{"uid":"cap_B5l9Z8vu3797HBPcFVwOu","slug":"ct-subdomain-enumeration-2e9a72cd","name":"CT Subdomain Enumeration","description":"Public data and utility APIs paid per call in USDC on Base (x402). No accounts, no API keys. 174 routes: crypto/equity data, onchain reads, DNS/email/security intel, geo/weather, x402 payment diagnostics, dev utilities and more.","url":"https://anibalb.duckdns.org/x402/ct-subdomain-enum?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET","HEAD","DELETE"],"type":"string"},"queryParams":{"type":"object","properties":{}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":{"type":"json","example":{"domain":"example.com","subdomains":[{"name":"www.example.com","issuer":"Let's Encrypt"}]}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.002","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.002/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_EQbu-p6151_awoXTgrEEe","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.002","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Enumerates subdomains for a given domain by querying Certificate Transparency logs, returning discovered subdomains along with their TLS certificate issuers.","exampleAgentPrompt":"Can you enumerate all the subdomains for example.com using certificate transparency logs and show me each subdomain along with which certificate authority issued their TLS cert?","exampleUseCases":[{"title":"Attack surface mapping for security audit","prompt":"I'm doing a security assessment on acmecorp.com — can you pull all discovered subdomains from certificate transparency logs so I can map out their full attack surface?"},{"title":"Competitive domain intelligence gathering","prompt":"I want to see what subdomains competitor.com has exposed publicly — can you enumerate them via CT logs and list the certificate issuers?"},{"title":"Monitoring for unexpected subdomains","prompt":"Can you check what subdomains are registered under mybrand.com in the certificate transparency logs? I want to make sure there are no unexpected or unauthorized subdomains showing up."}],"resultDescription":"Returns a JSON object containing the queried domain and an array of discovered subdomains, each with the subdomain's full hostname and the name of the TLS certificate issuer (e.g. Let's Encrypt, DigiCert) that issued a certificate for it.","failureModes":["Domain not found in CT logs returns empty subdomains array","Invalid domain format may return an error or empty result","CT log data may be incomplete or delayed for very new domains","Rate limiting or payment failure returns 402 Payment Required","Wildcard certificates may obscure individual subdomains"],"whenToPreferThis":"Choose this endpoint when you need passive, non-intrusive subdomain discovery based on Certificate Transparency log data — it requires no active scanning of the target domain and is suitable for recon, security audits, or attack surface mapping. Prefer this over active DNS brute-force tools when stealth or read-only access is required, and when you want to find subdomains that have had TLS certificates issued rather than guessing names.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-31T18:41:57.563Z","isFirstParty":false,"canonicalSlug":"ct-subdomain-enumeration-2e9a72cd"}