# 2s CT Logs — Certificate Transparency Lookup

> 2s CT Logs — Certificate Transparency Lookup is a paid API for AI agents from 2s.io, paid per call via x402, $0.00216/call, status unknown (last checked 2026-09-15).

Enumerates SSL/TLS certificates and subdomains for a given domain via Certificate Transparency logs

## Facts

- Endpoint: GET https://2s.io/api/domain/ct-logs
- Price: $0.00216/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/2s-ct-logs-certificate-transparency-lookup-463548c9
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_Kmo5RZ3pfjgXl3NByZxiB

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability 2s-ct-logs-certificate-transparency-lookup-463548c9
```

Example prompt: Pull all Certificate Transparency log records for stripe.com and list every subdomain and certificate issuer you find — return up to 200 certs.

## When to prefer this

Use this endpoint when you need to discover subdomains or audit SSL/TLS certificates for a domain using public Certificate Transparency log data, without needing an API key or account. Ideal for OSINT, security reconnaissance, unauthorized certificate detection, or subdomain enumeration. Prefer this over Shodan or similar tools when the specific goal is certificate-based subdomain discovery rather than port/service scanning.

## Known failure modes

- Domain not found in CT logs — returns empty items array with total:0
- Invalid domain format — likely returns a 400 or validation error
- Limit parameter out of range (must be 1–500) — may return error or clamp to default
- Rate limiting from upstream certSpotter free tier — may return partial results or error
- Network timeout from upstream CT log provider

## How this service works

Certificate Transparency recon for a domain — discover its subdomains and issued certificates from public CT logs (passive attack-surface mapping). Pass domain. Returns the deduplicated set of subdomains seen across all certs (subdomains + subdomainCount), and the certificates (issuer, validity window, SAN dns names), most recent first. Sourced from SSLMate certSpotter (primary) with a crt.sh fallback — keyless. Live CT-log data over a huge append-only dataset an LLM cannot enumerate. For external attack-surface discovery, shadow-IT/subdomain inventory, and certificate monitoring. Note: CT shows names that ever appeared in a cert, not necessarily live hosts.

## Output

Returns a JSON object containing an array of certificate records per domain, each with issuer, DNS names, validity window (notBefore/notAfter), a deduplicated list of discovered subdomains, subdomain count, cert count, and a truncated flag if the result was capped. Also includes source provenance (provider, license, URL).

## Example request

```json
{
 "input": {
  "type": "http",
  "method": "GET",
  "queryParams": {
   "limit": 50,
   "domain": "example.com"
  }
 }
}
```

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method",
    "queryParams"
   ],
   "properties": {
    "type": {
     "const": "http"
    },
    "method": {
     "const": "GET"
    },
    "queryParams": {
     "required": [
      "domain"
     ],
     "properties": {
      "limit": {
       "type": "integer",
       "description": "Max certs returned (1-500, default 100)."
      },
      "domain": {
       "type": "string",
       "description": "Domain to enumerate (e.g. example.com)."
      }
     }
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/2s-ct-logs-certificate-transparency-lookup-463548c9/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from 2s.io](https://www.zero.xyz/host/2s.io/llms.txt)