# TLS Certificate Inspector

> TLS Certificate Inspector is a paid API for AI agents from api.delx.ai, paid per call via x402, $0.01/call, status unknown (last checked 2026-09-15).

Inspects a domain's TLS certificate to retrieve issuer, subject, SANs, and expiry details for trust assessment and renewal risk evaluation.

## Facts

- Endpoint: POST https://api.delx.ai/api/v1/x402/tls-inspect
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/api-delx-ai-9cacc01c
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_b9HVooEpGrZg3QFabhdE3

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability api-delx-ai-9cacc01c -d '<json body>'
```

Example prompt: Can you inspect the TLS certificate for api.example.com and tell me who issued it, what domains are covered under the SANs, and how many days until it expires?

## When to prefer this

Use this endpoint when you need to programmatically audit TLS certificate health for a specific domain — especially for pre-outreach trust checks, compliance validation, infrastructure monitoring, or flagging certificates nearing expiry. Prefer this over manual browser inspection when you need structured, machine-readable certificate metadata in an agentic workflow.

## Known failure modes

- Domain does not have a reachable HTTPS endpoint — connection timeout or refused
- Invalid or malformed hostname input — validation error returned
- Self-signed or untrusted certificate — may return partial data with trust warning
- Certificate already expired — returned with zero or negative days remaining
- Domain resolves but TLS handshake fails — handshake error response

## How this service works

TLS certificate inspection API for agents: inspect issuer, subject, SANs, and expiry for one HTTPS host for $0.01 USDC before an agent trusts the channel.

## Output

Returns structured TLS certificate data including the issuer organization and CA, subject common name, list of Subject Alternative Names (SANs), certificate validity period with expiry date, and an assessment of renewal risk — e.g. days remaining and whether renewal action is recommended.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "url": {
   "type": "string"
  },
  "timeout": {
   "type": "integer",
   "maximum": 15,
   "minimum": 1
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "result": {
   "host": "example.com",
   "port": 443,
   "issuer": [
    "organizationName=DigiCert Inc",
    "commonName=DigiCert Global G3 TLS ECC SHA384 2020 CA1"
   ],
   "san_dns": [
    "example.com",
    "*.example.com"
   ],
   "subject": [
    "commonName=*.example.com"
   ],
   "days_until_expiry": 30
  },
  "tool_name": "util_tls_inspect"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/api-delx-ai-9cacc01c/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.delx.ai](https://www.zero.xyz/host/api.delx.ai/llms.txt)