TLS Checker API

GET

Check supported TLS versions and highest negotiable protocol for any domain.

TLS Checker tests which TLS protocol versions a server accepts by running a live handshake for each of TLS 1.0, 1.1, 1.2 and 1.3. It reports the highest version, the cipher the server picks, whether the certificate validates, whether deprecated protocols are still exposed, a risk score and a letter grade from a published rubric.

Try it — live request, no key required

Request

GETapi.apiverve.com/v1/tlscheck?domain=amazon.com

Query parameters

domainstring

Verification

Format

No key required to try it. Get a key to use it in your app.

Example

{
  "status": "ok",
  "error": null,
  "data": {
    "domain": "amazon.com",
    "tlsVersions": {
      "TLSv1": false,
      "TLSv1.1": false,
      "TLSv1.2": true,
      "TLSv1.3": true
    },
    "highestVersion": "TLSv1.3",
    "negotiatedCipher": "TLS_AES_256_GCM_SHA384",
    "forwardSecrecy": true,
    "certificateTrusted": true,
    "certificateError": null,
    "hasDeprecatedTLS": false,
    "isSecure": true,
    "riskScore": 0,
    "riskLevel": "low",
    "grade": "A+",
    "gradeReasons": []
  }
}

About the TLS Checker API

A TLS checker API for testing a server's TLS version support from code, a cron job or a CI pipeline, with the answer in seconds. TLS Checker connects to the domain and port you give it and runs a separate handshake at each protocol version, so it reports exactly which of TLS 1.0, 1.1, 1.2 and 1.3 are accepted. From the handshake at the highest version it returns the negotiated cipher, whether that cipher has forward secrecy, and whether the certificate validates for the host. It flags deprecated TLS 1.0/1.1, returns a composite risk score, and assigns an A+ to F grade using APIVerve's own documented rubric: TLS 1.2 or newer and a valid certificate are required; TLS 1.0/1.1, or a chosen cipher without forward secrecy or AEAD, caps the grade at B; A+ needs TLS 1.3. It does not enumerate every cipher suite or test for named vulnerabilities, so the grade is not an SSL Labs grade.

What people use it for

Payment Gateway Auditing: Before onboarding merchant checkout domains, fintech compliance auditors check whether incoming endpoints accept legacy protocols like TLS 1.0 or 1.1.
Deployment Pipeline Verification: Flag outdated web server configurations during production releases by testing handshake support across all modern protocol versions before traffic switches over.
Attack Surface Scanning: Security analysts query customer-facing domains periodically to find legacy protocol support and review the highest negotiable version across exposed web ports.
Vendor Security Assessments: When evaluating SaaS suppliers, procurement teams inspect external hostnames to confirm that partner servers negotiate TLS 1.2 or 1.3.

Ways to call it

One endpoint, many ways in — REST with JSON, XML, YAML and CSV, plus GraphQL and an MCP interface for AI agents.

JSON: Default REST response
XML: Markup format
YAML: Human-readable
CSV: Tabular export
GraphQL: Query language
MCP: For AI agents

View all integrations →

How it compares

Side by side with the tools people weigh TLS Checker against — what each one is better at, in plain terms.

APIVerve vs SSL Labs →

Other ways to use TLS Checker

Same data, same APIVerve account, same credit balance — one key works on all of them.

Give it to an AI agentConnect over MCP and your agent calls it as a native tool — Claude, Cursor, ChatGPT.on VerveKit Google Sheets or ExcelA =VERVE() formula fills a column — no script, no export, recalculates in place.on VerveSheets Ground an agent on itA cited, machine-checkable fact your model can't produce on its own.on VerveContext

Questions.

Common questions about the TLS Checker API.

Read the docs →

Which TLS versions does the check test against?

The check runs live handshakes for TLS 1.0, 1.1, 1.2 and 1.3 and reports each one. From the highest version it also returns the negotiated cipher, whether it has forward secrecy, and whether the certificate validates for the host. You can target any domain and set a custom port if the service does not run on HTTPS port 443.

Which plan fits 25,000 domain TLS checks a month?

The Starter plan easily covers this volume. Each check costs 2 credits, so 25,000 scans use 50,000 of the 200,000 credits on Starter, working out to about $0.30 per 1,000 calls. The Free plan includes 100 checks each month for testing.

Are the grade, risk score and deprecated protocol flags available on the Free plan?

No, those are premium fields. The Free plan reports raw version support, the highest negotiable version, the negotiated cipher, forward secrecy and certificate validity. The letter grade and its reasons, the composite risk score, the risk level band, the deprecated TLS flag and the overall security verdict unlock on any paid plan.

Does this check use cached data or scan live?

Every check performs real-time TLS handshakes directly against the destination host and port at the moment of your request. It does not rely on cached or historical scan databases.

What does the response return if a server refuses all TLS connections?

If none of the tested TLS protocols successfully negotiate a handshake, each protocol flag returns false and the highest version field returns null. You can use that null check to detect non-TLS services or connection failures.

How is the TLS grade calculated?

It is APIVerve's own rubric, applied only to what this check measures. No TLS 1.2 or 1.3, or a certificate that fails validation, is an F. Accepting TLS 1.0 or 1.1, or choosing a cipher without forward secrecy or AEAD at the highest version, caps the grade at B. Otherwise the grade is A, or A+ when TLS 1.3 is supported. Every deduction is listed in gradeReasons. It does not enumerate cipher suites or probe for vulnerabilities, so it is not equivalent to an SSL Labs grade.

Request parameters — GET /v1/tlscheck

Sent in the query string. Premium parameters are accepted on every plan but only take effect on plans that include them. Anything not listed here is dropped rather than passed through.

Required

Parameter	Type	Example	Description
`domain`Required	string	`amazon.com`	The domain to check the TLS/SSL configuration for domain

Optional

Parameter	Type	Example	Description
`port`Optional	integer	`443`	The port to connect to (usually 443 for HTTPS) default 443 · range 1-65535

Example request

1
2

curl "https://api.apiverve.com/v1/tlscheck?domain=amazon.com&port=443" \
  -H "x-api-key: YOUR_API_KEY"

Authentication

Send your key in the x-api-key header. That is the only auth step — no token exchange, and no per-endpoint scope to configure.

Header	When	Value
`x-api-key`Required	Every request	Your API key. Header names are case-insensitive, so `X-API-Key` is the same header.
`Authorization`Alternate	Instead of the above	`Bearer <key>` — for clients that only expose bearer auth. Resolves to the same account and the same billing.

401 is the only auth verdict

A 401 means the key is missing, invalid or expired. A 403 means the key is valid but not permitted here — blocked by a key restriction or an IP allow-list. Running out of credits is a 429.

Response — GET /v1/tlscheck

Every APIVerve endpoint returns the same three top-level keys, so one response handler covers your whole integration: status, error and data. Only data changes shape.

Sample response

{
  "status": "ok",
  "error": null,
  "data": {
    "domain": "amazon.com",
    "tlsVersions": {
      "TLSv1": false,
      "TLSv1.1": false,
      "TLSv1.2": true,
      "TLSv1.3": true
    },
    "highestVersion": "TLSv1.3",
    "negotiatedCipher": "TLS_AES_256_GCM_SHA384",
    "forwardSecrecy": true,
    "certificateTrusted": true,
    "certificateError": null,
    "hasDeprecatedTLS": false,
    "isSecure": true,
    "riskScore": 0,
    "riskLevel": "low",
    "grade": "A+",
    "gradeReasons": []
  }
}

Response fields

Paths are relative to data. Premium fields are absent rather than zeroed on plans that do not include them, so check for presence instead of comparing to 0.

Field	Type	Example	Description
`domain`	string	`"amazon.com"`	Domain name that was checked for TLS configuration
`tlsVersions`	object	`{...}`	Whether the server completes a handshake at each protocol version, keyed TLSv1, TLSv1.1, TLSv1.2 and TLSv1.3
`TLSv1`	boolean	`false`	Whether TLS 1.0 protocol is supported by server
`1`	boolean	`false`	Whether TLS 1.1 protocol is supported by server
`2`	boolean	`true`	Whether TLS 1.2 protocol is supported by server
`3`	boolean	`true`	Whether TLS 1.3 protocol is supported by server
`highestVersion`	string	`"TLSv1.3"`	The highest TLS version the server supports (e.g. TLSv1.3), or null if none were negotiable
`negotiatedCipher`	string	`"TLS_AES_256_GCM_SHA384"`	Cipher suite the server chose in the handshake at the highest supported version (IANA name where known); null if no version was negotiable
`forwardSecrecy`	boolean	`true`	Whether that cipher uses ephemeral key exchange (ECDHE/DHE; always true for TLS 1.3); null if no version was negotiable
`certificateTrusted`	boolean	`true`	Whether the certificate presented at the highest version verifies to a trusted root and matches the host; null if no version was negotiable
`certificateError`	object	`null`	Verifier error code when certificateTrusted is false, e.g. CERT_HAS_EXPIRED, DEPTH_ZERO_SELF_SIGNED_CERT or ERR_TLS_CERT_ALTNAME_INVALID; otherwise null
`hasDeprecatedTLS`Premium	boolean	`false`	Whether the server still supports deprecated TLS 1.0 or 1.1, which are insecure and disallowed by PCI-DSS
`isSecure`Premium	boolean	`true`	Whether the server supports a modern TLS version (1.2/1.3) and does not expose any deprecated version
`riskScore`Premium	number	`0`	Composite 0-100 risk score based on missing modern TLS and exposure of deprecated protocols (higher is riskier)
`riskLevel`Premium	string	`"low"`	Risk band derived from the score: low, medium or high
`grade`Premium	string	`"A+"`	Letter grade A+, A, B or F from APIVerve's own rubric (see gradeReasons): F without TLS 1.2+/a valid certificate, capped at B for TLS 1.0/1.1 or a cipher lacking forward secrecy or AEAD, A+ with TLS 1.3. Not an SSL Labs grade. null if no version was negotiable
`gradeReasons`Premium	array	`[]`	Plain-English reasons for every deduction from A+ (empty for A+)

Response headers

Every response carries your balance, so your own code always knows where it stands without polling anything. All four are exposed to browsers through CORS.

Header	What it carries
`x-api-remaining-credits`	Credits left in the current cycle
`x-api-credits-used`	Credits spent in the current cycle
`x-api-max-credits`	The allowance for the cycle
`x-api-version`	Version of the endpoint that answered

Errors

Read the HTTP status first, then error for the specific reason. The body names the parameter that has to change.

Status	Meaning	What to do
`400`	Input was rejected	Read `error`; it names the parameter that has to change.
`401`	Key missing or invalid	Check the header name and the key value.
`403`	Key valid, but not permitted here	A key restriction or an IP allow-list — never a bad key.
`429`	Rate limited, or out of credits	Read `error` to tell them apart, then back off or top up.

What a call costs — 2 credits per call

Credits are shared across every APIVerve API — one balance, one key, one bill. Failed requests never count against it, so a rejected input costs nothing.

Plan	Per month	Credits	TLS Checker calls	Per 1,000 calls
Free	Free	200	100	Free
Starter	$29.99	200,000	100,000	$0.30
Pro	$99.99	1,000,000	500,000	$0.20
Mega	$299.99	4,000,000	2,000,000	$0.15

Calls are what the credits buy at this API's rate — spend them here, on any of the other APIs, or across both. Nothing is reserved per endpoint.

Compare all pricing tiers →

Call it from cURL — GET /v1/tlscheck

No SDK to install — this is a plain HTTPS call to /v1/tlscheck with your key in the x-api-key header. Swap in a real key and it runs as-is.

cURL

1
2

curl "https://api.apiverve.com/v1/tlscheck" \
  -H "x-api-key: YOUR_API_KEY"

Resources

GitHubapiverve/tlscheck-apiSource, issues and the examples this page is built from.ReferenceTLS Checker API docsEvery parameter, every response field, and the errors.ParametersWhat this call acceptsRequired and optional inputs, with example values.

Also published for

@apiverve/tlschecknpm APIVerve.API.TLSCheckerNuGet

Only the languages APIVerve ships a client for are listed — the rest call the endpoint directly over HTTPS.

Call it from Node.js — GET /v1/tlscheck

Install the Node.js SDK, then call the TLS Checker API with your key. The client wraps the same HTTPS request, so anything it returns is what the endpoint returns.

Install — npm

npm install @apiverve/tlscheck

Node.js

const res = await fetch("https://api.apiverve.com/v1/tlscheck", {
  headers: { "x-api-key": "YOUR_API_KEY" },
});
const { data } = await res.json();
console.log(data);

Resources

npm@apiverve/tlscheckThe published Node.js client, versioned and signed.GitHubapiverve/tlscheck-apiSource, issues and the examples this page is built from.ReferenceTLS Checker API docsEvery parameter, every response field, and the errors.ParametersWhat this call acceptsRequired and optional inputs, with example values.

Also published for

APIVerve.API.TLSCheckerNuGet

Only the languages APIVerve ships a client for are listed — the rest call the endpoint directly over HTTPS.

Call it from Python — GET /v1/tlscheck

No SDK to install — this is a plain HTTPS call to /v1/tlscheck with your key in the x-api-key header. Swap in a real key and it runs as-is.

Python

import requests

res = requests.get(
    "https://api.apiverve.com/v1/tlscheck",
    headers={"x-api-key": "YOUR_API_KEY"},
)
print(res.json()["data"])

Resources

Also published for

@apiverve/tlschecknpm APIVerve.API.TLSCheckerNuGet

Only the languages APIVerve ships a client for are listed — the rest call the endpoint directly over HTTPS.

Call it from C# / .NET — GET /v1/tlscheck

Install the C# / .NET SDK, then call the TLS Checker API with your key. The client wraps the same HTTPS request, so anything it returns is what the endpoint returns.

Install — NuGet

dotnet add package APIVerve.API.TLSChecker

C# / .NET

using var client = new HttpClient();
client.DefaultRequestHeaders.Add("x-api-key", "YOUR_API_KEY");

var json = await client.GetStringAsync("https://api.apiverve.com/v1/tlscheck");
Console.WriteLine(json);

Resources

NuGetAPIVerve.API.TLSCheckerThe published C# / .NET client, versioned and signed.GitHubapiverve/tlscheck-apiSource, issues and the examples this page is built from.ReferenceTLS Checker API docsEvery parameter, every response field, and the errors.ParametersWhat this call acceptsRequired and optional inputs, with example values.

Also published for

@apiverve/tlschecknpm

Only the languages APIVerve ships a client for are listed — the rest call the endpoint directly over HTTPS.

Call it from Go — GET /v1/tlscheck

No SDK to install — this is a plain HTTPS call to /v1/tlscheck with your key in the x-api-key header. Swap in a real key and it runs as-is.

req, _ := http.NewRequest("GET", "https://api.apiverve.com/v1/tlscheck", nil)
req.Header.Set("x-api-key", "YOUR_API_KEY")

res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))

Resources

Also published for

@apiverve/tlschecknpm APIVerve.API.TLSCheckerNuGet

Only the languages APIVerve ships a client for are listed — the rest call the endpoint directly over HTTPS.

Call it from PHP — GET /v1/tlscheck

No SDK to install — this is a plain HTTPS call to /v1/tlscheck with your key in the x-api-key header. Swap in a real key and it runs as-is.

PHP

$ch = curl_init("https://api.apiverve.com/v1/tlscheck");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, ["x-api-key: YOUR_API_KEY"]);

$response = curl_exec($ch);
echo $response;

Resources

Also published for

@apiverve/tlschecknpm APIVerve.API.TLSCheckerNuGet

Only the languages APIVerve ships a client for are listed — the rest call the endpoint directly over HTTPS.

Call it from Ruby — GET /v1/tlscheck

No SDK to install — this is a plain HTTPS call to /v1/tlscheck with your key in the x-api-key header. Swap in a real key and it runs as-is.

Ruby

require "net/http"

uri = URI("https://api.apiverve.com/v1/tlscheck")
req = Net::HTTP::Get.new(uri)
req["x-api-key"] = "YOUR_API_KEY"

res = Net::HTTP.start(uri.hostname, uri.port, use_ssl: true) { |h| h.request(req) }
puts res.body

Resources

Also published for

@apiverve/tlschecknpm APIVerve.API.TLSCheckerNuGet

Only the languages APIVerve ships a client for are listed — the rest call the endpoint directly over HTTPS.

All articles →

7 SSL Certificate Problems That Kill TrustExpired certs, mismatched domains, weak encryption. A practical checklist for catching SSL issues before your users do.Read

How to Detect VPN and Proxy UsersIdentify VPN, proxy, and datacenter IPs to prevent fraud and enforce geo-restrictions. Complete tutorial with code examples.Read

Preventing Fake Signups: Registration Fraud GuideLearn how to stop bots and fraudsters while maintaining conversion rates for legitimate users.Read

TLS Checker API

Try it — live request, no key required

About the TLS Checker API

What people use it for

Ways to call it

How it compares

Other ways to use TLS Checker

Questions.

Request parameters — GET /v1/tlscheck

Required

Optional

Authentication

Response — GET /v1/tlscheck

Response fields

Response headers

Errors

What a call costs — 2 credits per call

Call it from cURL — GET /v1/tlscheck

Resources

Also published for

Call it from Node.js — GET /v1/tlscheck

Resources

Also published for

Call it from Python — GET /v1/tlscheck

Resources

Also published for

Call it from C# / .NET — GET /v1/tlscheck

Resources

Also published for

Call it from Go — GET /v1/tlscheck

Resources

Also published for

Call it from PHP — GET /v1/tlscheck

Resources

Also published for

Call it from Ruby — GET /v1/tlscheck

Resources

Also published for

Zero-code embed — one snippet, no backend

Changelog — TLS Checker API

Networking

Related articles

Ready to build with TLS Checker? Start with 200 free credits — one key unlocks all 300+ APIs.

Explore the catalog