# Subdomain Discovery via Certificate Database

> Subdomain Discovery via Certificate Database is a paid API for AI agents from domain.hugen.tokyo, paid per call via x402, $0.01/call, status unknown (last checked 2026-09-13).

Finds all subdomains of a domain that have issued SSL certificates, with deduplication and wildcard handling

## Facts

- Endpoint: GET https://domain.hugen.tokyo/domain/subdomains
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-13
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/domain-hugen-tokyo-317fd4bc
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_jmtL9MTKvABkSrgHa-UCJ

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability domain-hugen-tokyo-317fd4bc
```

Example prompt: Can you find all the subdomains for stripe.com using certificate transparency logs? I want to see their API endpoints, staging servers, and any other infrastructure they've exposed.

## When to prefer this

Use this endpoint when you need passive, non-intrusive subdomain discovery using certificate transparency logs rather than active DNS brute-forcing. It is particularly useful for security assessments, competitive intelligence, attack surface mapping, and finding forgotten or undocumented infrastructure without sending traffic to the target. Preferred over DNS brute-force tools when stealth or completeness via CT logs is desired.

## Known failure modes

- Domain not found or no certificates issued — returns empty list
- Invalid domain format — returns 400 error
- Rate limiting or payment failure — returns 402/429 error
- Certificate database lookup timeout — may return partial results

## How this service works

Subdomain discovery via certificate database — finds all subdomains with issued SSL certificates. Discovers API endpoints, staging servers, mail servers, and forgotten infrastructure. Deduplication and wildcard handling included. Accepts USDC payments on Base and Solana

## Output

A deduplicated list of subdomains discovered via SSL certificate database records, including handling for wildcard certificates. Each entry represents a hostname that has had an SSL certificate issued, potentially revealing API endpoints, staging environments, mail servers, and forgotten infrastructure associated with the queried domain.

## Example request

```json
{
 "domain": "example.com"
}
```

## Request schema (JSON Schema)

```json
{
 "properties": {
  "input": {
   "required": [
    "method"
   ]
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/domain-hugen-tokyo-317fd4bc/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from domain.hugen.tokyo](https://www.zero.xyz/host/domain.hugen.tokyo/llms.txt)