List Certificate Transparency logsList the logs, from the same published list Chrome uses, with who runs each one, its URL, its state, whether it speaks the RFC 6962 API or the newer tiled format, and the window of certificate expiry dates it accepts. Filter by state, operator, kind, or a word in the name.
Get a logRead everything the published list says about one log: its operator and their contact addresses, its URL, its public key, its state, how long it may take to include a certificate, and the expiry window it covers.
List log operatorsList the organisations running logs - Google, Cloudflare, Let's Encrypt, DigiCert, Sectigo and the rest - with how many logs each runs, how many are usable, and how they split between the two log formats.
Summarize the log listRead which version of the published log list is current, when it was published, how many logs are in each state, how they split between the two formats, and the range of certificate expiry dates the logs cover between them.
Find logs for a certificate expiry dateGiven the day a certificate expires, say which logs could hold it. Logs are sharded by year, so asking the wrong shard returns nothing - correctly and misleadingly. Answers that from the date, grouped by operator.
Get a log's tree headRead how big a log is right now and the root hash that commits to everything in it. Record both to check later that nothing already published has changed. Works on either kind of log.
Get a tiled log's checkpointRead a tiled log's checkpoint in full: its origin line, size, root hash and every signature on it, including the independent witnesses that co-sign it.
List the roots a log acceptsList the CA root certificates a log will accept chains up to, each decoded into its subject, issuer, validity dates and SHA-256 fingerprint. Filter by any text in the subject or issuer.
Get entries from a logRead a range of a log's entries and decode the certificate in each: the domain names it covers, who issued it, when it was issued and when it expires, its fingerprint, and the timestamps its CA embedded. Entries never move, so a workflow can pick up where it left off.
Get a log's newest entriesRead the certificates a log has just taken, newest first, without working out any index. This is the live view of what the web PKI is issuing right now.
Find certificates for a domain in a logScan the newest stretch of a log for certificates covering a domain, optionally including its subdomains - how a workflow catches a certificate being issued for a name it owns. Narrow further by issuing CA, by certificate or precertificate, and by when the log accepted it.
Prove an entry is in a logAsk a log to prove that an entry really is in it, from the leaf hash any entry-reading action returns, and check the proof against the log's own current root hash.
Get an entry with its proofRead the entry at a given position and prove it is in the log, in one call, so a workflow can quote a certificate and say in the same breath that the log stands behind it.
Prove a log has only appendedAsk a log to prove that everything it published at an earlier size is still there, unchanged. Record a tree head's size and root hash today, hand both back tomorrow, and get a yes or a no.
Get an issuer certificateFetch one of the CA certificates a tiled log stores, by its SHA-256 fingerprint, decoded and also as PEM ready to paste into another tool. Take a fingerprint from an entry's chain and look it up here.
