On-demand TLS authorization (BLE-1356): the edge (Caddy `on_demand_tls` "ask",
Dahili
or an ACME controller) calls this BEFORE issuing a certificate for an incoming SNI host. We return 200 only for a domain that maps to an ACTIVE tenant custom domain — so an attacker can't point an arbitrary host at us to mint certs or burn the ACME rate limit. Reuses the same `resolve_domain` lookup as edge routing. (Restrict to edge IPs at the network layer in production.)
İstek
curl -X GET "https://api.blesyum.com/internal/tls-authorize" \
-H "X-Blesyum-Internal: <imza>" \
-H "Accept: application/json"Yanıt
{
"data": "…",
"trace_id": "01JC…"
}