{"uid":"cap_JrYQ6riUeBghW0uCBlcZF","slug":"agentstoolshub-certificate-transparency-subdomain-enumeration-29318cd9","name":"AgentsToolsHub Certificate Transparency Subdomain Enumeration","description":"Enumerate a domain's subdomains from public Certificate Transparency logs via crt.sh — every TLS certificate ever issued for the domain or its subdomains, deduplicated. The passive-recon standard: reveals staging hosts, admin panels and internal naming without touching the target. Use this when an agent needs to subdomains disclosed by public CT logs (crt.sh).","url":"https://agentstoolshub.com/api/v1/security/cert-transparency?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["domain"],"properties":{"limit":{"type":"number","description":"Max results"},"domain":{"type":"string","description":"Domain"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.02","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.02/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.02","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.02","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_ceETSCyoI3B1kZf8eIRjS","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.02","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Enumerates all subdomains for a given domain by querying public Certificate Transparency logs via crt.sh, returning deduplicated subdomain names disclosed in TLS certificates.","exampleAgentPrompt":"Can you enumerate all subdomains disclosed in Certificate Transparency logs for example.com — I want to see every host they've ever issued a TLS cert for, deduplicated, up to 200 results?","exampleUseCases":[{"title":"Bug bounty passive recon on target","prompt":"I'm doing a bug bounty on acmecorp.com — can you pull all subdomains that show up in Certificate Transparency logs so I can find staging, dev, or admin panels without sending any traffic to their servers?"},{"title":"Security audit of own infrastructure","prompt":"I need to audit what subdomains of mycompany.com have been publicly disclosed through TLS certificates — check Certificate Transparency logs and give me the full deduplicated list so I can see if anything is exposed that shouldn't be."},{"title":"Competitive intelligence on exposed hosts","prompt":"Can you look up all subdomains that competitor.io has ever issued SSL certificates for using Certificate Transparency logs? I want to see if they have any staging or internal environments visible publicly."}],"resultDescription":"A deduplicated list of subdomain names for the queried domain, sourced from every TLS certificate ever issued and recorded in public Certificate Transparency logs. Results include hostnames like staging.example.com, admin.example.com, etc. Optionally limited by the 'limit' parameter.","failureModes":["Domain not found or no CT records exist — returns empty list","Invalid domain format — returns validation error","crt.sh upstream unavailable — may return timeout or upstream error","Rate limiting if too many calls in rapid succession","Wildcard certificate entries (*.example.com) may appear in results requiring filtering"],"whenToPreferThis":"Use this endpoint when you need passive subdomain discovery that requires no direct contact with the target — ideal for security research, bug bounties, penetration test scoping, and infrastructure audits. Prefer this over active DNS brute-forcing when stealth or non-intrusive recon is required. Best when the goal is to find historically issued certificates including expired ones, revealing hosts that may no longer be in active DNS but were once exposed.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-20T12:37:16.894Z","isFirstParty":false,"canonicalSlug":"agentstoolshub-certificate-transparency-subdomain-enumeration-29318cd9"}