# Datakoot Domain Intel – Subdomain Discovery via Certificate Transparency

> Datakoot Domain Intel – Subdomain Discovery via Certificate Transparency is a paid API for AI agents from x402.datakoot.com, paid per call via x402, $0.01/call, status unknown (last checked 2026-10-10).

Discovers all publicly visible subdomains of a given domain by querying Certificate Transparency logs (crt.sh and Cert Spotter in parallel), returning results from whichever source responds first.

## Facts

- Endpoint: POST https://x402.datakoot.com/mcp?utm_source=zero.xyz
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-10
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/datakoot-domain-intel-subdomain-discovery-via-certificate-transparency-fdb9f27a
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_Y7zQmDmdgsReTBxiCeOwD

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability datakoot-domain-intel-subdomain-discovery-via-certificate-transparency-fdb9f27a -d '<json body>'
```

Example prompt: What are all the public subdomains of stripe.com? Use Certificate Transparency logs to find things like api., app., staging., and any others that have been registered.

## When to prefer this

Choose this endpoint when you need fast, passive subdomain enumeration using Certificate Transparency logs without sending any traffic to the target domain. It is ideal for security research, attack surface mapping, and competitive intelligence. Prefer it over active DNS brute-force tools when stealth or read-only data collection is required, and over manual crt.sh queries when you want parallelized multi-source lookups with a simple API interface.

## Known failure modes

- Domain not found in CT logs — returns empty list if no certificates have been issued
- Upstream CT log sources (crt.sh / Cert Spotter) are unavailable — may timeout or return error
- Invalid domain format — malformed domain input causes request failure
- Rate limiting from upstream CT log providers — may cause delayed or failed responses
- No charge on failure — $0.002 USDC only debited on successful responses

## How this service works

Datakoot Koot: One call checks a domain: registration and DNS, email security (SPF/DKIM/DMARC), tech stack, and subdomains from certificate logs.. $0.01 USDC per brief, charged only on success.

## Output

A list of publicly discovered subdomains for the queried domain, sourced from Certificate Transparency log records (crt.sh and/or Cert Spotter), returned from whichever source responds first. Includes subdomain names such as api., app., staging., admin., and others that have had TLS certificates issued.

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/datakoot-domain-intel-subdomain-discovery-via-certificate-transparency-fdb9f27a/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from x402.datakoot.com](https://www.zero.xyz/host/x402.datakoot.com/llms.txt)