# Lookproof CSR Decode

> Lookproof CSR Decode is a paid API for AI agents from api.lookproof.dev, paid per call via x402, $0.002/call, status unknown (last checked 2026-10-31).

Parses and validates a PEM-encoded PKCS#10 certificate signing request, returning subject, SANs, key type/size, and signature validity — fully offline.

## Facts

- Endpoint: POST https://api.lookproof.dev/v1/tls/csr-decode?utm_source=zero.xyz
- Price: $0.002/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-31
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/lookproof-csr-decode-1635db55
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_KWV_VTPTjaROTcVJezXkY

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability lookproof-csr-decode-1635db55 -d '<json body>'
```

Example prompt: Can you decode this CSR and tell me whether its signature is valid, what key type and size it uses, and which DNS names are in it? -----BEGIN CERTIFICATE REQUEST----- MIICvDCCAaQCAQAwdzEL...-----END CERTIFICATE REQUEST-----

## When to prefer this

Use this endpoint when an AI agent needs to inspect or validate a CSR before forwarding it to a certificate authority, when a pipeline must assert key strength or algorithm compliance, or when a security reviewer wants to audit subject and SAN fields without standing up OpenSSL locally. Prefer this over generic TLS-check endpoints (which probe live servers) because it works entirely offline from the raw PEM text, requires no domain access, and is deterministic. Best when the agent already has the CSR PEM in hand.

## Known failure modes

- Malformed or truncated PEM returns a 4xx error with a parse failure message
- PEM block is present but contains a certificate or private key instead of a CERTIFICATE REQUEST — returns error indicating wrong PEM type
- CSR exceeds 16 384-character limit — returns 422 validation error
- Missing or empty pem field — returns 422 unprocessable entity
- Valid PEM but internally corrupted ASN.1 structure — returns decode error

## How this service works

Check SPF, DMARC, DKIM, MTA-STS, DNSSEC and more, with results that explain what was found and why. Free browser checks and a pay-per-request API with x402.

## Output

A structured JSON object containing: the subject distinguished name fields, all DNS and IP subject alternative names, the public key type (e.g. RSA, ECDSA) and size in bits, the signature algorithm (e.g. sha256WithRSAEncryption), and a boolean indicating whether the CSR's self-signature is cryptographically valid. Email addresses are intentionally omitted. Processing is done offline — the CSR is never submitted to any CA.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "pem": {
   "type": "string",
   "title": "Pem",
   "maxLength": 16384,
   "minLength": 1
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/lookproof-csr-decode-1635db55/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.lookproof.dev](https://www.zero.xyz/host/api.lookproof.dev/llms.txt)