{"uid":"cap_ZyralJSXeNm0qGHCgIU3c","slug":"subdomain-finder-via-certificate-transparency-54ab485c","name":"Subdomain Finder via Certificate Transparency","description":"Subdomains of a domain found in public Certificate Transparency logs (crt.sh), with first certificate and current validity date. Use for attack-surface mapping, asset inventory or competitor research.","url":"https://bess-x402.onrender.com/v1/web/subdomains?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET","HEAD","DELETE"],"type":"string"},"queryParams":{"type":"object","required":["domain"],"properties":{"limit":{"type":"integer","description":"Maximum number of results (1-1000)"},"domain":{"type":"string","description":"Domain name"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.003","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.003/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.003","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.003","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_2Zz2CKfIW1Jvm9SfA1RWk","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.003","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Discovers subdomains of a given domain by querying public Certificate Transparency logs (crt.sh), returning first-seen and validity dates.","exampleAgentPrompt":"Can you find all subdomains of stripe.com using Certificate Transparency logs and show me up to 200 results with their first-seen and validity dates?","exampleUseCases":[{"title":"Security attack surface mapping","prompt":"List all subdomains of acme-corp.com that appear in certificate transparency logs — I want up to 500 results so I can map out their full external attack surface."},{"title":"Competitor asset discovery","prompt":"What subdomains does shopify.com have? Pull from certificate transparency logs and give me up to 300, so I can see what services and infrastructure they've exposed publicly."},{"title":"Own domain asset audit","prompt":"Can you enumerate all subdomains of mybusiness.com from CT logs — up to 100 results — so I can audit which of our own assets are publicly visible and check for forgotten or rogue subdomains?"}],"resultDescription":"A list of subdomains discovered for the queried domain from Certificate Transparency logs, each entry including the subdomain name, the date the first certificate was issued, and the certificate's current validity/expiry date. Results are capped by the optional limit parameter (1–1000).","failureModes":["Domain not found in CT logs — returns empty result set","Invalid domain format — likely returns a 400 or validation error","Limit parameter out of range (< 1 or > 1000) — validation error","Upstream crt.sh service unavailable — may return 503 or timeout","Rate limiting or payment failure — returns 402 Payment Required"],"whenToPreferThis":"Choose this endpoint when you need passive, non-intrusive subdomain discovery sourced from public Certificate Transparency logs without sending any traffic to the target. Ideal for OSINT, asset inventory, and security reconnaissance where stealth and historical certificate data matter. Prefer over active DNS brute-force tools when you want a read-only, legally safe approach or need first-seen certificate dates alongside subdomains.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-28T06:43:19.149Z","isFirstParty":false,"canonicalSlug":"subdomain-finder-via-certificate-transparency-54ab485c"}