{"uid":"cap_Y3hqrFuu0wZteUltiQbwF","slug":"dns-subdomain-enumeration-via-certificate-transparency-65a631c1","name":"DNS Subdomain Enumeration via Certificate Transparency","description":"Discover subdomains for a domain via Certificate Transparency logs (crt.sh); returns a de-duplicated, sorted list.","url":"https://dns-intel-api-production.up.railway.app/dns/subdomains","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"limit":{"type":"integer","maximum":1000,"minimum":1,"description":"Maximum number of subdomains to return. Defaults to 200."},"domain":{"type":"string","description":"Apex domain to enumerate subdomains for via Certificate Transparency logs, e.g. 'example.com'."}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.002","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.002/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm__fsqW_T5ruVW1K77BV6JY","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.002","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Discovers all known subdomains for an apex domain by querying Certificate Transparency logs (crt.sh), returning a de-duplicated, sorted list of up to 1000 results.","exampleAgentPrompt":"Can you enumerate all known subdomains for stripe.com using certificate transparency logs? Return up to 500 results.","exampleUseCases":[{"title":"Security audit of company attack surface","prompt":"I need to map the full subdomain footprint of acmecorp.com for a security assessment — can you pull all known subdomains from certificate transparency logs, up to 1000?"},{"title":"Competitor infrastructure research","prompt":"What subdomains does shopify.com have exposed in certificate transparency logs? Give me up to 300 results so I can understand their infrastructure layout."},{"title":"Pre-pentest passive recon","prompt":"Before I start a penetration test on targetdomain.com, can you do passive subdomain discovery using CT logs and return everything you find, up to 500 subdomains?"}],"resultDescription":"A de-duplicated, sorted list of subdomain strings discovered from Certificate Transparency log entries for the requested apex domain, capped at the requested limit (default 200, max 1000).","failureModes":["Invalid or non-existent domain returns empty list or error","crt.sh upstream unavailability causes timeout or 502","Limit parameter out of range (below 1 or above 1000) returns validation error","Very new domains with no CT log entries return empty results","Rate limiting from crt.sh may cause partial results or failure"],"whenToPreferThis":"Use this endpoint when you need passive, non-intrusive subdomain discovery without sending traffic directly to the target — ideal for reconnaissance, attack surface mapping, or security audits. Prefer it over active DNS brute-forcing when stealth matters or when you want a quick snapshot of publicly issued certificates. It complements sibling endpoints (WHOIS, DNS resolution, TLS cert details) for comprehensive domain intelligence.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-14T00:33:53.711Z","isFirstParty":false}