# Certificate SANs Bulk Lookup

> Certificate SANs Bulk Lookup is a paid API for AI agents from intel.rallylive.ca, paid per call via x402, $0.1/call, status unknown (last checked 2026-09-14).

Fetches Subject Alternative Names (SANs) from the newest TLS certificate for up to 20 domains concurrently in a single call, using certificate transparency logs.

## Facts

- Endpoint: GET https://intel.rallylive.ca/bulk/monitor/cert-chain-sans
- Price: $0.1/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/certificate-sans-bulk-lookup-6624d396
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_ESMb6g6DkKAbAqK9IKtAN

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability certificate-sans-bulk-lookup-6624d396
```

Example prompt: Look up the Subject Alternative Names from the latest TLS certificates for these domains using certificate transparency logs: example.com, acme.org, testsite.io — I need all the SANs per domain and want to know if any lookups failed.

## When to prefer this

Use this endpoint when you have a list of 2–20 domains and need their TLS certificate SANs in a single efficient call rather than making sequential single-domain requests. It is ideal for security audits, attack surface mapping, subdomain enumeration, and bulk domain intelligence pipelines where concurrency and ordered results with per-item error handling matter.

## Known failure modes

- Domain not found in certificate transparency logs — per-item error field populated
- Invalid or malformed domain name — per-item error returned
- More than 20 domains submitted — request rejected
- Network timeout reaching certificate transparency log sources
- All items fail — full failure count returned with empty SAN lists

## How this service works

Bulk certificate sans: up to 20 domains in one call, processed concurrently, results returned in input order with a per-item error field and a count of failures. Same answer per item as the single /monitor/cert-chain-sans endpoint (Subject Alternative Names of the newest certificate for a domain from certificate-transparency logs). Batch enrichment for agents that hold a list. $0.01 per batch.

## Output

Returns an ordered array matching the input domain list, where each item contains the Subject Alternative Names extracted from the newest TLS certificate found in certificate transparency logs for that domain, plus a per-item error field if the lookup failed. A top-level failure count is also included.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "properties": {}
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/certificate-sans-bulk-lookup-6624d396/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from intel.rallylive.ca](https://www.zero.xyz/host/intel.rallylive.ca/llms.txt)