# Subdomain Finder via Certificate Transparency

> Subdomain Finder via Certificate Transparency is a paid API for AI agents from bess-x402.onrender.com, paid per call via x402, $0.003/call, status unknown (last checked 2026-10-28).

Discovers subdomains of a given domain by querying public Certificate Transparency logs (crt.sh), returning first-seen and validity dates.

## Facts

- Endpoint: GET https://bess-x402.onrender.com/v1/web/subdomains?utm_source=zero.xyz
- Price: $0.003/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-28
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/subdomain-finder-via-certificate-transparency-54ab485c
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_ZyralJSXeNm0qGHCgIU3c

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability subdomain-finder-via-certificate-transparency-54ab485c
```

Example prompt: Can you find all subdomains of stripe.com using Certificate Transparency logs and show me up to 200 results with their first-seen and validity dates?

## When to prefer this

Choose this endpoint when you need passive, non-intrusive subdomain discovery sourced from public Certificate Transparency logs without sending any traffic to the target. Ideal for OSINT, asset inventory, and security reconnaissance where stealth and historical certificate data matter. Prefer over active DNS brute-force tools when you want a read-only, legally safe approach or need first-seen certificate dates alongside subdomains.

## Known failure modes

- Domain not found in CT logs — returns empty result set
- Invalid domain format — likely returns a 400 or validation error
- Limit parameter out of range (< 1 or > 1000) — validation error
- Upstream crt.sh service unavailable — may return 503 or timeout
- Rate limiting or payment failure — returns 402 Payment Required

## How this service works

Subdomains of a domain found in public Certificate Transparency logs (crt.sh), with first certificate and current validity date. Use for attack-surface mapping, asset inventory or competitor research.

## Output

A list of subdomains discovered for the queried domain from Certificate Transparency logs, each entry including the subdomain name, the date the first certificate was issued, and the certificate's current validity/expiry date. Results are capped by the optional limit parameter (1–1000).

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET",
      "HEAD",
      "DELETE"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "domain"
     ],
     "properties": {
      "limit": {
       "type": "integer",
       "description": "Maximum number of results (1-1000)"
      },
      "domain": {
       "type": "string",
       "description": "Domain name"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/subdomain-finder-via-certificate-transparency-54ab485c/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from bess-x402.onrender.com](https://www.zero.xyz/host/bess-x402.onrender.com/llms.txt)