# AgentsToolsHub Certificate Transparency Subdomain Enumeration

> AgentsToolsHub Certificate Transparency Subdomain Enumeration is a paid API for AI agents from agentstoolshub.com, paid per call via x402, $0.02/call, status unknown (last checked 2026-10-20).

Enumerates all subdomains for a given domain by querying public Certificate Transparency logs via crt.sh, returning deduplicated subdomain names disclosed in TLS certificates.

## Facts

- Endpoint: GET https://agentstoolshub.com/api/v1/security/cert-transparency?utm_source=zero.xyz
- Price: $0.02/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-20
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/agentstoolshub-certificate-transparency-subdomain-enumeration-29318cd9
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_JrYQ6riUeBghW0uCBlcZF

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability agentstoolshub-certificate-transparency-subdomain-enumeration-29318cd9
```

Example prompt: Can you enumerate all subdomains disclosed in Certificate Transparency logs for example.com — I want to see every host they've ever issued a TLS cert for, deduplicated, up to 200 results?

## When to prefer this

Use this endpoint when you need passive subdomain discovery that requires no direct contact with the target — ideal for security research, bug bounties, penetration test scoping, and infrastructure audits. Prefer this over active DNS brute-forcing when stealth or non-intrusive recon is required. Best when the goal is to find historically issued certificates including expired ones, revealing hosts that may no longer be in active DNS but were once exposed.

## Known failure modes

- Domain not found or no CT records exist — returns empty list
- Invalid domain format — returns validation error
- crt.sh upstream unavailable — may return timeout or upstream error
- Rate limiting if too many calls in rapid succession
- Wildcard certificate entries (*.example.com) may appear in results requiring filtering

## How this service works

Enumerate a domain's subdomains from public Certificate Transparency logs via crt.sh — every TLS certificate ever issued for the domain or its subdomains, deduplicated. The passive-recon standard: reveals staging hosts, admin panels and internal naming without touching the target. Use this when an agent needs to subdomains disclosed by public CT logs (crt.sh).

## Output

A deduplicated list of subdomain names for the queried domain, sourced from every TLS certificate ever issued and recorded in public Certificate Transparency logs. Results include hostnames like staging.example.com, admin.example.com, etc. Optionally limited by the 'limit' parameter.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "domain"
     ],
     "properties": {
      "limit": {
       "type": "number",
       "description": "Max results"
      },
      "domain": {
       "type": "string",
       "description": "Domain"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/agentstoolshub-certificate-transparency-subdomain-enumeration-29318cd9/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from agentstoolshub.com](https://www.zero.xyz/host/agentstoolshub.com/llms.txt)