v0.34.10

docs/API.md

@@ -26,6 +26,7 @@ The current bundled `src/admin/openapi.json` declares these operations (among ot
 | `GET /api/metrics/json` · `GET /api/metrics/summary` | Full JSON snapshot (includes all Prometheus samples and `summary`) or compact computed `summary` only, both pull-only. [Monitoring](MONITORING.md). |
 | `GET /api/docker` · `POST /api/docker/refresh` | Docker-agent observation and refresh. |
 | `GET /api/certificates` · `POST /api/certificates/upload` | Certificate inventory/import. |
+| `POST /api/certificates/inspect` | Read DNS SAN coverage from a managed/external public PEM path for the editor; admin browser session only. |
 | `GET /api/acme` · `POST /api/acme/issue` · `POST /api/acme/renew` | Managed certificate jobs. |
 | `GET/PUT /api/preferences` | Personal UI settings. |
 | `GET /api/dashboard-presets` and named preset operations | Saved Overview presets. |
@@ -33,6 +34,8 @@ The current bundled `src/admin/openapi.json` declares these operations (among ot
 
 Some paths have additional DELETE/PATCH operations, job-status resources, query parameters or restricted actions. Use OpenAPI for the **actual fields/methods**, not guesses based on a table. `GET /metrics` here is not a replacement for the separate Prometheus exporter.
 
+Certificate inspection accepts `{ "cert_file": "filename.pem" }` for a managed file or an absolute external path and returns `{ "cert_file": "...", "covered_hosts": ["example.com"] }`. It applies the existing certificate-file trust and size checks and reads no private key. It makes no configuration or permission changes. This POST requires the signed-in administrator's normal Origin, request-marker and CSRF checks; general RO/RW API tokens and certificate-only credentials cannot call it.
+
 ## Authentication and safe writes
 
 - Ordinary API calls require an administrator browser/session cookie on the admin listener, or a scoped general API Bearer token for explicitly allowlisted API methods/paths. Logging in also provides CSRF context. Writes require correct Host/Origin, `X-CSRF-Token` and `X-RustProxy-Request: 1` as enforced by the server.