{"uid":"cap_1K74hp-uBELt0eTTKoXhW","slug":"sitecheck-web-intel-certificate-transparency-subdomain-lookup-fefa2293","name":"SiteCheck Web Intel – Certificate Transparency Subdomain Lookup","description":"Subdomain names found in public Certificate Transparency logs for a domain (via CertSpotter): unique host names and wildcard names, issuers, latest issue date and how many listed certificates are still valid. Returns the first page only (up to 100 certificates) and lists at most 100 names; wildcard names are shown as *.domain.","url":"https://api.webintel-api.workers.dev/api/security/crtsh-transparency?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["domain"],"properties":{"domain":{"type":"string","description":"Domain name such as wikipedia.org (required)"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.002","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.002/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_ZY7YgarVFWUGzxqomfc-f","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.002","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Returns subdomain names, wildcard entries, certificate issuers, latest issuance dates, and valid-certificate counts found in Certificate Transparency logs for a given domain via CertSpotter","exampleAgentPrompt":"Can you look up all the subdomains and certificate transparency records for stripe.com — I want to see the hostnames, any wildcard certs, who issued them, and which ones are still valid?","exampleUseCases":[{"title":"Subdomain attack surface audit","prompt":"Pull all the subdomains showing up in Certificate Transparency logs for acmecorp.com so I can see our full external attack surface — include wildcard names, issuers, and how many certs are still active."},{"title":"Competitor infrastructure reconnaissance","prompt":"Use CT log data to enumerate all publicly known subdomains for shopify.com — I want to understand the scope of their infrastructure from certificate transparency records."},{"title":"Detecting unauthorized certificate issuance","prompt":"Check certificate transparency records for mybrand.com and tell me which certificate authorities have issued certs for it and when the latest one was issued — I want to know if any unexpected CA signed a cert for us."}],"resultDescription":"A list of up to 100 unique hostnames (including wildcard entries like *.domain.com) discovered in Certificate Transparency logs for the queried domain, along with the certificate issuer names, the most recent certificate issuance date per entry, and a count of how many of the listed certificates are currently valid. Only the first page (up to 100 certificates) is returned.","failureModes":["Missing or invalid 'domain' query parameter returns an error","Domain not found in CT logs returns an empty result set","CertSpotter upstream API unavailable causes timeout or 5xx response","Domains with very large CT log histories are truncated to the first 100 entries with no pagination","Malformed domain strings may return unexpected results or errors"],"whenToPreferThis":"Choose this endpoint when you need passive, non-intrusive subdomain discovery based on public Certificate Transparency log data — no active scanning, no DNS brute-forcing. It is ideal for security reconnaissance, attack surface mapping, and certificate auditing tasks where stealth and legality matter. Prefer this over active DNS enumeration tools when you need a quick, read-only view of what CAs have publicly disclosed about a domain's certificates.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-24T12:44:44.611Z","isFirstParty":false,"canonicalSlug":"sitecheck-web-intel-certificate-transparency-subdomain-lookup-fefa2293"}