# SiteCheck Subdomain Enumeration

> SiteCheck Subdomain Enumeration is a paid API for AI agents from api.sitecheck-api.workers.dev, paid per call via x402, $0.002/call, status unknown (last checked 2026-10-16).

Discovers subdomains for a given domain using certificate transparency logs (CertSpotter)

## Facts

- Endpoint: GET https://api.sitecheck-api.workers.dev/api/subdomains?utm_source=zero.xyz
- Price: $0.002/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-16
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/sitecheck-subdomain-enumeration-645fea22
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_7M3T-YWeOepTGNKl-7GTj

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability sitecheck-subdomain-enumeration-645fea22
```

Example prompt: Can you find all the subdomains for stripe.com using certificate transparency logs?

## When to prefer this

Use this endpoint when you need fast subdomain discovery via certificate transparency logs without running active DNS scans. Best for security reconnaissance, infrastructure auditing, or competitive research when you only have a domain name and want passive enumeration. Prefer crt.sh directly if you need a fully comprehensive (non-truncated) dataset for popular domains.

## Known failure modes

- Missing or invalid 'domain' query parameter returns an error
- Domain with no certificate transparency records returns empty subdomain list
- Results may be truncated for popular domains with many certificates (truncated=true flag set)
- CertSpotter free index may undercount compared to crt.sh for high-volume domains
- Network timeout if CertSpotter upstream is slow

## How this service works

Subdomains of a domain seen in certificate transparency logs: each name with the first and last certificate dates, the issuer of the newest certificate, and wildcard entries flagged. Deduplicated, newest first, up to 500. CertSpotter is read first, but its free index is partial, so those answers are marked truncated with the reason; crt.sh is the fallback and is complete. Only public certificates are listed.

## Output

Returns a list of subdomains discovered via CertSpotter certificate transparency logs, including each subdomain's name, first seen date, last seen date, certificate expiry, wildcard flag, and issuer. Also includes total count, whether results were truncated, and the source description. Truncation occurs when CertSpotter's free index doesn't cover all certificates.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "domain"
     ],
     "properties": {
      "domain": {
       "type": "string",
       "description": "A registered domain like example.com"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "note": null,
  "count": 42,
  "total": 42,
  "domain": "github.com",
  "source": "CertSpotter (certificate transparency), 5 pages of 100 issuances",
  "checkedAt": "2026-10-15T14:20:11.463Z",
  "truncated": true,
  "subdomains": [
   {
    "name": "livesend.github.com",
    "issuer": null,
    "lastSeen": "2026-10-15T05:34:03Z",
    "wildcard": false,
    "firstSeen": "2026-08-14T05:47:26Z",
    "lastExpires": "2027-01-13T05:34:02Z"
   },
   {
    "name": "github.com",
    "issuer": null,
    "lastSeen": "2026-10-14T00:00:00Z",
    "wildcard": true,
    "firstSeen": "2026-08-02T23:38:02Z",
    "lastExpires": "2027-01-11T23:59:59Z"
   },
   {
    "name": "www.github.com",
    "issuer": null,
    "lastSeen": "2026-10-14T00:00:00Z",
    "wildcard": false,
    "firstSeen": "2026-08-04T00:00:00Z",
    "lastExpires": "2027-01-11T23:59:59Z"
   }
  ],
  "truncatedReason": "CertSpotter's free index lists only part of the certificates (github.com: 42 names there, 118 on crt.sh on 15 Oct); crt.sh is the full search"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/sitecheck-subdomain-enumeration-645fea22/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.sitecheck-api.workers.dev](https://www.zero.xyz/host/api.sitecheck-api.workers.dev/llms.txt)