V2 · USDC on Base · $0.005 USDC

x402 V2 curl

Expect HTTP 402 and a PAYMENT-REQUIRED header until you retry with PAYMENT-SIGNATURE.

curl -i -H "Accept: application/json" "https://api.fetchx402.com/v1/tools/ssl-check?domain=example.com"

Cursor mcp.json

Intended config for @fetchx402/mcp. This is not npm @x402/fetch (a payment fetch wrapper).

{
  "mcpServers": {
    "fetchx402": {
      "args": [
        "-y",
        "@fetchx402/mcp"
      ],
      "command": "npx",
      "env": {
        "X402_PRIVATE_KEY": "0xYOUR_SPENDING_KEY"
      }
    }
  }
}

Query parameters

Name	Type	Required	Description
`domain`	string	required	Public fully-qualified domain name to inspect, such as example.com. IPs, localhost, and internal/mDNS names are rejected.
`port`	integer	optional · 443 · default 443	TLS port. v1 accepts 443 only. Defaults to 443 if omitted.

Success fields

Field	Type	Description
`domain`	string	Normalized FQDN that was inspected
`port`	integer	TLS port (v1 is 443 only)
`sni`	string	SNI hostname sent during the handshake
`peer_ip`	string	Connected peer IP after ConnectGuard
`tls_version`	string \| null	Negotiated TLS protocol
`cipher`	string \| null	Negotiated cipher suite
`subject`	string	Leaf certificate subject DN
`issuer`	string	Leaf certificate issuer DN
`serial`	string	Leaf serial number as lowercase hex
`not_before`	string	Validity start (ISO-8601 UTC)
`not_after`	string	Validity end (ISO-8601 UTC)
`expired`	boolean	True when now is after not_after. Still HTTP 200
`not_yet_valid`	boolean	True when now is before not_before. Still HTTP 200
`hostname_match`	boolean	True when the leaf matches the requested hostname. Still HTTP 200 on mismatch
`sans`	array	DNS names from the subjectAltName extension
`fingerprint_sha256`	string	SHA-256 of the leaf DER, hex
`signature_algorithm`	string	Leaf signature algorithm name

Example

Frozen fixture. Not a live lookup.

{
  "cipher": "aes_256_gcm_sha384",
  "domain": "example.com",
  "expired": false,
  "fingerprint_sha256": "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
  "hostname_match": true,
  "issuer": "CN=DigiCert Global G3 TLS ECC SHA384 2020 CA1, O=DigiCert Inc, C=US",
  "not_after": "2027-01-15T23:59:59Z",
  "not_before": "2026-01-15T00:00:00Z",
  "not_yet_valid": false,
  "peer_ip": "23.215.0.138",
  "port": 443,
  "sans": [
    "www.example.org",
    "example.com",
    "example.net",
    "example.org"
  ],
  "serial": "0f1a2b3c4d5e6f708192a3b4c5d6e7f8",
  "signature_algorithm": "ecdsa-with-SHA384",
  "sni": "example.com",
  "subject": "CN=www.example.org, O=Internet Corporation for Assigned Names and Numbers, C=US",
  "tls_version": "tlsv1.3"
}

Payment

Unpaid requests return HTTP 402 with a base64 PAYMENT-REQUIRED header. Retry the same URL with PAYMENT-SIGNATURE. Settlement completes before the tool runs. Full handshake and shared payment errors: Payments.

Errors

HTTP	Code	When
400	`invalid_domain`	Domain is missing, malformed, an IP address, or a blocked/internal name
400	`invalid_port`	port must be 443
400	`blocked_address`	The domain resolved to a private, loopback, or metadata address
402	`payment_required`	Missing or invalid PAYMENT-SIGNATURE; decode the PAYMENT-REQUIRED header
404	`nxdomain`	The domain name does not exist
502	`connect_failed`	TCP connection to the host failed
502	`handshake_failed`	TLS handshake failed (no leaf certificate)
503	`overloaded`	Tool concurrency cap reached; retry shortly
504	`ssl_timeout`	TLS handshake timed out
409	`payment_in_progress`	The same authorization nonce is already being settled; retry shortly
429	`rate_limited`	Too many requests from this client
503	`settlement_uncertain`	Settlement is unconfirmed; retry with the same PAYMENT-SIGNATURE
503	`facilitator_unavailable`	Payment facilitator unavailable
503	`facilitator_misconfigured`	Payment facilitator is not configured
503	`facilitator_unauthorized`	Payment facilitator rejected credentials
503	`ledger_unavailable`	Payment ledger unavailable
503	`payment_unavailable`	Payment processing unavailable

Guarantees

Settlement finishes before the tool executes. Uncertain settlement fails closed (HTTP 503).
Lookups run on our nodes — no third-party data API wrappers.
Localhost, IP literals, and metadata hostnames are rejected.
Execution is timeout-bounded and concurrency-capped.