{"uid":"cap_xSgesDZDx0gtU14Kf0Dbk","slug":"certificate-transparency-subdomain-lookup-crt-sh-4b30d7f0","name":"Certificate Transparency Subdomain Lookup (crt.sh)","description":"Certificate transparency subdomains (crt.sh). ?domain=example.com","url":"https://pyfile-agent.taile3ff35.ts.net/data/ct","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","properties":{"domain":{"type":"string"}}}}},"output":{"type":"object"}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.003","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.003/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.003","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.003","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_et612vbizXvKkvW1UK4R8","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.003","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Queries certificate transparency logs via crt.sh to enumerate subdomains registered for a given domain","exampleAgentPrompt":"What subdomains are registered for example.com according to certificate transparency logs?","exampleUseCases":[{"title":"Security recon on target domain","prompt":"I'm doing a security assessment — can you pull all the subdomains you can find for acmecorp.com from certificate transparency logs?"},{"title":"Discovering forgotten dev or staging hosts","prompt":"Check certificate transparency records for mycompany.com and tell me if there are any staging, dev, or internal subdomains showing up that we may have forgotten about."},{"title":"Competitive OSINT research","prompt":"I want to map out the infrastructure of competitor.io — can you enumerate their subdomains using certificate transparency data from crt.sh?"}],"resultDescription":"A list of subdomains and related hostnames discovered in certificate transparency logs for the queried domain, sourced from crt.sh aggregated CT log data. May include wildcards, expired certificates, and historically issued hostnames.","failureModes":["Domain not found or no CT records — returns empty result","Invalid domain format — may return error or empty response","Rate limiting by upstream crt.sh — may result in timeout or error","Very large domains (e.g. google.com) may return extremely large or truncated result sets","Network timeout if crt.sh is slow to respond"],"whenToPreferThis":"Use this endpoint when you need passive subdomain enumeration without active scanning — it relies purely on public certificate transparency logs and leaves no footprint on the target. Prefer this over DNS brute-forcing when stealth or speed matters, or when you want historical subdomain data from issued certificates.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-14T06:41:24.403Z","isFirstParty":false}