Public site monitor

Independent of ACME renewals entirely - add any externally-reachable hostname and CertIntel polls its live TLS certificate directly on a timer. No script or API key needed for the common case: add it from the Public Endpoints page in your dashboard. The dashboard reaches out here; if you need to monitor a certificate on a host CertIntel can't reach, use the internal certificate scanners instead.

Note

Probes are SSRF-safe: targets that resolve to private, loopback or link-local addresses are refused. Only a successful probe overwrites the stored certificate details - a transient outage updates the last-checked timestamp and error message only, so a blip never wipes the last known-good data.

Adding a target via the API

Authenticate as a logged-in dashboard user or an admin-scoped API key (this is a management action, not an unattended reporting post). A write/ingest key cannot add targets.

Field	Type	Notes
hostname	string	required; a bare hostname
port	integer	default 443
label	string	optional friendly name
organization	string	organization id or slug; required for a tenant-wide key, ignored for an org-scoped one
check_interval_seconds	integer	optional; 300 - 2592000

curl -X POST https://<tenant>.certintel.example/api/v1/targets \
  -H "X-Api-Key: cik_<prefix>.<secret>" \
  -H "Content-Type: application/json" \
  -d '{"hostname": "www.example.com", "port": 443,
       "label": "Marketing site", "organization": "secops"}'

The first TLS check runs synchronously as part of this call, so the new entry has real certificate data immediately. Returns 409 if that hostname+port already exists for the organization.

Forcing an immediate re-check

curl -X POST https://<tenant>.certintel.example/api/v1/targets/<target-id>/check \
  -H "X-Api-Key: cik_<prefix>.<secret>"

A cross-tenant or unknown target id returns 404, never 403.