/ssllabs/assessments/endpoints

POST /api/ssllabs/assessments/endpoints

Price: 5 credits

Return the SSL Labs assessment detail for a single endpoint IP of a host

How to use it

Fetch the TLS assessment detail for one specific server endpoint (IP address) of a host — useful for multi-IP / CDN hosts where each IP may have a different configuration. Returns the same per-endpoint report as the full assessment: grade, supported protocols and cipher suites, the full vulnerability battery, HSTS policy, forward secrecy and client handshake simulations for that IP. Provide the host and one of its endpoint IP addresses (the ipAddress values returned by the ssllabs/assessments endpoint).

Parameters

• access-token string required

Request body

• timeout integer — Max scrapping execution timeout (in seconds) (default: 600; min: 20; max: 1500)
• host string required — Hostname the endpoint belongs to (a bare domain or URL; scheme, path and port are stripped) (examples: "github.com", "cloudflare.com"; minLength: 1)
• s string required — Endpoint IP address (one of the ipAddress values from the host's assessment) (examples: "140.82.113.4", "104.16.132.229"; minLength: 1)
• from_cache boolean — Return a recently cached assessment when available instead of testing live (default: true)

Response

• @type string (default: "SsllabsEndpoint")
• ip_address string nullable
• server_name string nullable
• status_message string nullable
• grade string nullable
• grade_trust_ignored string nullable
• future_grade string nullable
• has_warnings boolean nullable
• is_exceptional boolean nullable
• progress integer nullable
• duration integer nullable
• delegation integer nullable
• details object nullable
  • @type string (default: "SsllabsEndpointDetails")
  • protocols array (default: [])
    • @type string (default: "SsllabsProtocol")
    • id integer nullable
    • name string nullable
    • version string nullable
  • cipher_suites array (default: [])
    • @type string (default: "SsllabsCipherSuite")
    • id integer nullable
    • name string nullable
    • cipher_strength integer nullable
    • kx_type string nullable
    • kx_strength integer nullable
    • named_group_id integer nullable
    • named_group_bits integer nullable
    • named_group_name string nullable
    • protocol_id integer nullable
  • named_groups array (default: [])
  • server_signature string nullable
  • prefix_delegation boolean nullable
  • non_prefix_delegation boolean nullable
  • reneg_support integer nullable
  • session_resumption integer nullable
  • session_tickets integer nullable
  • compression_methods integer nullable
  • supports_npn boolean nullable
  • supports_alpn boolean nullable
  • alpn_protocols string nullable
  • supports_aead boolean nullable
  • supports_cbc boolean nullable
  • chacha20_preference boolean nullable
  • forward_secrecy integer nullable
  • protocol_intolerance integer nullable
  • misc_intolerance integer nullable
  • has_sct integer nullable
  • ocsp_stapling boolean nullable
  • sni_required boolean nullable
  • http_status_code integer nullable
  • implements_tls13_mandatory_cs boolean nullable
  • zero_rtt_enabled integer nullable
  • hsts_policy object nullable
    • @type string (default: "SsllabsHstsPolicy")
    • status string nullable
    • max_age integer nullable
    • include_sub_domains boolean nullable
    • preload boolean nullable
    • header string nullable
  • hpkp_status string nullable
  • vulnerabilities object nullable
    • @type string (default: "SsllabsVulnerabilities")
    • beast boolean nullable
    • heartbleed boolean nullable
    • heartbeat boolean nullable
    • open_ssl_ccs integer nullable
    • open_ssl_lucky_minus20 integer nullable
    • ticketbleed integer nullable
    • bleichenbacher integer nullable
    • zombie_poodle integer nullable
    • golden_doodle integer nullable
    • zero_length_padding_oracle integer nullable
    • sleeping_poodle integer nullable
    • poodle boolean nullable
    • poodle_tls integer nullable
    • fallback_scsv boolean nullable
    • freak boolean nullable
    • logjam boolean nullable
    • dh_uses_known_primes integer nullable
    • dh_ys_reuse boolean nullable
    • drown_vulnerable boolean nullable
    • ecdh_parameter_reuse boolean nullable
    • supports_rc4 boolean nullable
    • rc4_only boolean nullable
    • rc4_with_modern boolean nullable
  • sims array (default: [])
    • @type string (default: "SsllabsSimulation")
    • client_id integer nullable
    • client_name string nullable
    • client_version string nullable
    • client_platform string nullable
    • is_reference boolean nullable
    • error_code integer nullable
    • error_message string nullable
    • attempts integer nullable
    • protocol_id integer nullable
    • suite_id integer nullable
    • suite_name string nullable
    • kx_type string nullable
    • named_group_name string nullable
  • cert_chains array (default: [])
    • @type string (default: "SsllabsCertChain")
    • id string nullable
    • cert_ids array (default: [])
    • issues integer nullable
    • no_sni boolean nullable

Errors

• 422 — The request body did not validate Check the fields against this schema. A URN with the wrong prefix is the most common cause.
• 408 — The request ran past its time limit Raise `timeout` in the request body, up to the maximum this endpoint documents. Lowering `count` or turning off the `with_*` flags also helps, because less work finishes sooner.
• 412 — Endpoint not found for this host / IP, or it could not be assessed Retrying will not help: either the entity does not exist, or the input points at a different one.
• 429 — Too many requests: a rate limit or a usage window is exhausted When the response carries an X-Retry-After header, wait that many seconds and retry: the same number is in the body as `detail.retry_after`, and the limit clears once that window passes. The message in the body names the limit that was hit.
• 500 — Something broke on our side Retrying will not help. If it keeps happening, send us the X-Request-ID from the response headers.
• 529 — Rate limit reached, or the endpoint is overloaded Wait at least 30 seconds, then retry.

Response headers

• X-Error — Error message text (present only on error)
• X-Request-ID — Unique request identifier
• X-Execution-Time — Execution time in seconds
• X-Result-Count — How many records the body carries. 0 means an empty result, which is a normal answer and not by itself an error. A non-zero count can come back together with X-Error when the failure happened partway through — read this header and X-Error independently.
• X-Total-Available-Results — How many records exist for this query, when the endpoint can say. On a `dry_run` request this is the answer and the body is empty. It saturates: the endpoint's documented maximum means 'at least that many', any smaller number is exact.
• X-Warning — Present when the request body carried keys this endpoint does not document. They were ignored, so any filter you meant to apply through them did not apply. Check the spelling against this schema and retry.
• X-Retry-After — Seconds to wait before retrying. Present only on 429.