# CSR API
> Generate and parse X.509 Certificate Signing Requests (PKCS#10) — the CSRs you submit to a Certificate Authority to obtain a TLS certificate. Generate a CSR from a common name plus optional organisation, country, locality and Subject Alternative Names, and get back the CSR together with a freshly-generated RSA private key (2048/3072/4096). Or parse an existing CSR to read its subject, SANs, key size and whether its signature is valid. Pure local processing — no key, no third-party service. Note: for development and testing; keep production private keys offline. Live, nothing stored. 3 endpoints. Distinct from key-pair generation, certificate decoding and live SSL checks.

## Authentication
All requests require your oanor API key in the `x-oanor-key` header. Get one at https://www.oanor.com/developer/keys.

```bash
curl -H "x-oanor-key: oanor_live_…" "https://api.oanor.com/csr-api/..."
```

## Pricing
- **Free** (Free) — 1,120 calls/Mo, 2 req/s
- **Starter** ($3/Mo) — 10,000 calls/Mo, 8 req/s
- **Pro** ($23/Mo) — 144,000 calls/Mo, 20 req/s
- **Mega** ($59/Mo) — 740,000 calls/Mo, 50 req/s

## Endpoints

### CSR

#### `GET /v1/generate` — Generate a CSR + private key

**Parameters:**
- `common_name` (query, required, string) — Common name (domain) Example: `example.oanor.com`
- `org` (query, optional, string) — Organisation Example: `oanor`
- `country` (query, optional, string) — 2-letter country Example: `DE`
- `san` (query, optional, string) — Comma-separated SANs Example: `example.oanor.com,www.example.oanor.com`
- `bits` (query, optional, string) — RSA bits 2048|3072|4096

**Example:**
```bash
curl -H "x-oanor-key: $KEY" \
  "https://api.oanor.com/csr-api/v1/generate?common_name=example.oanor.com&org=oanor&country=DE&san=example.oanor.com%2Cwww.example.oanor.com"
```

**Response:**
```json
{
    "data": {
        "csr": "-----BEGIN CERTIFICATE REQUEST-----\r\nMIICxDCCAawCAQAwOTEaMBgGA1UEAxMRZXhhbXBsZS5vYW5vci5jb20xCzAJBgNV\r\nBAYTAkRFMQ4wDAYDVQQKEwVvYW5vcjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC\r\nAQoCggEBAOP1i2LVX31aSiSw+AggIb7UyHBYctldSsqVuMbzYJmp1x8EozR6r8hT\r\nQvUWe4fEv2dWTl7Ao6Op8garZ7Q4J2ag7YSqER69/ud8uAF8ou9s+vhzJKhjSbKn\r\nGOZysEy91BdP6A6KaLti88IeewYBrN9MqN4jUJeGKFf2M0jLgjPj5Y4cS3QP5uyr\r\nWYWHPm7VaFTBFUd0KFQknWMaApZ+5H7HwLKFEO20C7VcZqGA07XoTSw3v1fCTrRi\r\nTME0AJRlzRFfHtwPNTLX1/ipYhcaSM3rg1XvkNG7XRVmAceK7r2zfAMgy9dZdo4p\r\n5kNKTjIpsFJq5i9hEcK5+wGGJrUooWcCAwEAAaBGMEQGCSqGSIb3DQEJDjE3MDUw\r\nMwYDVR0RBCwwKoIRZXhhbXBsZS5vYW5vci5jb22CFXd3dy5leGFtcGxlLm9hbm9y\r\nLmNvbTANBgkqhkiG9w0BAQsFAAOCAQEAcOJchKBQ4tgZh9HQSLfWHEO3wqO/uzD/\r\nrHqzap1KKwEZW8WDVqI7NIMY9ASIdBtgboreAMzzVDjmpTEmlknyOEnw1+5E31yf\r\n44HMdlNbTo++AeS/yq3ZGL/0n8uKddXydIB5h+tnwCgkbo5tO5U7y0dSfGZaXhws\r\nkicoYJrMAKmFE7m9l5z9h9cwq9xiGvwp+BV7aS0AD7wARdueyXuZVhS8toH2xBQZ\r\nmDtv6ym28H2BsnSTvDGjWZLZKYuoAocBEEBDCVe0XAWEdbQcwohAHMjS0qvzms+w\r\nqNK9z+vMi+cqLnafNg+2TNCRAnFJdQjrGVCoVHs7PTK/Urp93RPxnA==\r\n-----END CERTIFICATE REQUEST-----\r\n",
        "note": "For development/testing — keep production private keys offline.",
        "key_bits": 2048,
        "common_name": "example.oanor.com",
        "private_key": "-----BEGIN PRIVATE KEY-----\nMIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQDj9Yti1V99Wkok\nsPgIICG+1MhwWHLZXUrKlbjG82CZqdcfBKM0eq/IU0L1FnuHxL9nVk5ewKOjqfIG\nq2e0OCdmoO2EqhEevf7nfLgBfKLvbPr4cySoY
…(truncated, see openapi.json for full schema)
```

#### `GET /v1/parse` — Parse a CSR

**Parameters:**
- `csr` (query, required, string) — PEM CSR Example: `-----BEGIN CERTIFICATE REQUEST-----
MIICxDCCAawCAQAwOTELMAkGA1UEBhMCREUxDjAMBgNVBAoMBW9hbm9yMRowGAYD
VQQDDBFleGFtcGxlLm9hbm9yLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC
AQoCggEBALPS08xpej3RxLTC6NzPDePUDG1aKZRURiB6nezaGZpUN17Ip47dEqxm
zoXz7fB95WttryWqAQIErul2LFiCSyt5jK5TNn+LDXAo2uR+SaN8d20hyeTh/shm
v9rD338a+mop3IO9Tgx4eQhTu9lqLOLbiLtDcufq7H5P6x2q0AgTHYYDvV3GWJje
m5vvuuix4YVW9ZGaBq5S2Pt3xKIENZ5N0wS3uxCJYdUc9a+tK2ttS03MdM8XzsVq
otOB7eyIQEmPTDGZS2mOCuSE1oDki/3/xIVY4QVslZ2SETDt0tThgqKmVHhW3jHv
3s/ZRaOC+qc8+V9tvokzoK1+6v9pkw8CAwEAAaBGMEQGCSqGSIb3DQEJDjE3MDUw
MwYDVR0RBCwwKoIRZXhhbXBsZS5vYW5vci5jb22CFXd3dy5leGFtcGxlLm9hbm9y
LmNvbTANBgkqhkiG9w0BAQsFAAOCAQEAkrVZEjOXDTTzbvPg5p/8w5eeCMAkwNcO
cOIo6ox9+1K2R6ssbhuZ5NnVbmKFLFOkUpqXKHlxIyA4MXY9z1G0U4YEm9WHrQ98
fg0o5WrIv/3m5koMkB4aCYcGznxgEIzkn+PE2lMtiZrVrRLYCOA5YJw0A0EGQM4W
CTEYTcxHpHMUcu9N3jA9V+Jhn3uEfw9Z0GNeBdROWRNiTBMrvWb+s16UE81J/HUW
WoQqFFyMRv8z9bGIjN2dsvoppFM4TRZ7mDNkxmSN4o9OiCpwBaU+DEn9GFH1jDVy
VT9bH91hecoMll1L+Mr/vfYBCGaO0r76TJQdKQVd8UKaKzffgb3Jvw==
-----END CERTIFICATE REQUEST-----`

**Example:**
```bash
curl -H "x-oanor-key: $KEY" \
  "https://api.oanor.com/csr-api/v1/parse?csr=-----BEGIN+CERTIFICATE+REQUEST-----%0AMIICxDCCAawCAQAwOTELMAkGA1UEBhMCREUxDjAMBgNVBAoMBW9hbm9yMRowGAYD%0AVQQDDBFleGFtcGxlLm9hbm9yLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC%0AAQoCggEBALPS08xpej3RxLTC6NzPDePUDG1aKZRURiB6nezaGZpUN17Ip47dEqxm%0AzoXz7fB95WttryWqAQIErul2LFiCSyt5jK5TNn%2BLDXAo2uR%2BSaN8d20hyeTh%2Fshm%0Av9rD338a%2Bmop3IO9Tgx4eQhTu9lqLOLbiLtDcufq7H5P6x2q0AgTHYYDvV3GWJje%0Am5vvuuix4YVW9ZGaBq5S2Pt3xKIENZ5N0wS3uxCJYdUc9a%2BtK2ttS03MdM8XzsVq%0AotOB7eyIQEmPTDGZS2mOCuSE1oDki%2F3%2FxIVY4QVslZ2SETDt0tThgqKmVHhW3jHv%0A3s%2FZRaOC%2Bqc8%2BV9tvokzoK1%2B6v9pkw8CAwEAAaBGMEQGCSqGSIb3DQEJDjE3MDUw%0AMwYDVR0RBCwwKoIRZXhhbXBsZS5vYW5vci5jb22CFXd3dy5leGFtcGxlLm9hbm9y%0ALmNvbTANBgkqhkiG9w0BAQsFAAOCAQEAkrVZEjOXDTTzbvPg5p%2F8w5eeCMAkwNcO%0AcOIo6ox9%2B1K2R6ssbhuZ5NnVbmKFLFOkUpqXKHlxIyA4MXY9z1G0U4YEm9WHrQ98%0Afg0o5WrIv%2F3m5koMkB4aCYcGznxgEIzkn%2BPE2lMtiZrVrRLYCOA5YJw0A0EGQM4W%0ACTEYTcxHpHMUcu9N3jA9V%2BJhn3uEfw9Z0GNeBdROWRNiTBMrvWb%2Bs16UE81J%2FHUW%0AWoQqFFyMRv8z9bGIjN2dsvoppFM4TRZ7mDNkxmSN4o9OiCpwBaU%2BDEn9GFH1jDVy%0AVT9bH91hecoMll1L%2BMr%2FvfYBCGaO0r76TJQdKQVd8UKaKzffgb3Jvw%3D%3D%0A-----END+CERTIFICATE+REQUEST-----"
```

**Response:**
```json
{
    "data": {
        "key": {
            "bits": 2048,
            "type": "rsa"
        },
        "subject": {
            "C": "DE",
            "O": "oanor",
            "CN": "example.oanor.com"
        },
        "signature_valid": true,
        "subject_alt_name": [
            "example.oanor.com",
            "www.example.oanor.com"
        ]
    },
    "meta": {
        "timestamp": "2026-06-02T16:51:51.793Z",
        "request_id": "4118bc86-e1d3-46c3-aab4-0046f93b05b7"
    },
    "status": "ok",
    "message": "Parse a CSR",
    "success": true
}
```

### Meta

#### `GET /v1/meta` — Spec

**Example:**
```bash
curl -H "x-oanor-key: $KEY" \
  "https://api.oanor.com/csr-api/v1/meta"
```

**Response:**
```json
{
    "data": {
        "auth": "none upstream; this gateway requires x-api-key",
        "name": "CSR API",
        "note": "Generate and parse X.509 Certificate Signing Requests. /v1/generate?common_name=example.com&org=…&san=example.com,www.example.com&bits=2048 returns a CSR plus a fresh RSA private key (PEM). /v1/parse?csr=… reads the subject, SANs, key size and signature validity. For development/testing — keep production keys offline. Distinct from key-pair generation, certificate decoding and live SSL checks.",
        "source": "Local PKCS#10 generation/parsing (Node crypto + node-forge) — no key, no upstream",
        "endpoints": 3
    },
    "meta": {
        "timestamp": "2026-06-02T16:51:51.890Z",
        "request_id": "019a9f5b-2f21-4695-9b70-ac93e4a86b3f"
    },
    "status": "ok",
    "message": "Meta",
    "success": true
}
```


---
Marketplace page: https://www.oanor.com/api/csr-api
OpenAPI spec: https://www.oanor.com/api/csr-api/openapi.json