# Certificate Transparency Log Search (crt.sh)

> Certificate Transparency Log Search (crt.sh) is a paid API for AI agents from agent402.tools, paid per call via x402, $0.005/call, status unknown (last checked 2026-09-15).

Searches public Certificate Transparency logs via crt.sh to enumerate all SSL/TLS certificates issued for a domain and extract a deduplicated list of subdomains from the SANs.

## Facts

- Endpoint: POST https://agent402.tools/api/cert-transparency
- Price: $0.005/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/certificate-transparency-log-search-crt-sh-c7f96fb5
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_JZb5ePPJZp3R8fdgqkSAf

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability certificate-transparency-log-search-crt-sh-c7f96fb5 -d '<json body>'
```

Example prompt: Search Certificate Transparency logs for all certs issued to example.com — include expired ones and return up to 200 results — I want the full subdomain list extracted from the SANs for a security audit.

## When to prefer this

Use this endpoint when you need fast, passive subdomain enumeration without active scanning. Ideal for security audits, recon phases, or verifying certificate issuance history. Prefer this over DNS brute-forcing or active scanners when stealth or speed matters — CT log data is public and requires no special permissions. Best when you need a quick, free-to-source subdomain surface map of a target domain.

## Known failure modes

- Domain not found in CT logs — returns empty certificate list
- Invalid domain format — returns validation error
- Upstream crt.sh unavailable — returns 502 or timeout
- Limit out of range (outside 1–500) — returns parameter validation error
- Payment failure via x402 — request not processed

## How this service works

Search public Certificate Transparency logs (via crt.sh) for every cert issued to a domain. Returns the cert list plus a deduped subdomain set extracted from the SANs - the fastest way to enumerate subdomains for a security audit. Free upstream, no key required.

## Output

Returns a list of SSL/TLS certificates issued to the queried domain (up to the specified limit) along with a deduplicated set of subdomains extracted from the Subject Alternative Names (SANs) across all matching certificates. Each cert entry includes relevant metadata such as issuance date, expiry, and issuer.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "limit": {
   "type": "integer",
   "description": "Max certs to return (1–500, default 50)"
  },
  "domain": {
   "type": "string",
   "description": "Domain to search (also accepts host/hostname/url/email)"
  },
  "includeExpired": {
   "type": "boolean",
   "description": "Include expired certs (default false)"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "certs": [
   {
    "id": 1234567890,
    "sans": [
     "agent402.tools"
    ],
    "issuer": "C=US, O=Let's Encrypt, CN=E5",
    "serial": "0a:1b:2c",
    "notAfter": "2027-02-14T23:59:59",
    "notBefore": "2026-01-15T00:00:00",
    "commonName": "agent402.tools"
   }
  ],
  "count": 2,
  "domain": "agent402.tools",
  "queriedAt": "2026-06-19T22:00:00.000Z",
  "truncated": false,
  "subdomains": [
   "agent402.tools"
  ]
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/certificate-transparency-log-search-crt-sh-c7f96fb5/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from agent402.tools](https://www.zero.xyz/host/agent402.tools/llms.txt)