# Certificate Decoder API
> Decode an X.509 certificate (PEM) into readable details — without a live connection. Paste a certificate and get back its subject and issuer (parsed into fields), the validity window with days-until-expiry and an expired flag, the serial number, SHA-1 and SHA-256 fingerprints, the Subject Alternative Names, the public-key type and size, and the CA / self-signed flags. Pure local parsing with no third-party service. Live, nothing stored. 2 endpoints. Built for certificate inspection, CI/CD expiry checks, PKI debugging and audit tooling. Distinct from a live SSL/TLS endpoint checker — this decodes a certificate you already hold.

## Authentication
All requests require your oanor API key in the `x-oanor-key` header. Get one at https://www.oanor.com/developer/keys.

```bash
curl -H "x-oanor-key: oanor_live_…" "https://api.oanor.com/certdecode-api/..."
```

## Pricing
- **Free** (Free) — 1,140 calls/Mo, 2 req/s
- **Starter** ($3/Mo) — 10,500 calls/Mo, 8 req/s
- **Pro** ($23/Mo) — 146,000 calls/Mo, 20 req/s
- **Mega** ($59/Mo) — 750,000 calls/Mo, 50 req/s

## Endpoints

### Certificate

#### `GET /v1/decode` — Decode a PEM X.509 certificate

**Parameters:**
- `pem` (query, required, string) — PEM certificate Example: `-----BEGIN CERTIFICATE-----
MIIDijCCAnKgAwIBAgIUe/Yigo9jewUQ/NAyoU+Cl0LFwSkwDQYJKoZIhvcNAQEL
BQAwOTELMAkGA1UEBhMCREUxDjAMBgNVBAoMBW9hbm9yMRowGAYDVQQDDBFleGFt
cGxlLm9hbm9yLmNvbTAeFw0yNjA2MDIxMzIwNDVaFw0yNzA2MDIxMzIwNDVaMDkx
CzAJBgNVBAYTAkRFMQ4wDAYDVQQKDAVvYW5vcjEaMBgGA1UEAwwRZXhhbXBsZS5v
YW5vci5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCeujyMN5fo
gP4M9wgpBzYzjjUE5/uqyR8qrkhk+D0iNebFUp0NZd7dPVh8omwOOUjRJIYEy20t
sSDBpsqW+SYoKYAPC4/IvdnkWsbrH7xSurT4POK+M39+fyirIrvoT3JO6CHk8BEy
FqYpQ3KA5KQLDBJbPwtrEUhFaABR4c/WyOTafQkeHRTlpCNpkfpDafdeyCbf8Xeq
zIFGHHBRoUKgd7H2xC5CvV1d05ZTNU+2eNp3Y2AlYyaKhv/16JRdCtkpgHtJ/IHe
Le/0ckRSUcmqcVH5NyEh46NJPQ3zBAhwGWRm5LGrORkWiFbdA9/A92TNL1WNsDzZ
Qb5Yx4iM2kKbAgMBAAGjgYkwgYYwHQYDVR0OBBYEFAM8LpsfG5Bm7F5WfjZOMv5L
vYDyMB8GA1UdIwQYMBaAFAM8LpsfG5Bm7F5WfjZOMv5LvYDyMA8GA1UdEwEB/wQF
MAMBAf8wMwYDVR0RBCwwKoIRZXhhbXBsZS5vYW5vci5jb22CFXd3dy5leGFtcGxl
Lm9hbm9yLmNvbTANBgkqhkiG9w0BAQsFAAOCAQEAmvEKg+Cl1W0FxEyByhT7t1ey
6gX7E0kHvX0PwpXEHC+x6qzAt0D7B2XyXP7dqm2Ajgb78Fd7yldZWYb6U5AX762k
xPk4gzG0YquXAOdhcaTiQrcua/E8zO3vRXZs7sGf4zcFtwktBX83Fa84b5SS/ON5
qKVATU4He5nnszLXvTlGBOnSPPAuGuNQidSP7B9Z0QFHI8Yndm8aUit7UDHetUry
ZqLQrGgaCnOtO0lv4X3qxDhWx6POFDdi0KhQZDpDPF6XMonUlcD5gXs363ZYY8hu
epQMrrb2MZtqQjxWInBg+/QiEl8bblaM4Rh334ay7vR1Vry7ZsvD28VcO4JxtA==
-----END CERTIFICATE-----`

**Example:**
```bash
curl -H "x-oanor-key: $KEY" \
  "https://api.oanor.com/certdecode-api/v1/decode?pem=-----BEGIN+CERTIFICATE-----%0AMIIDijCCAnKgAwIBAgIUe%2FYigo9jewUQ%2FNAyoU%2BCl0LFwSkwDQYJKoZIhvcNAQEL%0ABQAwOTELMAkGA1UEBhMCREUxDjAMBgNVBAoMBW9hbm9yMRowGAYDVQQDDBFleGFt%0AcGxlLm9hbm9yLmNvbTAeFw0yNjA2MDIxMzIwNDVaFw0yNzA2MDIxMzIwNDVaMDkx%0ACzAJBgNVBAYTAkRFMQ4wDAYDVQQKDAVvYW5vcjEaMBgGA1UEAwwRZXhhbXBsZS5v%0AYW5vci5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCeujyMN5fo%0AgP4M9wgpBzYzjjUE5%2FuqyR8qrkhk%2BD0iNebFUp0NZd7dPVh8omwOOUjRJIYEy20t%0AsSDBpsqW%2BSYoKYAPC4%2FIvdnkWsbrH7xSurT4POK%2BM39%2BfyirIrvoT3JO6CHk8BEy%0AFqYpQ3KA5KQLDBJbPwtrEUhFaABR4c%2FWyOTafQkeHRTlpCNpkfpDafdeyCbf8Xeq%0AzIFGHHBRoUKgd7H2xC5CvV1d05ZTNU%2B2eNp3Y2AlYyaKhv%2F16JRdCtkpgHtJ%2FIHe%0ALe%2F0ckRSUcmqcVH5NyEh46NJPQ3zBAhwGWRm5LGrORkWiFbdA9%2FA92TNL1WNsDzZ%0AQb5Yx4iM2kKbAgMBAAGjgYkwgYYwHQYDVR0OBBYEFAM8LpsfG5Bm7F5WfjZOMv5L%0AvYDyMB8GA1UdIwQYMBaAFAM8LpsfG5Bm7F5WfjZOMv5LvYDyMA8GA1UdEwEB%2FwQF%0AMAMBAf8wMwYDVR0RBCwwKoIRZXhhbXBsZS5vYW5vci5jb22CFXd3dy5leGFtcGxl%0ALm9hbm9yLmNvbTANBgkqhkiG9w0BAQsFAAOCAQEAmvEKg%2BCl1W0FxEyByhT7t1ey%0A6gX7E0kHvX0PwpXEHC%2Bx6qzAt0D7B2XyXP7dqm2Ajgb78Fd7yldZWYb6U5AX762k%0AxPk4gzG0YquXAOdhcaTiQrcua%2FE8zO3vRXZs7sGf4zcFtwktBX83Fa84b5SS%2FON5%0AqKVATU4He5nnszLXvTlGBOnSPPAuGuNQidSP7B9Z0QFHI8Yndm8aUit7UDHetUry%0AZqLQrGgaCnOtO0lv4X3qxDhWx6POFDdi0KhQZDpDPF6XMonUlcD5gXs363ZYY8hu%0AepQMrrb2MZtqQjxWInBg%2B%2FQiEl8bblaM4Rh334ay7vR1Vry7ZsvD28VcO4JxtA%3D%3D%0A-----END+CERTIFICATE-----"
```

**Response:**
```json
{
    "data": {
        "key": {
            "size": 2048,
            "type": "rsa"
        },
        "is_ca": true,
        "issuer": {
            "C": "DE",
            "O": "oanor",
            "CN": "example.oanor.com"
        },
        "expired": false,
        "subject": {
            "C": "DE",
            "O": "oanor",
            "CN": "example.oanor.com"
        },
        "valid_to": "2027-06-02T13:20:45.000Z",
        "issuer_raw": "C=DE, O=oanor, CN=example.oanor.com",
        "valid_from": "2026-06-02T13:20:45.000Z",
        "self_signed": true,
        "subject_raw": "C=DE, O=oanor, CN=example.oanor.com",
        "serial_number": "7BF622828F637B0510FCD032A14F829742C5C129",
        "fingerprint_sha1": "9A:25:5F:E1:07:D1:1E:7E:81:F5:35:C0:A5:71:4A:93:85:CC:CA:02",
        "subject_alt_name": "DNS:example.oanor.com, DNS:www.example.oanor.com",
        "days_until_expiry": 365,
        "fingerprint_sha256": "83:5B:D3:A4:17:81:DF:BD:86:7B:26:84:B2:E0:03:A0:FA:AC:AA:F5:89:EA:2A:53:E9:2A:39:4C:B3:B2:E9:6F"
    },
    "meta": {
        "timestamp": "2026-06-02T16:51:52.020Z",
        "request_id": "ad1196b6-61ce-4378-8dba-8ac6be85cf12"
    },
    "status": "ok",
    "message": "Decode a PEM X.509 certificate",
    "success": true
}
```

### Meta

#### `GET /v1/meta` — Spec

**Example:**
```bash
curl -H "x-oanor-key: $KEY" \
  "https://api.oanor.com/certdecode-api/v1/meta"
```

**Response:**
```json
{
    "data": {
        "auth": "none upstream; this gateway requires x-api-key",
        "name": "Certificate Decoder API",
        "note": "Decode a PEM X.509 certificate. Pass ?pem= the certificate (-----BEGIN CERTIFICATE-----…) and get back the subject and issuer (parsed), validity window with days-until-expiry and an expired flag, serial number, SHA-1/SHA-256 fingerprints, Subject Alternative Names, key type/size, CA and self-signed flags. Distinct from sslcheck-api (live TLS handshake). Instant, nothing stored.",
        "source": "Local X.509 parsing (Node crypto) — no key, no upstream",
        "endpoints": 2
    },
    "meta": {
        "timestamp": "2026-06-02T16:51:52.126Z",
        "request_id": "dc1e94b3-df0b-4d92-8de3-9fbd336f67ad"
    },
    "status": "ok",
    "message": "Meta",
    "success": true
}
```


---
Marketplace page: https://www.oanor.com/api/certdecode-api
OpenAPI spec: https://www.oanor.com/api/certdecode-api/openapi.json