BYTETOOLS

SSL Labs API

Free Qualys SSL Labs API with no key: deep TLS/SSL analysis of any HTTPS host, grading certificates, protocols and cipher suites. Tested curl example.

No API key requiredHTTPSFree tier

Endpoint tested and returned HTTP 200 on 2026-08-19

What is the SSL Labs API?

The SSL Labs API is Qualys's free, key-free API for analysing the TLS configuration of any public HTTPS server. It grades certificates, protocol support, cipher suites and known vulnerabilities, producing the same A+ to F rating as the SSL Labs website.

SSL Labs is the de facto standard for TLS assessment, and the same engine behind the familiar A+ grade is available through a free API. It checks certificate chains, protocol versions, cipher suite strength and exposure to known attacks.

The critical thing to understand is that scans are asynchronous and slow — a full assessment takes one to three minutes. You start a scan, then poll until `status` becomes READY. Treating it like a normal synchronous API is the usual mistake, and hammering it with polls will get you throttled.

Quick facts

Base URL
https://api.ssllabs.com/api/v3
Authentication
No API key required. Qualys asks that you respect the polling guidance and terms of use.
Rate limit
One assessment at a time per client is recommended; poll no more than once every 10 seconds.
Pricing
Free for assessing your own or publicly accessible hosts. Not for bulk commercial scanning.
CORS
Not enabled — call it from your server
Official docs
Read the docs

How to use the SSL Labs API

Every request below was executed against the live API on 2026-08-19, and the response shown is the real body it returned — not an illustration.

1. Check API availability and engine version

GET https://api.ssllabs.com/api/v3/info

curl
curl 'https://api.ssllabs.com/api/v3/info'
JavaScript (fetch)
const res = await fetch("https://api.ssllabs.com/api/v3/info");
if (!res.ok) throw new Error(`Request failed: ${res.status}`);
const data = await res.json();
console.log(data);
Python (requests)
import requests

res = requests.get("https://api.ssllabs.com/api/v3/info", timeout=20)
res.raise_for_status()
print(res.json())
Response — HTTP 200
{
  "engineVersion": "2.4.3",
  "criteriaVersion": "2009q",
  "maxAssessments": 7,
  "currentAssessments": 0,
  "newAssessmentCoolOff": 1000,
  "messages": [
    "This assessment service is provided free of charge by Qualys SSL Labs, subject to our terms and conditions: https://www.ssllabs.com/about/terms.html"
  ]
}

Parameters

ParameterTypeRequiredDescription
hoststringOptionalHostname to assess on /analyze. example.com
publishstringOptional`on` to publish results on the SSL Labs board. off
startNewstringOptional`on` to force a fresh scan rather than cached results. on
fromCachestringOptional`on` to accept a recent cached assessment — much faster. on
allstringOptional`done` to return full endpoint detail when finished. done

Response fields

engineVersionstring
Version of the assessment engine, from /info.
statusstring
DNS, IN_PROGRESS, READY or ERROR. Poll until READY.
endpoints[].gradestring
The letter grade, A+ through F.
endpoints[].detailsobject
Full analysis — protocols, ciphers, certificate chain, known vulnerabilities.
messagesarray
Terms-of-use and status messages from /info.

What you can build with the SSL Labs API

  • Automate TLS configuration checks in CI before a release
  • Monitor your own certificates and grades over time
  • Audit third-party services you depend on
  • Teach TLS configuration with concrete, graded feedback

Common errors and how to fix them

status: IN_PROGRESS

The scan has not finished; this is normal, not an error.

Fix: Poll every 10 seconds until status is READY. A full scan takes 1-3 minutes.

429

Polling too aggressively or running concurrent assessments.

Fix: Run one assessment at a time and poll no more often than every 10 seconds.

status: ERROR

The host is unreachable, or does not serve HTTPS.

Fix: Check the hostname resolves publicly — SSL Labs cannot reach internal or firewalled hosts.

SSL Labs API — frequently asked questions

Is the SSL Labs API free?

Yes, free with no API key for assessing publicly reachable hosts. Bulk commercial scanning is outside the terms of use.

Why does the API return IN_PROGRESS instead of results?

Assessments are asynchronous and take one to three minutes. Start the scan, then poll /analyze until status becomes READY — polling more often than every 10 seconds risks throttling.

Can I scan an internal server?

No. SSL Labs runs the scan from its own infrastructure, so the host must be reachable from the public internet.

How do I get results faster?

Pass fromCache=on to accept a recent cached assessment rather than forcing a fresh scan. For monitoring, cached results are usually sufficient.

Tools that pair with this API

JSON Formatter

Format, beautify and minify JSON online with 2-space, 4-space or tab indentation. Sort keys alphabetically and catch syntax errors instantly — free and private.

SSL Labs is an independent third-party service and is not affiliated with ByteTools or ByteVancer. Details on this page were verified on 2026-08-19; always check the official documentation before relying on this API in production, as terms and limits can change.