No account

API

The same checks as the pages, in JSON, for your scripts and CI pipelines. No key or account; limited to 30 calls per minute per address. Nothing is saved.

POST /api/v1/analyse

Checks a SAML response (XML, base64 or form body). Fields: response (required), entity_id, acs_url, issuer, request_id, cert (PEM). Returns ok, checks (status, title, detail), nameId and attributes.

curl -s https://idkit.idkit.workers.dev/api/v1/analyse \
  -H 'content-type: application/json' \
  -d '{"response":"<samlp:Response …","entity_id":"https://mon-app/saml","cert":"-----BEGIN CERTIFICATE-----…"}'

POST /api/v1/metadata

Analyses metadata (a) and, if b is provided, both. Returns the type, fields, certificates (fingerprint, validity) and warnings.

curl -s https://idkit.idkit.workers.dev/api/v1/metadata \
  -H 'content-type: application/json' \
  -d '{"a":"<EntityDescriptor …"}'

POST /api/v1/diagnostic

Finds the probable cause of an error message (error field).

curl -s https://idkit.idkit.workers.dev/api/v1/diagnostic \
  -H 'content-type: application/json' \
  -d '{"error":"AADSTS700016 invalid audience"}'

Use in CI

Make the pipeline fail if ok is false: … | jq -e '.ok'.