# NetIntel Certificate Transparency Lookup

> NetIntel Certificate Transparency Lookup is a paid API for AI agents from netintel.dev, paid per call via x402, $0.01/call, status unknown (last checked 2026-10-09).

Queries certificate transparency logs for a domain to return all issued SSL/TLS certificates, subdomains, issuers, expiry info, and a security grade.

## Facts

- Endpoint: GET https://netintel.dev/cert-transparency/lookup?utm_source=zero.xyz
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-09
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/netintel-certificate-transparency-lookup-56a34b86
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_ocBUa_yXu2H_rerQLScED

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability netintel-certificate-transparency-lookup-56a34b86
```

Example prompt: Pull all certificate transparency log entries for example.com, including subdomains, and tell me the security grade, any certificates expiring within 30 days, and which certificate authorities have issued certs for that domain.

## When to prefer this

Use this endpoint when you need to audit the full certificate history of a domain, discover subdomains via CT logs, check for unauthorized certificate issuance, or assess certificate hygiene (expiry, wildcard usage, issuer diversity). Prefer this over DNS-based enumeration when you want certificate-level detail including issuers and validity windows.

## Known failure modes

- Missing or invalid 'domain' query parameter returns a 400 error
- Domain with no CT log entries returns empty certs array and zero counts
- Rate limiting or payment failure returns 402 Payment Required
- Limit exceeding max of 500 is clamped or returns a validation error
- Unreachable CT log upstream may cause timeout or 503

## How this service works

Query the crt.sh certificate transparency log database to enumerate all SSL certificates ever issued for a domain — returns subdomains discovered, certificate issuers, validity periods, and a risk score flagging wildcard certs, expiring certs, and suspicious issuance patterns.

## Output

Returns a list of certificates (with SANs, issuer, validity dates, wildcard status, days until expiry), an aggregate security grade (letter) and score (0-100), list of unique subdomains, list of CAs that have issued certs, recently issued certs, certs expiring within 30 days, and total cert count found.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "domain"
     ],
     "properties": {
      "limit": {
       "type": "number",
       "description": "Maximum number of certificates to return (default: 100, max: 500)"
      },
      "domain": {
       "type": "string",
       "description": "Domain name to query certificate transparency logs for (e.g. example.com)"
      },
      "include_subdomains": {
       "type": "boolean",
       "description": "Whether to include subdomain certificates (default: true)"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object",
     "properties": {
      "certs": {
       "type": "array"
      },
      "grade": {
       "type": "string"
      },
      "score": {
       "type": "number"
      },
      "domain": {
       "type": "string"
      },
      "issuers": {
       "type": "array"
      },
      "findings": {
       "type": "array"
      },
      "wildcard_certs": {
       "type": "array"
      },
      "recently_issued": {
       "type": "array"
      },
      "total_certs_found": {
       "type": "number"
      },
      "unique_subdomains": {
       "type": "array"
      },
      "unique_subdomain_count": {
       "type": "number"
      },
      "expiring_within_30_days": {
       "type": "array"
      }
     }
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "certs": [
   {
    "id": 12345678,
    "sans": [
     "example.com",
     "www.example.com"
    ],
    "issuer": "Let's Encrypt",
    "not_after": "2024-04-01T00:00:00Z",
    "is_expired": false,
    "not_before": "2024-01-01T00:00:00Z",
    "common_name": "example.com",
    "is_wildcard": false,
    "days_until_expiry": 90
   }
  ],
  "grade": "A",
  "score": 100,
  "domain": "example.com",
  "issuers": [
   "Let's Encrypt"
  ],
  "findings": [],
  "wildcard_certs": [],
  "recently_issued": [],
  "total_certs_found": 47,
  "unique_subdomains": [
   "www.example.com",
   "mail.example.com"
  ],
  "unique_subdomain_count": 2,
  "expiring_within_30_days": []
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/netintel-certificate-transparency-lookup-56a34b86/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from netintel.dev](https://www.zero.xyz/host/netintel.dev/llms.txt)