• All requests must be issued over HTTPS.
• Project API requests use Authorization: ApiKey {PROJECT_API_KEY}.
• All project API routes include {workspaceId} and {projectId}.
• Domain creation and enable transitions are asynchronous and can return 202 Accepted.
• Request and response bodies are application/json.

No plan-specific request throttling contract is currently published. If infrastructure returns 429 Too Many Requests, retry with backoff and preserve idempotency on your side.

Validation errors occur when a request body, identifier, or query parameter is missing or invalid.

{
  "message": "Invalid request body"
}

Authorization errors occur when the project API key is missing, invalid, revoked, inactive, or lacks the required scope.

{
  "message": "Forbidden"
}

Requires the domains:write scope.

Requires the domains:write scope.

A project API key can work with domain lifecycle endpoints according to its declared scopes:

• Add a customer domain to a project.
• Read persisted DNS, hostname, and certificate status.
• Request read-only provider status refresh for an already linked hostname.
• Disable a domain before deleting it.

Configure webhooks from the project settings page. Owners and admins can set a webhook URL, enable/disable delivery, set a signing secret, and choose event types.

• Webhook settings are project-scoped.
• System events are visible in the notification catalog but are not project-webhook subscribable by default.
• Webhook secrets are used to sign each delivery attempt.

Outbound webhook deliveries send JSON with the same top-level shape used by notification events:

{
  "event_type": "workspace.domain_disabled",
  "scope": "workspace_event",
  "severity": "high",
  "title": "Domain disabled",
  "message": "Domain customer.example.com has been disabled.",
  "source": "domains.update",
  "workspace_id": "{workspaceId}",
  "project_id": "{projectId}",
  "payload": {
    "domain_id": "{domainId}",
    "domain_name": "customer.example.com"
  },
  "occurred_at": "2026-06-22T10:00:00Z"
}

Verify signatures

Recompute the HMAC with your webhook secret over {timestamp}.{rawBody} and compare it to X-SSLforSaaS-Signature.

Respond quickly

Return 2xx quickly and process long-running work asynchronously. SSLforSaaS retries transient delivery failures according to the worker retry policy.

Be idempotent

Webhook deliveries can be retried. Record processed event IDs or payload identifiers and skip duplicates gracefully.

When a domain is added to a project, SSLforSaaS uses the project's Cloudflare and routing mapping to direct traffic to the configured application endpoint. The domain create API does not currently accept a per-domain target parameter.

• Project application endpoint is the source of truth for origin routing.
• Domain create returns the authoritative CNAME/target information for customer DNS setup.
• Endpoint changes are managed from project settings and reconciled through provider-backed workflow.

Requires the project:read scope.

Requires the domains:read scope.

curl -X GET \
     -H "Authorization: ApiKey {PROJECT_API_KEY}" \
     'https://api.sslforsaas.io/workspaces/{workspaceId}/projects/{projectId}/domains?page=1&limit=20'

Sample Response

{
  "total": 2,
  "page": 1,
  "pages": 1,
  "domains": [
    {
      "_id": "65f000000000000000000001",
      "domain_name": "customer.example.com",
      "status": true,
      "ssl_status": "active",
      "provisioning": {
        "state": "active"
      }
    }
  ]
}