# Subdomain Finder Change Watch

> Subdomain Finder Change Watch is a paid API for AI agents from intel.rallylive.ca, paid per call via x402, $0.02/call, status unknown (last checked 2026-10-19).

Monitors certificate-transparency-based subdomain discovery for a domain and returns whether results have changed since the last check, with before/after field diffs.

## Facts

- Endpoint: GET https://intel.rallylive.ca/watch/subdomains?utm_source=zero.xyz
- Price: $0.02/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-19
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/subdomain-finder-change-watch-45088a03
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_Nk0PNCnFdiWXWsqP2CjIH

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability subdomain-finder-change-watch-45088a03
```

Example prompt: Keep an eye on example.com's subdomains using certificate transparency logs — let me know whenever new ones appear or existing ones disappear compared to the last check.

## When to prefer this

Choose this endpoint when you need scheduled, differential monitoring of subdomains discovered via certificate transparency logs — specifically when you care about what changed between checks rather than just retrieving the current list. It is ideal for security automation pipelines, attack surface management workflows, or competitive intelligence agents that need to react to changes without storing their own state. Prefer this over a raw subdomain lookup when you need built-in diffing, change detection, and 90-day result history.

## Known failure modes

- Domain not provided or malformed — missing required query parameter
- No previous result stored (first call always returns changed=false or baseline)
- Certificate transparency log sources temporarily unavailable — may return stale or empty results
- Domain has no CT log entries — returns empty subdomain list
- Result retention window exceeded 90 days — previous baseline lost, treated as first call

## How this service works

Change watch for subdomain finder: runs the check and compares it with the result from your previous call for the same domain (kept 90 days), returning the current answer, changed true/false, exactly which fields changed with before/after values, and when it was last seen. Call it on a schedule to be told when subdomain finder from certificate-transparency logs changes. $0.02 per check.

## Output

Returns the current list of subdomains found via certificate-transparency logs, a boolean 'changed' field indicating whether results differ from the previous call for the same domain, a field-level diff showing exactly which entries were added or removed with before/after values, and a timestamp of when the data was last seen. Previous results are retained for 90 days.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "properties": {}
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/subdomain-finder-change-watch-45088a03/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from intel.rallylive.ca](https://www.zero.xyz/host/intel.rallylive.ca/llms.txt)