api.orioncmd.com x402 offerings

When does this domain's TLS certificate expire, and is renewal stuck? Input: ?domain=example.com. Returns issuer, not_after, days_left, % lifetime used, renewal cadence, a renewal-stall flag (from Certificate Transparency logs via Cert Spotter) and a live HTTPS handshake/status probe. $0.01 USDC on Base. Certificate details come from CT logs, not the live served cert. For cert+DNS+expiry in one call use /v1/site-health ($0.03).

Check a domain's email authentication: SPF, DMARC, DKIM, MTA-STS, TLS-RPT and BIMI. $0.01 USDC on Base per call. Returns SPF validity and lookup count (limit 10), DMARC policy/pct/rua, DKIM on common selectors, MTA-STS mode, TLS-RPT, BIMI, a rough 0-100 score and plain-English findings. Don't use this for DKIM on custom selectors; only common selectors are checked.

Check a website's HTTP security headers and redirect chain. $0.01 USDC on Base per call. One HTTPS GET returns the redirect chain, final status, HSTS, CSP, X-Frame-Options and other headers, a simple A-F grade and plain-English findings. Don't use this for a full site security audit; use /v1/audit-report.

Runs the cert, DNS, expiry, email-auth and security-header checks and scores them: TLS 25, email auth 25, HTTP headers 20, DNS (resolves, DNSSEC, CAA) 15, registration expiry 15. Returns one A-F letter, a 0-100 score, each category's points and notes, and the top fixes. Unlike /v1/site-health (raw cert/DNS/expiry data, no grade), this is a graded scorecard that also covers email auth and headers.

Resolves the hostname (A/AAAA via Cloudflare DoH), matches the hostname, its parent domains and resolved IPv4 addresses against ThreatCluster's high-confidence 30-day IOC feed (cached, refreshed hourly), and looks up ransomware leak-site claims naming the domain from commercially reusable sources (via Dragons Eye). Returns one verdict: listed, claimed, listed_and_claimed or no_known_threat. No mat

OrionCMD Checks: Bulk IOC check: up to 100 domains or IPv4 (domains resolved, IPs matched too). Up to 100 comma- or newline-separated domains, URLs or IPv4 addresses in ?q=. Each domain is resolved (A) and the name, parent domains and resolved IPv4 are matched against ThreatCluster's high-confidence 30-day IOC feed (cached, refreshed hourly). No ransomware-claim lookups (use /v1/threat-check). Stale feed answers 503 before payment.

Check a domain's DNS records, DNSSEC, CAA, SPF and DMARC. $0.01 USDC on Base per call. Returns NS, A/AAAA/CNAME, MX, SPF, DMARC, CAA and DNSSEC via Cloudflare DoH, with plain-English findings and paste-ready fixes with dig verify commands. Don't use this for DKIM, MTA-STS or BIMI; use /v1/email-auth.

One report for a client or vendor review: runs every check (TLS from CT logs + live probe, DNS/DNSSEC/CAA, RDAP expiry and transfer lock, SPF/DMARC/DKIM/MTA-STS, security headers) plus HTTP->HTTPS redirect, www/apex consistency, RFC 9116 security.txt, robots.txt and sitemap. Returns the A-F grade and score (same weights as /v1/domain-grade), an action plan sorted critical > high > medium > low whe

Check a domain's certificate, DNS and expiry together in one call. $0.03 USDC on Base per call. Returns a summary, the renewal-stall heuristic, the Let's Encrypt 64-day (2027-02-10) note and fixes[] with paste-ready DNS records and auto-renew steps, each with a verify command. Partial results if one source fails. Don't use this for an A-F grade; use /v1/domain-grade.

When does a domain expire? Registration expiry and registrar via RDAP. $0.01 USDC on Base per call. Returns registrar, registration and expiry dates, days left, EPP status and nameservers. Within 60 days of expiry, fixes[] gives auto-renew steps for the registrar. Don't use this for SSL certificate expiry; use /v1/cert.