curl --request POST \
  --url https://api.iotools.cloud/v1/tool/tls-ssl-config-snippet-grader \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "configInput": "server {\n    listen 443 ssl http2;\n    server_name example.com;\n\n    ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;\n    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;\n\n    ssl_protocols       TLSv1.2 TLSv1.3;\n    ssl_ciphers         ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;\n    ssl_prefer_server_ciphers on;\n\n    ssl_stapling on;\n    ssl_stapling_verify on;\n\n    add_header Strict-Transport-Security \"max-age=63072000; includeSubDomains\" always;\n\n    root /var/www/example.com/public;\n}",
  "serverType": "auto",
  "targetProfile": "intermediate"
}
'

{
  "tool": "tls-ssl-config-snippet-grader",
  "tool_version": "1.0.1",
  "outputs": {
    "gradeSummary": [
      {
        "metric": "Grade",
        "value": "A — Excellent — config follows current best practices."
      },
      {
        "metric": "Score",
        "value": "100 / 100"
      },
      {
        "metric": "Server",
        "value": "Nginx"
      },
      {
        "metric": "Profile",
        "value": "Intermediate"
      }
    ],
    "findings": [
      {
        "severity": "OK",
        "issue": "No deprecated protocols enabled",
        "detail": "TLS 1.0/1.1/SSLv2/SSLv3 are correctly disabled.",
        "impact": ""
      },
      {
        "severity": "OK",
        "issue": "Forward-secret (ECDHE) ciphers present",
        "detail": "Server supports perfect forward secrecy.",
        "impact": ""
      },
      {
        "severity": "OK",
        "issue": "HSTS configured with strong max-age",
        "detail": "max-age=63072000; includeSubDomains",
        "impact": ""
      },
      {
        "severity": "OK",
        "issue": "OCSP stapling enabled",
        "detail": "Faster, more private handshakes.",
        "impact": ""
      }
    ],
    "suggestion": "# Mozilla Intermediate configuration (Nginx)\nssl_protocols TLSv1.2 TLSv1.3;\nssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305;\nssl_conf_command Ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256;\nssl_prefer_server_ciphers on;\nssl_session_tickets off;\nssl_stapling on;\nssl_stapling_verify on;\nadd_header Strict-Transport-Security \"max-age=63072000; includeSubDomains\" always;"
  },
  "credits_used": 3,
  "credits_remaining": null
}