Certificate transparency API

Every publicly-trusted TLS certificate is written to a Certificate Transparency log, which makes CT the one place a domain's subdomains reveal themselves without brute force — if a host got a cert, it is in the logs. This endpoint reads those logs through certspotter and returns either the distinct subdomains of a domain or one row per certificate, each with its DNS names, issuing CA and validity window.

Get my free API key See the request

$0.0004 per delivered record · $2 free every month · Failed runs never billed

POST /v1/scraper/collectors/certificate_transparency/run

$ curl $QD/certificate_transparency/run \
    -H "Authorization: Bearer $QD_API_KEY" \
    -d '{"domain": "github.com", "output": "subdomains", "max_results": 100}'
{ "status": "done", "count": 100,
  "results": [
    {
      "subdomain": "…",
      "domain": "…",
      "id": "…",
      "dns_names": […] } ],
  "cost": 0.04 }
# 100 records × $0.0004 · nothing delivered, nothing charged

$0.0004 / record5,000 records on the free $2 every month

Semantic inputdomain, output, include_subdomains — no URL lists

Up to 500records per run, pagination handled for you

No browserread over HTTP/TLS — cheaper and faster than rendering

What a certificate transparency API does

Ask for subdomains and you get the deduplicated hostnames CT has seen for the domain — the map of a target's public footprint that a DNS brute-force would take hours to approximate and still miss. Ask for certificates and each row is an issued cert: the DNS names it covers, who issued it, when it is valid from and until, and whether it is revoked.

The source matters here: this reads certspotter rather than crt.sh, the well-known CT search that is also famously slow and prone to timing out. Because issuance is logged whether or not the host is currently live, CT surfaces staging, internal-sounding and forgotten subdomains that never appear in search results — which is why it is the OSINT subdomain finder rather than a nice-to-have.

What one record looks like

Every delivered record carries these fields. Nullable means the source did not publish it — the field stays empty instead of being guessed.

Field	Type	What it holds
`rank`	integer	1-based position.
`subdomain`	string · nullable	Hostname (output=subdomains).
`domain`	string · nullable	The queried domain (output=subdomains).
`id`	string · nullable	certspotter issuance id (output=certificates).
`dns_names`	string[]	DNS names on the certificate (output=certificates).
`issuer`	string · nullable	Issuing CA (output=certificates).
`not_before`	string · nullable	Validity start (output=certificates).
`not_after`	string · nullable	Validity end (output=certificates).
`revoked`	boolean · nullable	Revocation flag (output=certificates).

Inputs

The whole request. Anything you leave out falls back to the default shown in the catalog.

Input	Type	Required	What it does
`domain`	string	yes	Bare domain, e.g. example.com.
`output`	string	no	'subdomains' (distinct hostnames) or 'certificates' (one row per cert). One of: `certificates`, `subdomains`.
`include_subdomains`	boolean	no	Include certs covering *.domain (the point of a subdomain scan).
`max_results`	integer	no	How many records to deliver at most (1–500). You pay only for delivered records.

Pricing

Certificate transparency API pricing

$0.0004 per delivered record. A run that delivers nothing costs nothing: blocked pages, challenges and retries are on us, and the $2 monthly allowance covers about 5,000 records before you spend anything.

$0.0004per delivered record$0.4 per 1,000 delivered records

5,000 recordson the free allowance$2 every month, no card

Zero rowszero chargeblocks, captchas and retries are on us

−30%on volume tiersthe catalog returns your key's price

Pay as you go

$0/mo

$2 free credit / month
60 requests / min
List unit prices

Starter

$19/mo

$15 free credit / month
300 requests / min
10% off unit prices

Growth

$79/mo

$50 free credit / month
600 requests / min
20% off unit prices

Scale

$299/mo

$250 free credit / month
1,200 requests / min
30% off unit prices

Same wallet, same key and same $2 monthly allowance as every other Data API. Prices are launch pricing read live from the billing config — GET /v1/scraper/collectors returns the price your key actually pays.

Integration

One POST, typed rows

Base URL https://api.quanticdata.io/v1, Bearer auth, the same key as every other Data API. Endpoint: POST /v1/scraper/collectors/certificate_transparency/run.

curl -X POST https://api.quanticdata.io/v1/scraper/collectors/certificate_transparency/run \
  -H "Authorization: Bearer $QD_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"domain":"github.com","output":"subdomains","max_results":100}'

import requests

r = requests.post(
    "https://api.quanticdata.io/v1/scraper/collectors/certificate_transparency/run",
    headers={"Authorization": f"Bearer {QD_API_KEY}"},
    json={
        "domain": "github.com",
        "output": "subdomains",
        "max_results": 100
    },
    timeout=120,
)
for row in r.json()["payload"]["results"]:
    print(row)

const res = await fetch(
  "https://api.quanticdata.io/v1/scraper/collectors/certificate_transparency/run",
  {
    method: "POST",
    headers: {
      Authorization: `Bearer ${process.env.QD_API_KEY}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({"domain":"github.com","output":"subdomains","max_results":100}),
  },
);
const { payload } = await res.json();
console.table(payload.results);

claude mcp add quantumproxies \
  -e QUANTUMPROXIES_API_KEY=qd_live_your_key_here \
  -- npx -y quantumproxies-mcp

# then, in the chat:
> run the certificate_transparency collector with domain="github.com" and output="subdomains"

What people build with the certificate transparency API

Three shapes of work this endpoint was designed around.

Attack-surface mapping

Enumerate a domain's subdomains from CT to inventory the hosts it exposes, including the ones no link points at.

Certificate inventory

In certificates mode, list every cert covering a domain with its issuer and expiry to audit the CAs in use and spot certificates about to lapse.

Infrastructure monitoring

Re-run a domain over time and new subdomains appearing in the logs flag newly stood-up hosts before they surface anywhere else.

Certificate transparency API versus rolling your own

The differences that actually cost time when you build this in-house.

	DIY scraper	This collector
Discovery method	DNS brute-force wordlists	Every logged certificate, no guessing
Source	crt.sh, slow and timing out	certspotter, one clean pass
Two outputs	Parse raw log JSON yourself	A subdomains list or per-cert rows

FAQ

Questions we get about the certificate transparency API.

Something else? Ask us →

How is finding subdomains from CT better than brute-forcing DNS?

Brute force only finds hosts whose names you already guessed and that answer DNS; CT lists hosts that were issued a certificate, guessed or not. Since almost everything public gets a cert, the logs surface staging and internal-sounding subdomains a wordlist never reaches — with no traffic sent to the target.

What is the difference between the subdomains and certificates outputs?

Set output to subdomains for the distinct hostnames — the OSINT footprint list. Set it to certificates for one row per issued cert, each with its DNS names, issuing CA and validity dates, the view for auditing certificates rather than hosts.

Why certspotter and not crt.sh?

crt.sh is the CT search most people know and also the one that regularly times out under load. This reads certspotter instead, so a subdomain scan returns in one reliable pass rather than intermittently failing.

Does this include wildcard and sub-subdomain coverage?

By default include_subdomains is on, so certificates covering *.domain are pulled in — that is the point of a subdomain scan. The DNS names on each cert row show exactly what each certificate covers.

Is there a free certificate transparency API?

Every account gets $2 of credit every month with no card, which is about 5,000 delivered records on this endpoint at $0.0004 each. It renews monthly, and a run that delivers nothing is never billed — so a failed or blocked attempt does not eat the allowance.

How much does one run cost?

Multiply the rows you actually receive by $0.0004. A run capped at 500 records — the maximum for this collector — costs $0.2 if every row comes back, and less when the source has fewer. Volume tiers take up to 30% off, and GET /v1/scraper/collectors returns the price your key actually pays.

Run the certificate transparency API now

$2 of free credit every month, no card. Your key returns its own prices from GET /v1/scraper/collectors.

Get my free API key