generated: '2026-07-17'
method: probed
source: live DNS/TLS/HTTP probes of apis.yml + OpenAPI hosts
hosts:
- host: portone.io
  https: true
  tls_version: TLSv1.3
  http_status: 308
  cert_expires: Oct  2 15:06:23 2026 GMT
  cert_issuer: (probed)
- host: api.portone.io
  https: true
  tls_version: TLSv1.3
  http_status: 404
  cert_expires: Nov 29 23:59:59 2026 GMT
  cert_issuer: 'C=US, O=Amazon, CN=Amazon RSA 2048 M04'
  notes: V2 API host; served behind AWS. Root path returns 404 (no unauthenticated index).
- host: developers.portone.io
  https: true
  tls_version: TLSv1.3
  http_status: 200
  cert_expires: Sep 24 18:31:39 2026 GMT
- host: api.iamport.kr
  https: true
  tls_version: TLSv1.3
  http_status: 301
  cert_expires: Jan 18 23:59:59 2027 GMT
  notes: Legacy V1 (Iamport) API host, still live.
domains:
- domain: portone.io
  dnssec: false
  caa: []
  spf: true
  spf_record: 'v=spf1 include:_spf.google.com include:mail.stibee.com include:_spf.salesforce.com include:_spf.getresponse.com include:243569856.spf05.hubspotemail.net ~all'
  dmarc: true
  dmarc_policy: none
  dmarc_rua: 'mailto:infra+dmarc@portone.io'
notes: >-
  All apis.yml and OpenAPI hosts serve over HTTPS with TLS 1.3. The V2 API host
  api.portone.io presents an Amazon-issued certificate (AWS-fronted). A
  .well-known/security.txt was not found on portone.io (HTTP 404) at probe time.
  DMARC is published with policy p=none (monitoring). No CAA records were returned
  for portone.io. The legacy api.iamport.kr host remains live for V1 integrations.