The Trustico® tracking system is where an individual SSL Certificate is managed after it is ordered : checking validation progress, changing the Domain Control Validation (DCV) method, requesting a reissue, and downloading the issued SSL Certificate files. The tracking system Application Programming Interface (API) makes those same SSL Certificate management operations available programmatically, so you can build them into your own systems rather than perform each step by hand. Learn About The Trustico® Tracking System 🔗
It is built for customers and partners who manage SSL Certificates regularly and would rather drive each action from their own platform than sign in and work through the dashboard by hand. Every request is made over Hypertext Transfer Protocol Secure (HTTPS) and every response is returned as JavaScript Object Notation (JSON).
This page describes what the Application Programming Interface (API) does and how it behaves. The full request and response detail, together with working examples that rewrite themselves around the SSL Certificate you are viewing, is presented inside the tracking system itself. Learn About The Trustico® Tracking System 🔗
Eligibility and Access
Access is limited to established customers and partners and requires approval before use. Trustico® issues an Application Programming Interface (API) key only when the requester already holds an SSL Certificate order that is fully validated, complete, and paid in full.
Requests from customers who have not been verified through a completed SSL Certificate order are not approved. Partners must additionally hold an approved partner account, as approval for Application Programming Interface (API) access follows from an existing approved partner relationship. Learn About The Trustico® Partner Service 🔗
Keys are issued individually after review, and a key may be revoked at any time, taking effect on the next request received.
Programmatic Access to the Tracking System
The Application Programming Interface (API) is the programmatic equivalent of the tracking dashboard. The operations it exposes are the same ones a customer performs in the dashboard today, so anything you automate behaves exactly as it would if a member of your team carried out the same action by hand.
The design is deliberately SSL Certificate specific. Every call operates on one SSL Certificate at a time, identified by the caller in each request. There is no call that lists or enumerates an entire portfolio, and the Application Programming Interface (API) is not an account management interface. Integrators who manage many SSL Certificates simply make one request per SSL Certificate within their own systems.
Important : The Application Programming Interface (API) acts on a single SSL Certificate per request. It does not provide portfolio listing, account management, or bulk enumeration of SSL Certificates.
Authentication
Every request carries the issued key in an X-Api-Key header. One key identifies the approved caller and works across every SSL Certificate belonging to that caller, so there is no need to request a separate key for each order.
Alongside the key, every request identifies the specific SSL Certificate it acts on with three values : the Certificate Authority (CA) Reference, a domain name that appears on the SSL Certificate, and the product brand. These are the same three values used to open an individual SSL Certificate in the tracking dashboard, so no new identifiers are introduced.
The key proves the caller is approved, while the three identifiers authorize the specific action on that specific SSL Certificate. A request that is missing the key, or that carries an unrecognized key, is refused.
Important : Your key is an account credential, and the three SSL Certificate identifiers are account-equivalent. Store the key as a secret on your server, never place it in code that reaches a browser, and request a replacement immediately if you believe it has been exposed.
SSL Certificate Operations
The Application Programming Interface (API) covers the full lifecycle of an individual SSL Certificate, from monitoring validation progress through to collecting the issued files.
A summary of an SSL Certificate can be retrieved at any time, including its current status, its validity dates, and the domains it covers, which feeds accurate information into your own monitoring without signing in to the dashboard.
Domain Control Validation (DCV) is usually the step that decides how quickly an SSL Certificate is issued, and the Application Programming Interface (API) gives full control over it. You can read the Domain Control Validation (DCV) status for each domain, retrieve the approver e-mail addresses available for e-mail based validation, resend a Domain Control Validation (DCV) e-mail that has gone astray, and change the method for a domain between e-mail, Domain Name System (DNS), and Hypertext Transfer Protocol (HTTP) validation, for one domain or several in a single request. Where a Certification Authority Authorization (CAA) check has blocked issuance, a dedicated operation retries the Certification Authority Authorization (CAA) check on demand. Learn About The Validation Procedure 🔗
An SSL Certificate can be reissued with a new Certificate Signing Request (CSR), which matters increasingly as industry mandated validity periods shorten and reissues become a routine part of SSL Certificate management. A decode operation confirms the contents of a Certificate Signing Request (CSR) first, catching a mistyped domain name or an incorrect organization detail before the reissue begins, and a further operation generates a secure portal session at the Certificate Authority (CA) for the occasions that call for direct access. Learn About Reissuing an SSL Certificate 🔗
Once an SSL Certificate has been issued, the Application Programming Interface (API) collects and downloads the files, including a single call that returns everything as a ZIP archive, so an automated deployment pipeline can retrieve an installable SSL Certificate in one request.
Note : A Wildcard SSL Certificate is validated by the Domain Name System (DNS) method, as file based validation is not available for wildcards. The method is set through the Application Programming Interface (API) in the same way as for any other domain.
Operations Reserved for the Tracking Dashboard
A small number of operations remain available only through the signed in tracking dashboard. Adding new domains to a Multi-Domain SSL Certificate, sending SSL Certificate or validation records by e-mail, and live re-checking of published validation records are performed in the dashboard rather than through an Application Programming Interface (API) key.
Revocation is not available through the Application Programming Interface (API) at all. Keeping these operations in the dashboard ensures that the most sensitive and least frequent actions always involve a signed in session.
Rate Limits and Acceptable Use
Each endpoint carries a short term burst limit and a longer sustained limit, and the operations that act on your account additionally carry a limit against the Certificate Authority (CA) Reference. A response that reaches a ceiling states how long to wait before retrying rather than failing without explanation.
Repeated failed authentication locks out the calling address and the Certificate Authority (CA) Reference for a rolling window, after which every authenticated request is refused until the window passes. Separately, a temporary unavailable response means the platform briefly could not reach the Certificate Authority (CA), where the correct response is to retry after a short delay rather than immediately.
Important : Only genuine credentials may be used, and repeated calls that fail because invalid information was supplied may result in suspension or revocation of your key. Acting on an SSL Certificate without the permission of the SSL Certificate holder is a breach and results in immediate termination of access.
Partners remain responsible for the SSL Certificates they manage on behalf of others, exactly as they are for actions taken by hand. Learn About Partner Responsibilities 🔗
Reading the Reference Documentation
The reference documentation carries every field, every response code, and working examples in several languages. It is available inside the tracking system itself : log in with any valid Certificate Authority (CA) Reference, then scroll to the bottom of any page to reach the link to the documentation. The examples shown there are generated for the exact SSL Certificate license you logged in to manage, so they always reflect the SSL Certificate the key is authorized against.
Requesting Access
To apply for a tracking system Application Programming Interface (API) key, complete the form below with your organization details, your contact information, and a short description of the integration you intend to build.
Including a Certificate Authority (CA) Reference from one of your existing SSL Certificates lets Trustico® confirm the request comes from a verified customer or an approved partner, which keeps the review efficient. Trustico® reviews each request individually and issues a key directly to approved requesters.
