{"uid":"cap_7M3T-YWeOepTGNKl-7GTj","slug":"sitecheck-subdomain-enumeration-645fea22","name":"SiteCheck Subdomain Enumeration","description":"Subdomains of a domain seen in certificate transparency logs: each name with the first and last certificate dates, the issuer of the newest certificate, and wildcard entries flagged. Deduplicated, newest first, up to 500. CertSpotter is read first, but its free index is partial, so those answers are marked truncated with the reason; crt.sh is the fallback and is complete. Only public certificates are listed.","url":"https://api.sitecheck-api.workers.dev/api/subdomains?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["domain"],"properties":{"domain":{"type":"string","description":"A registered domain like example.com"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":{"type":"json","example":{"note":null,"count":42,"total":42,"domain":"github.com","source":"CertSpotter (certificate transparency), 5 pages of 100 issuances","checkedAt":"2026-10-15T14:20:11.463Z","truncated":true,"subdomains":[{"name":"livesend.github.com","issuer":null,"lastSeen":"2026-10-15T05:34:03Z","wildcard":false,"firstSeen":"2026-08-14T05:47:26Z","lastExpires":"2027-01-13T05:34:02Z"},{"name":"github.com","issuer":null,"lastSeen":"2026-10-14T00:00:00Z","wildcard":true,"firstSeen":"2026-08-02T23:38:02Z","lastExpires":"2027-01-11T23:59:59Z"},{"name":"www.github.com","issuer":null,"lastSeen":"2026-10-14T00:00:00Z","wildcard":false,"firstSeen":"2026-08-04T00:00:00Z","lastExpires":"2027-01-11T23:59:59Z"}],"truncatedReason":"CertSpotter's free index lists only part of the certificates (github.com: 42 names there, 118 on crt.sh on 15 Oct); crt.sh is the full search"}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.002","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.002/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_lqKkvdA7V-DyJog1ydzSs","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.002","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Discovers subdomains for a given domain using certificate transparency logs (CertSpotter)","exampleAgentPrompt":"Can you find all the subdomains for stripe.com using certificate transparency logs?","exampleUseCases":[{"title":"Security attack surface mapping","prompt":"List all the subdomains you can find for acmecorp.com — I'm doing a security audit and want to know the full attack surface before we start the pentest."},{"title":"Competitor infrastructure research","prompt":"What subdomains does shopify.com have? I want to understand how they structure their web infrastructure and what services they expose publicly."},{"title":"Pre-acquisition domain audit","prompt":"We're considering acquiring a company and I need to see all the subdomains registered under their domain targetcompany.com — can you pull that from certificate transparency records?"}],"resultDescription":"Returns a list of subdomains discovered via CertSpotter certificate transparency logs, including each subdomain's name, first seen date, last seen date, certificate expiry, wildcard flag, and issuer. Also includes total count, whether results were truncated, and the source description. Truncation occurs when CertSpotter's free index doesn't cover all certificates.","failureModes":["Missing or invalid 'domain' query parameter returns an error","Domain with no certificate transparency records returns empty subdomain list","Results may be truncated for popular domains with many certificates (truncated=true flag set)","CertSpotter free index may undercount compared to crt.sh for high-volume domains","Network timeout if CertSpotter upstream is slow"],"whenToPreferThis":"Use this endpoint when you need fast subdomain discovery via certificate transparency logs without running active DNS scans. Best for security reconnaissance, infrastructure auditing, or competitive research when you only have a domain name and want passive enumeration. Prefer crt.sh directly if you need a fully comprehensive (non-truncated) dataset for popular domains.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-20T12:48:03.277Z","isFirstParty":false,"canonicalSlug":"sitecheck-subdomain-enumeration-645fea22"}