Certify+

Changelog

v1.1.0 — 2026-08-12

Documentation catch-up release. The endpoints below shipped between May and June 2026 but were missing from these guides; this entry records them, and the OpenAPI spec has been corrected to match the routes exactly. No breaking changes — every v1.0.0 request shape still works.

Added

  • GET /api/v1/certificates/:id/pdf — download the frozen certificate PDF (application/pdf).
  • POST /api/v1/certificates/:id/send — send the delivery email, with PDF attached when renderable. Returns 202.
  • GET /api/v1/certificates/:id/emails — paginated email send history for a certificate.
  • GET /api/v1/usage — current tier plus the period certificate counter, so you can show remaining quota before triggering a 402.
  • CORS support for allowlisted partner origins, including 204 preflight responses. See Authentication.
  • IP-bucketed rate limiting on the public GET /verify/:code endpoint (60 req / 60s).

Fixed (documentation)

  • POST /certificates request body: the spec previously declared recipientName as a required top-level field and advertised recipientEmail and dataJson. None of those exist on this endpoint — the body is templateId plus exactly one of recipient or recipients. Generated clients built against the old spec would have failed with 422.
  • GET /certificates no longer advertises an emailStatus filter; the endpoint never supported it.
  • GET /templates perPage default corrected to 20 (the spec said 12).
  • 403 forbidden (account not entitled to API access) is now documented; previously only insufficient_scope was listed.
  • 409 conflict is documented as live on POST /certificates/:id/send — it was previously marked "reserved for future use".
  • GET /verify/:code now documents its 422 and 429 responses.
  • Certificate objects document verificationCount, emailCount, and downloadCount, which the API has always returned.
  • X-RateLimit-* and Retry-After response headers are declared in the spec.
  • Batch issuance quota behaviour documented: batch is partial and returns 201, not 402.

Known limitations

  • Outbound webhooks not available yet (see Webhooks).
  • No SDKs yet — generate one from the OpenAPI spec or file a request.

v1.0.0 — 2026-04-19

Initial public release.

Added

  • GET /api/v1/templates, GET /api/v1/templates/:id
  • POST /api/v1/certificates (single + batch), GET /api/v1/certificates, GET /api/v1/certificates/:id
  • POST /api/v1/certificates/:id/revoke
  • GET /api/v1/verify/:code (public)
  • GET /api/v1/openapi.json — OpenAPI 3.1 spec
  • API key management UI at Settings → API Keys
  • Per-key sliding-window rate limiting (60 req/60s)