API Changelog

Notable additions, behaviour changes and fixes to the MySSL API, newest first. The base path /api/v1 is stable — we add endpoints and fields without breaking existing integrations, and any backwards-incompatible change would ship under a new version prefix.

June 2026

2026-06-24 Changed Fixed

Security Headers API quota raised — GET /headers/check now allows 400 requests/day anonymously and 2,000/day with a free API key.
Header grading parity — the Security Headers API grade now matches securityheaders.com's model, including the “capped at A” behaviour for unsafe CSP; MySSL's deeper checks are reported as a secondary score.
Rate limiting moved to shared Redis storage — burst limits are now enforced consistently across all application workers and keyed to the real client IP.
Fixes — POST /api-keys no longer returns an incorrect 403, POST /api-keys/:id/rotate no longer errors, and GET /domains/:id/certificate/chain returns 404 (instead of an empty 200) when no chain data is available.

2026-06-21 New

Public Security Headers API — anonymous GET /headers/check?q=<domain> returns securityheaders.com-compatible JSON (grade, score, tests passed/failed, raw headers) plus an X-Grade response header. Built as a drop-in replacement for the discontinued securityheaders.com API. Docs & migration guide →
Billing API — tier endpoints now include annual pricing alongside monthly.

2026-06-20 Changed

Domain ownership verification required — POST /domains now only accepts domains you have verified (DNS TXT record, or a match with your verified company email domain). Unverified domains return 403 with a verify_url. See Error Handling.

May 2026

2026-05-22 Changed

On-demand scans are fully asynchronous — the synchronous “quick scan” mode was retired. POST /scan for a hostname you don't monitor now queues the full analysis (60–120s) and returns 202 with a status_url to poll and a result_url for the finished report.

2026-05-14 Fixed

Atomic quota enforcement — concurrent POST /domains requests can no longer race past the tier's domain limit.

January 2026

2026-01-27 Fixed

Real client IPs — rate limiting and request logging now use the true client IP behind the proxy rather than the proxy address.

2026-01-24 New

Per-domain integration binding — alert integrations can be scoped to specific domains instead of firing for every domain on the account.

2026-01-13 New

API key management — GET/POST /api-keys, GET/DELETE /api-keys/:id and POST /api-keys/:id/rotate (paths finalised on 2026-01-14).
Certificates API — GET /domains/:id/certificate and GET /domains/:id/certificate/chain.
Usage API — GET /usage, /usage/history, /usage/limits and /usage/summary.
Per-key daily quotas enforced — exceeding your tier's daily request quota returns 429 with rate_limit, requests_today and reset_at.
This API documentation site published.

2026-01-10 New

Uptime Monitoring API — /uptime/monitors CRUD plus checks, incidents, an aggregate /uptime/status and manual check triggering.
Integrations API — /integrations CRUD with test delivery, delivery logs and supported-types listing.
Billing API — /billing/usage, /billing/invoices, /billing/estimate and related endpoints.
Tier limits on domain creation — POST /domains returns 403 with usage details when your plan's domain limit is reached.

2026-01-04 New

API v1 initial release — authentication (API keys and JWT /auth/login + /auth/refresh), domain management (/domains CRUD and per-domain scan trigger) and scan results (/scan, /scans/:id, /domains/:id/scans, /scans/stats).

Stay Informed

Questions about a change, or need advance notice for a large integration? Email support@myssl.info.