Herald
OpenapiRealms

Caddy On-Demand TLS ask authorization endpoint.

Returns `200 {"authorized": true}` when `host` matches a published+enabled `custom_domain_mapping` row (design §4.2.2 ask / §5.1 effectiveness rule); `404` on a miss (Caddy declines TLS issuance); `401` when the `X-Herald-Ask-Key` header is missing or mismatches the configured shared secret. Never exposes realm information — this is a certificate-abuse gate.

GET
/api/internal/custom-domain/authorize

Returns 200 {"authorized": true} when host matches a published+enabled custom_domain_mapping row (design §4.2.2 ask / §5.1 effectiveness rule); 404 on a miss (Caddy declines TLS issuance); 401 when the X-Herald-Ask-Key header is missing or mismatches the configured shared secret. Never exposes realm information — this is a certificate-abuse gate.

Query Parameters

host*string

Hostname to authorize for TLS issuance

Response Body

application/json

application/json

application/json

application/json

curl -X GET "https://example.com/api/internal/custom-domain/authorize?host=string"
{  "authorized": true}
{  "code": "string",  "details": null,  "message": "string",  "requestId": "string",  "status": 0}
{  "code": "string",  "details": null,  "message": "string",  "requestId": "string",  "status": 0}
{  "code": "string",  "details": null,  "message": "string",  "requestId": "string",  "status": 0}