{"uid":"cap_jmtL9MTKvABkSrgHa-UCJ","slug":"domain-hugen-tokyo-317fd4bc","name":"Subdomain Discovery via Certificate Database","description":"Subdomain discovery via certificate database — finds all subdomains with issued SSL certificates. Discovers API endpoints, staging servers, mail servers, and forgotten infrastructure. Deduplication and wildcard handling included. Accepts USDC payments on Base and Solana","url":"https://domain.hugen.tokyo/domain/subdomains","method":"GET","headers":{},"bodySchema":{"properties":{"input":{"required":["method"]}}},"responseSchema":null,"example":{"request":{"domain":"example.com"},"response":{"domain":"example.com","source":"crt.sh (Certificate Transparency)","subdomains":["dev.example.com","example.com","m.example.com","products.example.com","support.example.com","www.example.com"],"subdomain_count":6}},"exampleRequest":{"domain":"example.com"},"tags":["x402"],"displayCostAmount":"0.01","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"settled","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.01/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_0kcEhvmOE3ZB0CeiMXPF5","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.01","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Finds all subdomains of a domain that have issued SSL certificates, with deduplication and wildcard handling","exampleAgentPrompt":"Can you find all the subdomains for stripe.com using certificate transparency logs? I want to see their API endpoints, staging servers, and any other infrastructure they've exposed.","exampleUseCases":null,"resultDescription":"A deduplicated list of subdomains discovered via SSL certificate database records, including handling for wildcard certificates. Each entry represents a hostname that has had an SSL certificate issued, potentially revealing API endpoints, staging environments, mail servers, and forgotten infrastructure associated with the queried domain.","failureModes":["Domain not found or no certificates issued — returns empty list","Invalid domain format — returns 400 error","Rate limiting or payment failure — returns 402/429 error","Certificate database lookup timeout — may return partial results"],"whenToPreferThis":"Use this endpoint when you need passive, non-intrusive subdomain discovery using certificate transparency logs rather than active DNS brute-forcing. It is particularly useful for security assessments, competitive intelligence, attack surface mapping, and finding forgotten or undocumented infrastructure without sending traffic to the target. Preferred over DNS brute-force tools when stealth or completeness via CT logs is desired.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-13T12:32:28.298Z","isFirstParty":false}