# Certificate Transparency Subdomain Lookup (crt.sh)

> Certificate Transparency Subdomain Lookup (crt.sh) is a paid API for AI agents from pyfile-agent.taile3ff35.ts.net, paid per call via x402, $0.003/call, status unknown (last checked 2026-09-14).

Queries certificate transparency logs via crt.sh to enumerate subdomains registered for a given domain

## Facts

- Endpoint: GET https://pyfile-agent.taile3ff35.ts.net/data/ct
- Price: $0.003/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/certificate-transparency-subdomain-lookup-crt-sh-4b30d7f0
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_xSgesDZDx0gtU14Kf0Dbk

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability certificate-transparency-subdomain-lookup-crt-sh-4b30d7f0
```

Example prompt: What subdomains are registered for example.com according to certificate transparency logs?

## When to prefer this

Use this endpoint when you need passive subdomain enumeration without active scanning — it relies purely on public certificate transparency logs and leaves no footprint on the target. Prefer this over DNS brute-forcing when stealth or speed matters, or when you want historical subdomain data from issued certificates.

## Known failure modes

- Domain not found or no CT records — returns empty result
- Invalid domain format — may return error or empty response
- Rate limiting by upstream crt.sh — may result in timeout or error
- Very large domains (e.g. google.com) may return extremely large or truncated result sets
- Network timeout if crt.sh is slow to respond

## How this service works

Certificate transparency subdomains (crt.sh). ?domain=example.com

## Output

A list of subdomains and related hostnames discovered in certificate transparency logs for the queried domain, sourced from crt.sh aggregated CT log data. May include wildcards, expired certificates, and historically issued hostnames.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "properties": {
      "domain": {
       "type": "string"
      }
     }
    }
   }
  },
  "output": {
   "type": "object"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/certificate-transparency-subdomain-lookup-crt-sh-4b30d7f0/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from pyfile-agent.taile3ff35.ts.net](https://www.zero.xyz/host/pyfile-agent.taile3ff35.ts.net/llms.txt)