CSR decoder API

Decodes one PEM PKCS#10 request (RFC 2986): subject, DNS and IP names, key type and size, signature algorithm and whether the signature matches the key. Email addresses are never returned. Nothing is sent to a certificate authority.

POST https://api.lookproof.dev/v1/tls/csr-decode

Updated 2026-10-09

Examples use the Base (eip155:8453) network.

Input

A JSON body with content-type: application/json.

Name	Type	Required	Limits	Description
`pem`	string	Yes	1–16384 characters	One PEM CERTIFICATE REQUEST block, at most 16384 characters. Private keys are refused.

Example request

curl -i -X POST https://api.lookproof.dev/v1/tls/csr-decode \
  -H 'content-type: application/json' \
  -d '{"pem": "-----BEGIN CERTIFICATE REQUEST-----\nMIIBDzCBtgIBADAaMRgwFgYDVQQDDA93d3cuZXhhbXBsZS5jb20wWTATBgcqhkjO\nPQIBBggqhkjOPQMBBwNCAASYaBFVYf3ODOTflUCxvFDsM5JYUQi+lX/NiQHXhj8i\neWCINKAp3k2MFrjAsCXIYzDZt9kRgg8v6m4v7tBVmhQsoDowOAYJKoZIhvcNAQkO\nMSswKTAnBgNVHREEIDAegg93d3cuZXhhbXBsZS5jb22CC2V4YW1wbGUuY29tMAoG\nCCqGSM49BAMCA0gAMEUCID4KBezMJNy36Sj8p9NoYQDTus6ysKWT7yLaOxm5Vfa2\nAiEApYG7bF7p3rBwf7RghWBn+709OKTRM6jQhTmKnd96XXA=\n-----END CERTIFICATE REQUEST-----\n"}'

import asyncio
import os

from eth_account import Account
from x402 import x402Client
from x402.http.clients import x402HttpxClient
from x402.mechanisms.evm import EthAccountSigner
from x402.mechanisms.evm.exact import register_exact_evm_client


async def main() -> None:
    signer = EthAccountSigner(Account.from_key(os.environ["EVM_PRIVATE_KEY"]))
    client = register_exact_evm_client(x402Client(), signer, networks="eip155:8453")
    async with x402HttpxClient(client) as http:
        response = await http.post('https://api.lookproof.dev/v1/tls/csr-decode', json={'pem': '-----BEGIN CERTIFICATE REQUEST-----\nMIIBDzCBtgIBADAaMRgwFgYDVQQDDA93d3cuZXhhbXBsZS5jb20wWTATBgcqhkjO\nPQIBBggqhkjOPQMBBwNCAASYaBFVYf3ODOTflUCxvFDsM5JYUQi+lX/NiQHXhj8i\neWCINKAp3k2MFrjAsCXIYzDZt9kRgg8v6m4v7tBVmhQsoDowOAYJKoZIhvcNAQkO\nMSswKTAnBgNVHREEIDAegg93d3cuZXhhbXBsZS5jb22CC2V4YW1wbGUuY29tMAoG\nCCqGSM49BAMCA0gAMEUCID4KBezMJNy36Sj8p9NoYQDTus6ysKWT7yLaOxm5Vfa2\nAiEApYG7bF7p3rBwf7RghWBn+709OKTRM6jQhTmKnd96XXA=\n-----END CERTIFICATE REQUEST-----\n'})
        response.raise_for_status()
        print(response.json())


asyncio.run(main())

import { wrapFetchWithPaymentFromConfig } from "@x402/fetch";
import { ExactEvmScheme } from "@x402/evm";
import { privateKeyToAccount } from "viem/accounts";

const account = privateKeyToAccount(process.env.EVM_PRIVATE_KEY);
const fetchWithPayment = wrapFetchWithPaymentFromConfig(fetch, {
  schemes: [{ network: "eip155:8453", client: new ExactEvmScheme(account) }],
});

const response = await fetchWithPayment("https://api.lookproof.dev/v1/tls/csr-decode", {
  method: "POST",
  headers: { "content-type": "application/json" },
  body: JSON.stringify({"pem": "-----BEGIN CERTIFICATE REQUEST-----\nMIIBDzCBtgIBADAaMRgwFgYDVQQDDA93d3cuZXhhbXBsZS5jb20wWTATBgcqhkjO\nPQIBBggqhkjOPQMBBwNCAASYaBFVYf3ODOTflUCxvFDsM5JYUQi+lX/NiQHXhj8i\neWCINKAp3k2MFrjAsCXIYzDZt9kRgg8v6m4v7tBVmhQsoDowOAYJKoZIhvcNAQkO\nMSswKTAnBgNVHREEIDAegg93d3cuZXhhbXBsZS5jb22CC2V4YW1wbGUuY29tMAoG\nCCqGSM49BAMCA0gAMEUCID4KBezMJNy36Sj8p9NoYQDTus6ysKWT7yLaOxm5Vfa2\nAiEApYG7bF7p3rBwf7RghWBn+709OKTRM6jQhTmKnd96XXA=\n-----END CERTIFICATE REQUEST-----\n"}),
});
console.log(await response.json());

curl: unpaid request — returns 402 with the price (PAYMENT-REQUIRED). The Python and JavaScript clients pay it and send the request again. Only ordinary wallets (EOA) can pay; smart-contract wallets get a 402 without charge. See payments.

Example response

{
  "checked_at": "2026-10-24T12:00:00Z",
  "data": {
    "decoded": true,
    "key_bits": 256,
    "key_type": "ec",
    "notes": [
      "A request is only what its owner asks for: the CA decides which names and key usages the certificate gets."
    ],
    "omitted": [],
    "san_count": 2,
    "san_dns": [
      "www.example.com",
      "example.com"
    ],
    "san_ip": [],
    "signature_algorithm": "ecdsa-with-SHA256",
    "signature_valid": true,
    "subject": "CN=www.example.com",
    "subject_cn": "www.example.com"
  },
  "endpoint": "tls.csr_decode",
  "findings": [],
  "meta": {
    "cache_hit": false,
    "duration_ms": 42,
    "fresh_until": "2026-10-24T12:05:00Z",
    "observed_at": "2026-10-24T12:00:00Z",
    "resolver": null,
    "source": "offline"
  },
  "request_id": "req_aaaaaaaaaaaaaaaaaaaaaaaaaa",
  "schema_version": "1.0",
  "status": "ok"
}

Response fields

Field	Meaning
`request_id`	Unique id of this request. Quote it when you contact support.
`endpoint`	The endpoint id, for example mail.spf.
`schema_version`	Version of the response format, currently 1.0.
`checked_at`	When the check ran (ISO 8601, UTC).
`status`	ok, info, warning or error from the worst finding, or unknown when the check was incomplete. unknown is not an error in the domain.
`data`	The check's own data. Its fields are listed below.
`findings`	What was found: code, severity, message, explanation and evidence.
`meta`	Duration, cache use, resolver and how long the result stays fresh.

Fields in `data`

Field	Type
`decoded`	boolean
`subject`	string or null
`subject_cn`	string or null
`san_dns`	array of string
`san_ip`	array of string
`san_count`	integer
`omitted`	array of one of subject_email, issuer_email, san_email, san_other
`key_type`	one of rsa, ec, ed25519, ed448, dsa, other or null
`key_bits`	integer or null
`signature_algorithm`	string or null
`signature_valid`	boolean or null
`notes`	array of string

Status codes

Status	Code	Meaning	Do you pay?
200	—	The result is delivered, also when it has negative findings.	Yes: charged once per payment; redelivery of the same payment is free
402	—	Payment is required, or the attached payment was refused. The body states the price.	No
400	`bad_request`	The request is malformed.	No
409	`payment_in_progress`, `payment_bound_to_other_request`	This payment is already being processed, or it is bound to a different request. No new payment is taken.	No
413	`payload_too_large`	The body is larger than 64 KB.	No
422	`invalid_input`	The input failed validation on a request that carries a payment; nothing is charged. Without a payment, invalid input gets a 402 whose error field names the problem.	No
429	`rate_limited`	Too many requests from this IP address or payer.	No
502	`check_failed`	The check could not be completed.	No
503	`busy`, `unavailable`, `payments_unavailable`	The service is busy or temporarily unavailable.	No
504	`deadline_exceeded`	The check ran out of time.	No

Errors use the common error body. See errors.

Findings this endpoint can return

Certificate requests (2)

Warning CSR_NO_SAN The request asks for no host in subject alternative names.
Error CSR_SIGNATURE_INVALID The request's signature does not match its public key.

PEM data (4)

Error PEM_INVALID The PEM block cannot be decoded.
Info PEM_PERSONAL_DATA_OMITTED Email addresses and personal name types were left out of the result.
Warning PEM_WEAK_KEY The pasted certificate or request uses a weak public key.
Warning PEM_WEAK_SIGNATURE The pasted certificate or request is signed with SHA-1 or MD5.

CSR decoder API

Input

Example request

Example response

Response fields

Fields in data

Status codes

Findings this endpoint can return

Fields in `data`