# Subdomain Enumeration via Certificate Transparency (crt.sh)

> Subdomain Enumeration via Certificate Transparency (crt.sh) is a paid API for AI agents from x402-deployer.x402-deployer.workers.dev, paid per call via x402, $0.03/call, status unknown (last checked 2026-09-14).

Enumerates subdomains for a given domain by querying Certificate Transparency logs via crt.sh, returning each subdomain with first-seen, last-seen, and certificate count.

## Facts

- Endpoint: POST https://x402-deployer.x402-deployer.workers.dev/subdomain-enum
- Price: $0.03/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/x402-deployer-x402-deployer-workers-dev-d8f36197
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_Ci1_u5BovetQ4CJspZubJ

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability x402-deployer-x402-deployer-workers-dev-d8f36197 -d '<json body>'
```

Example prompt: Can you enumerate all subdomains for example.com using certificate transparency logs and show me when each one was first and last seen?

## When to prefer this

Use this endpoint when you need passive subdomain discovery without active scanning, relying on public certificate transparency logs for comprehensive historical subdomain data including first/last seen metadata. Ideal for OSINT, attack surface mapping, and reconnaissance workflows where stealth and passivity matter.

## Known failure modes

- Domain not found in crt.sh — returns empty list
- Invalid or malformed domain input — returns error
- crt.sh upstream timeout or unavailability — returns upstream error
- Rate limiting by crt.sh backend — may return partial results or error
- Payment failure (x402) — request not processed

## How this service works

Subdomain enumeration / attack-surface mapping / DNS recon. Certificate Transparency log mining (crt.sh). All-public data. Each subdomain with first-seen, last-seen, cert count.

## Output

A list of discovered subdomains for the queried domain, each with a first-seen timestamp, last-seen timestamp, and the number of certificates observed for that subdomain in CT logs.

## Example request

```json
{
 "input": {
  "body": {
   "domain": "example.com",
   "include_wildcards": false
  },
  "type": "http",
  "method": "POST",
  "bodyType": "json"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/x402-deployer-x402-deployer-workers-dev-d8f36197/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from x402-deployer.x402-deployer.workers.dev](https://www.zero.xyz/host/x402-deployer.x402-deployer.workers.dev/llms.txt)