Knowledge Base
How to identify domains requiring-DCV revalidation using the Sectigo Certificate Manager API?
Overview:
As of March 12, 2026, domains whose Domain Control Validation (DCV) age exceeds 198 days must be revalidated before public certificates can be issued. Customers can use the SCM REST API to programmatically identify affected domains.
This document explains:
- The API call to use
- Example response output
- How to interpret the results
- Common scenarios (wildcards, order status, methods)
API Endpoint
GET /api/dcv/v1/validation
Required Headers
login: <SCM username>
password: <SCM password>
customerUri: <customerUri>
Accept: application/json
Query Parameters Used
|
Parameter |
Value |
Description |
|
expiresIn |
198 or lower |
Returns domains whose DCV expires in 198 days or fewer, corresponding to DCV age ≥ 200 days |
|
dcvStatus |
VALIDATED |
Limits results to domains with a currently valid DCV |
|
size |
100 (or higher) |
Number of results per page |
|
position |
0 |
Pagination offset |
Configurable DCV Expiration Window
The expiresIn parameter allows customers to define how far in advance they want to identify domains whose DCV is expiring.
This value is evaluated relative to the date the API request is executed.
Common Examples
|
Use Case |
expiresIn Value |
|
Short-term monitoring |
30 |
|
Quarterly review |
90 |
|
CAB Forum 200-day DCV rule |
198 |
|
Custom internal policy |
Customer-defined |
Example Request
GET https://cert-manager.com/api/dcv/v1/validation?expiresIn=198&dcvStatus=VALIDATED&size=100&position=0
This request returns all domains whose DCV expires within the next 198 days.
Example API Response
[
{
"domain": "*.abcdworktest.uk",
"dcvStatus": "VALIDATED",
"dcvMethod": "CNAME",
"dcvOrderStatus": "SUBMITTED",
"dcvOrderMethod": "CNAME",
"expirationDate": "2026-07-09"
},
{
"domain": "abcdworktest.uk",
"dcvStatus": "VALIDATED",
"dcvMethod": "CNAME",
"dcvOrderStatus": "SUBMITTED",
"dcvOrderMethod": "CNAME",
"expirationDate": "2026-07-09"
}
]
Each object in the response represents one domain or wildcard domain whose DCV falls within the revalidation window.
How to Interpret the Response Fields
|
Field |
Description |
|
domain |
The fully qualified domain name. Wildcard domains (*.example.com) are listed separately from base domains. |
|
dcvStatus |
Current DCV status. Only VALIDATED domains are returned when using the recommended filter. |
|
dcvMethod |
The method originally used to validate the domain (EMAIL, CNAME, TXT, HTTP, HTTPS). |
|
dcvOrderStatus |
Current state of the DCV order, if one exists. |
|
dcvOrderMethod |
Method selected for the DCV order (may differ from original method). |
|
expirationDate |
Date when the current DCV expires. Domains appearing in this response require revalidation before or by this date. |
Important Behavioral Notes -
1. Wildcard and Base Domains Appear Separately
For example:
*.example.com
example.com
Each requires its own DCV revalidation and revalidating one does not automatically cover the other.
2. dcvOrderStatus Does Not Mean Revalidation Is Complete
Common values you may see:
|
Status |
Meaning |
|
NOT_INITIATED |
No revalidation has been started |
|
AWAITING_SUBMISSION |
Revalidation is prepared but not submitted |
|
SUBMITTED |
Revalidation is in progress |
A domain remains listed until revalidation completes successfully.
3. Results Are Time-Dependent
The expiresIn filter is calculated relative to the date the API request is executed.
As time passes, additional domains will automatically appear in the results.
This is expected behavior.
4. Empty Response Is Not an Error
An empty array:
[]
means:
- No domains currently meet the criteria.
- No revalidation is required currently.
It does not indicate an API or permission issue.
Pagination Considerations
If the response header contains:
X-Total-Count: <number greater than size>
You must repeat the request with:
position = position + size
until all results are retrieved.
Summary
- This API call provides a programmatic equivalent to the SCM UI Domain report
- Each returned entry represents a domain that requires DCV revalidation
- The response includes enough information to:
- Identify affected domains
- Understand current validation and order state
- Automate reporting or alerting
Sample Postman Collection (Importable)
A ready‑to‑import Postman collection is included below.
It uses header‑based authentication, validates response structure, and includes logic to confirm expiration ranges.
This collection:
- Uses header-based auth only (no Basic nonsense)
- Includes tests to confirm JSON, status, and DCV logic
- Is safe for customers to reuse
How customers use it
- Open Postman
- Import → Raw text
- Paste the JSON below
- Fill environment variables
- Click Send
Postman Collection JSON
{
"info": {
"name": "SCM - DCV Revalidation (198-Day Rule)",
"description": "Identify domains requiring DCV revalidation based on the 198-day DCV rule effective March 12, 2026.",
"schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json"
},
"item": [
{
"name": "List Domains Requiring DCV Revalidation",
"request": {
"method": "GET",
"header": [
{
"key": "login",
"value": "{{scm_login}}"
},
{
"key": "password",
"value": "{{scm_password}}"
},
{
"key": "customerUri",
"value": "{{customer_uri}}"
},
{
"key": "Accept",
"value": "application/json"
}
],
"url": {
"raw": "{{scm_base_url}}/api/dcv/v1/validation?expiresIn=198&dcvStatus=VALIDATED&size=100&position=0",
"host": [
"{{scm_base_url}}"
],
"path": [
"api",
"dcv",
"v1",
"validation"
],
"query": [
{
"key": "expiresIn",
"value": "198"
},
{
"key": "dcvStatus",
"value": "VALIDATED"
},
{
"key": "size",
"value": "100"
},
{
"key": "position",
"value": "0"
}
]
}
},
"event": [
{
"listen": "test",
"script": {
"exec": [
"pm.test('Status code is 200', function () {",
" pm.response.to.have.status(200);",
"});",
"",
"pm.test('Response is JSON', function () {",
" pm.expect(pm.response.headers.get('Content-Type')).to.include('application/json');",
"});",
"",
"pm.test('Each item contains DCV fields', function () {",
" const body = pm.response.json();",
" pm.expect(Array.isArray(body)).to.be.true;",
" body.forEach(item => {",
" pm.expect(item).to.have.property('domain');",
" pm.expect(item).to.have.property('dcvStatus');",
" pm.expect(item).to.have.property('expirationDate');",
" });",
"});",
"",
"pm.test('DCV expiration is within expected range', function () {",
" const body = pm.response.json();",
" const today = new Date();",
" body.forEach(item => {",
" const exp = new Date(item.expirationDate);",
" const diffDays = Math.ceil((exp - today) / (1000 * 60 * 60 * 24));",
" pm.expect(diffDays).to.be.at.most(198);",
" });",
"});"
]
}
}
]
}
]
}
Related Articles: https://www.sectigo.com/knowledge-base/detail/impact-of-shorter-certificate-lifespans-on-DCV-reuse-and-SCM-domain-pre-validation
How to create a report in SCM to filter DCV for revalidation process within days?
Need assistance?
Contact our team for help with your purchase or issuing your certificate.
Live chat
Click the button below or click "Chat with an Expert" to start chatting with us now!
