- Overview
- Reference Guide
- Setup & Architecture
- Release Notes
- Workflow
- API Reference
- Integration Guide
- Discovery Agent Setup Guide
Health
The Health endpoints confirm that the CertSecure Manager backend is reachable, report the installed version, validate an API token, and return health information for the connected PKI.
Endpoints
| Method | Endpoint | Description |
|---|---|---|
| GET | /check | Readiness and licence probe. |
| GET | /check_token | Authenticated health check. |
| GET | /get/pkiinfo | PKI health summary. |
| GET | /version | Product version. |
GET /check
Answers while the process is serving, and says whether the instance is ready to be used: the administrator account exists and the licence is valid. Takes no Authorization header. The answer is text, not JSON. A ready instance answers True (text/plain). An instance that is not ready still answers 200, with the message as the body (text/html): Admin is not Initialized! or License is not activated; the web interface reads the body as text and compares it with exactly these two messages to send the user to the setup wizard, so they are part of the contract. A licence that fails to verify is a 401 whose body is the reason. The connectors only look for a 200. The licence is re-verified at most once a minute, and the first request to a ready instance also creates the instance keys if they are missing.
Note: This endpoint does not require authentication.
Example Request
curl -X GET "https://<certsecure-backend-url>/check" \
-H "Authorization: Bearer <token>"Responses
| Status Code | Description |
|---|---|
| 200 | Serving. True when the instance is ready; otherwise one of the two setup messages, still with status 200. |
| 401 | The licence does not verify. The body is the reason, as text. |
GET /check_token
Succeeds only for a caller presenting a valid credential, so it doubles as a quick "is this token still good" probe. Takes no parameters.
Example Request
curl -X GET "https://<certsecure-backend-url>/check_token" \
-H "Authorization: Bearer <token>"Responses
| Status Code | Description |
|---|---|
| 200 | The credential is valid. The body is the literal text True, sent as text/plain (it is not JSON, which would spell it true), so compare it as text or rely on the status code. |
| 401 | Authentication failed. The Authorization header is missing, malformed, expired, revoked, or names a session that no longer exists. |
GET /get/pkiinfo
The latest stored health reading of every onboarded Microsoft CA and AWS Private CA: CA certificate and CRL expiry, certificate utilisation, and whether each AIA and CDP location could be fetched. Public and third-party CAs (AWS Certificate Manager, ACME, DigiCert, GlobalSign, GoDaddy, Sectigo, ...) carry no PKI health reading and never appear here. Unauthenticated: takes no Authorization header and no parameters. Returns an empty array when no health data has been collected yet.
Example Request
curl -X GET "https://<certsecure-backend-url>/get/pkiinfo" \
-H "Authorization: Bearer <token>"Responses
| Status Code | Description |
|---|---|
| 200 | One object per CA that has a stored health reading. |
Example Response
[
{
"caName": "Issuing CA 1",
"healthData": {
"IssuingCA": {
"ExpireOn": "2036-01-13 10:21:54",
"MinutesRemaining": 5011030,
"CRLExpireOn": "2026-10-19 04:17:54",
"CRLMinutesRemaining": 3786,
"DeltaCRLExpireOn": "2026-10-13 05:48:02",
"DeltaCRLMinutesRemaining": 996,
"CertUtilization": 4.71,
"aia": {
"http://pki.example.com/CertEnroll/issuing-ca-1.crt": "Verified"
},
"cdp": {
"http://pki.example.com/CertEnroll/issuing-ca-1.crl": "Verified"
}
},
"RootCA": {
"ExpireOn": "2046-01-13 10:21:54",
"MinutesRemaining": 10268630,
"aia": {
"http://pki.example.com/CertEnroll/root-ca.crt": "Verified"
},
"cdp": {
"http://pki.example.com/CertEnroll/root-ca.crl": "Failed"
}
}
},
"lastUpdated": "Mon, 12 Oct 2026 14:00:00 GMT"
}
]GET /version
Reports the product release this installation is running. Unauthenticated: takes no Authorization header and no parameters.
Note: This endpoint does not require authentication.
Example Request
curl -X GET "https://<certsecure-backend-url>/version" \
-H "Authorization: Bearer <token>"Responses
| Status Code | Description |
|---|---|
| 200 | The running release and the deployment mode. |
Example Response
{
"Backend": "3.4",
"Frontend": "3.4",
"mode": "saas"
}