Subdomains from certificate transparency

Subdomains of a domain found in public certificate-transparency logs (every publicly trusted TLS certificate is logged): each name with whether it is a wildcard, when it was first and last seen in a certificate, when its newest certificate expires, how many certificates name it and their issuers. total counts all names found; certificates the certificates read. Only names with a currently valid certificate by default; include_expired=true adds names whose certificates have all expired (older infrastructure). Domains with very many certificates can take up to a minute. Pages with page / next_page (null on the last page).

Every response includes credits_used: the credits this call cost.

Parameters

Every endpoint also takes fresh, raw, fields (see lean responses and caching).

Example

curl "https://api.api.sh/web/v1/subdomains?domain=stripe.com" \
  -H "x-api-key: $APISH_KEY"

import os, requests

res = requests.get(
    "https://api.api.sh/web/v1/subdomains",
    params={"domain": "stripe.com"},
    headers={"x-api-key": os.environ["APISH_KEY"]},
    timeout=120,
)
res.raise_for_status()
data = res.json()

const url = new URL("https://api.api.sh/web/v1/subdomains");
url.searchParams.set("domain", "stripe.com");

const res = await fetch(url, { headers: { "x-api-key": process.env.APISH_KEY } });
if (!res.ok) throw new Error(`${res.status} ${await res.text()}`);
const data = await res.json();

Response

A JSON object with the fields described above, plus raw (the source's own data), cached, fetched_at and credits_used. Errors return {"success": false, "error": "…"} with the HTTP status (see errors). A lookup that ran but found nothing (404) costs the price above; refused calls and errors on our side are free (what's charged).