# SiteCheck Web Intel Certificate Revocation CRL Check

> SiteCheck Web Intel Certificate Revocation CRL Check is a paid API for AI agents from api.webintel-api.workers.dev, paid per call via x402, $0.002/call, status unknown (last checked 2026-10-25).

Checks whether a domain's current TLS certificate has been revoked by downloading its CRL Distribution Point and looking up the serial number

## Facts

- Endpoint: GET https://api.webintel-api.workers.dev/api/security/cert-revocation-crl?utm_source=zero.xyz
- Price: $0.002/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-25
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/sitecheck-web-intel-certificate-revocation-crl-check-4f9dc731
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_1DA5A3CZHvL-Poa7Zt5cP

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability sitecheck-web-intel-certificate-revocation-crl-check-4f9dc731
```

Example prompt: Can you check whether the current TLS certificate for github.com has been revoked by looking up its CRL — I want to know the revocation status and when the CRL was last updated?

## When to prefer this

Use this endpoint when you need CRL-based revocation checking specifically (not OCSP), when you want to inspect the published CRL timestamps, or when OCSP is unavailable or untrusted. Prefer over manual lookups when automating certificate health checks across many domains. Not suitable when real-time OCSP stapling status is required.

## Known failure modes

- Domain has no resolvable certificate in Certificate Transparency logs
- Certificate lacks a CRL Distribution Point extension
- CRL file is unreachable or returns a non-200 response
- Domain parameter missing or malformed
- CRL parsing error due to unexpected format
- Certificate Transparency data may lag real-time certificate issuance

## How this service works

For a domain's current certificate (taken from public Certificate Transparency data via CertSpotter): reads its CRL Distribution Point, downloads that public CRL, and reports whether the certificate's serial number is on it, plus the CRL's thisUpdate and nextUpdate. OCSP is not queried. Revocation status is as of the CRL's publication time.

## Output

Returns whether the domain's current TLS certificate serial number appears on the certificate's CRL Distribution Point list, along with the CRL's thisUpdate (last published time) and nextUpdate (next scheduled refresh time). Revocation status reflects the CRL publication time, not real-time OCSP status.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "domain"
     ],
     "properties": {
      "domain": {
       "type": "string",
       "description": "Domain name such as wikipedia.org (required)"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/sitecheck-web-intel-certificate-revocation-crl-check-4f9dc731/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.webintel-api.workers.dev](https://www.zero.xyz/host/api.webintel-api.workers.dev/llms.txt)