Certificate transparency API

OSINT & security · v1.1.0 · certificate_transparency

$0.0004 / record

$0.40 / 1K · pay per delivered record

Every publicly-trusted TLS certificate is written to a Certificate Transparency log, which makes CT the one place a domain's subdomains reveal themselves without brute force — if a host got a cert, it is in the logs. This endpoint reads those logs through certspotter and returns either the distinct subdomains of a domain or one row per certificate, each with its DNS names, issuing CA and validity window.

By Aldo Morese, founder of QuanticData · Published Aug 21, 2026 · Updated Sep 3, 2026

Run in dashboard See the request

$0.0004 per delivered record · $2 free every month · Failed runs never billed

What it does

What a certificate transparency API does

Ask for subdomains and you get the deduplicated hostnames CT has seen for the domain — the map of a target's public footprint that a DNS brute-force would take hours to approximate and still miss. Ask for certificates and each row is an issued cert: the DNS names it covers, who issued it, when it is valid from and until, and whether it is revoked.

The source matters here: this reads certspotter rather than crt.sh, the well-known CT search that is also famously slow and prone to timing out. Because issuance is logged whether or not the host is currently live, CT surfaces staging, internal-sounding and forgotten subdomains that never appear in search results — which is why it is the OSINT subdomain finder rather than a nice-to-have.

Inputs

The whole request. Anything you leave out falls back to the default shown in the catalog.

Input	Type	Required	What it does
`domain`	string	yes	Bare domain, e.g. example.com.
`output`	string	no	'subdomains' (distinct hostnames) or 'certificates' (one row per cert). One of: `certificates`, `subdomains`.
`include_subdomains`	boolean	no	Include certs covering *.domain (the point of a subdomain scan).
`max_results`	integer	no	How many records to deliver at most (1–500). You pay only for delivered records.

Outputs — 18 fields, one row per record

What one record looks like

Every delivered record carries these fields. Nullable means the source did not publish it — the field stays empty instead of being guessed.

Field	Type	What it holds
`rank`	integer	1-based position.
`subdomain`	string · nullable	Hostname (output=subdomains).
`domain`	string · nullable	The queried domain (output=subdomains).
`id`	string · nullable	certspotter issuance id (output=certificates).
`dns_names`	string[]	DNS names on the certificate (output=certificates).
`issuer`	string · nullable	Issuing CA (output=certificates).
`not_before`	string · nullable	Validity start (output=certificates).
`not_after`	string · nullable	Validity end (output=certificates).
`revoked`	boolean · nullable	Revocation flag (output=certificates).
`issuer_dn`	string · nullable	Issuer distinguished name (certificates).
`validity_days`	integer · nullable	Validity window in days (certificates).
`expired`	boolean · nullable	Whether the certificate has expired (certificates).
`wildcard`	boolean · nullable	Whether it covers a wildcard name (certificates).
`pubkey_sha256`	string · nullable	SHA-256 of the public key (certificates).
`certificates`	integer · nullable	Certificates naming this hostname (subdomains).
`first_seen`	string · nullable	Earliest certificate for this hostname (subdomains).
`last_seen`	string · nullable	Latest certificate for this hostname (subdomains).
`issuers`	string[] · nullable	Certificate authorities that issued for this hostname (subdomains).

Integration

One POST, typed rows

Base URL https://api.quanticdata.io/v1, Bearer auth, the same key as every other Data API. Endpoint: POST /v1/scraper/collectors/certificate_transparency/run.

curl -X POST https://api.quanticdata.io/v1/scraper/collectors/certificate_transparency/run \
  -H "Authorization: Bearer $QD_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"domain":"github.com","output":"subdomains","max_results":100}'

import requests

r = requests.post(
    "https://api.quanticdata.io/v1/scraper/collectors/certificate_transparency/run",
    headers={"Authorization": f"Bearer {QD_API_KEY}"},
    json={
        "domain": "github.com",
        "output": "subdomains",
        "max_results": 100
    },
    timeout=120,
)
for row in r.json()["payload"]["results"]:
    print(row)

const res = await fetch(
  "https://api.quanticdata.io/v1/scraper/collectors/certificate_transparency/run",
  {
    method: "POST",
    headers: {
      Authorization: `Bearer ${process.env.QD_API_KEY}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({"domain":"github.com","output":"subdomains","max_results":100}),
  },
);
const { payload } = await res.json();
console.table(payload.results);

claude mcp add quanticdata \
  -e QUANTICDATA_API_KEY=qd_live_your_key_here \
  -- npx -y quanticdata-mcp

# then, in the chat:
> run the certificate_transparency collector with domain="github.com" and output="subdomains"

Example response

POST /v1/scraper/collectors/certificate_transparency/run

$ curl $QD/certificate_transparency/run \
    -H "Authorization: Bearer $QD_API_KEY" \
    -d '{"domain": "github.com", "output": "subdomains", "max_results": 100}'
{ "status": "done", "count": 100,
  "results": [
    {
      "subdomain": "…",
      "domain": "…",
      "id": "…",
      "dns_names": […] } ],
  "cost": 0.04 }
# 100 records × $0.0004 · nothing delivered, nothing charged

Try it

Certificate Transparency (subdomains), running now

Change the input and run it against the live collector — nothing to install, no sign-up.

Run it from your own code, on your own inputs

Same collector, same rows — $2 of free API credit every month, no card.

Get my free API key

Certificate transparency API: from domain and output, QuanticData reads the certificate logs and returns one row per record with subdomain, domain and issuer, at $0.0004 per delivered record. — You send domain and output; the run reads the source and comes back as records with rank, subdomain and domain — 18 fields on every row — and you are billed $0.0004 for each record actually delivered, nothing for a run that delivers none.

$0.0004 / record5,000 records on the free $2 every month

Semantic inputdomain, output, include_subdomains — no URL lists

Up to 500records per run, pagination handled for you

No browserread over HTTP/TLS — cheaper and faster than rendering

Pricing

Certificate transparency API pricing

$0.0004 per delivered record. A run that delivers nothing costs nothing: blocked pages, challenges and retries are on us, and the $2 monthly allowance covers about 5,000 records before you spend anything.

$0.0004per delivered record$0.4 per 1,000 delivered records

5,000 recordson the free allowance$2 every month, no card

Zero rowszero chargeblocks, captchas and retries are on us

−30%on volume tiersthe catalog returns your key's price

Pay as you go

$0/mo

$2 free credit / month
60 requests / min
List unit prices

Starter

$19/mo

$15 free credit / month
300 requests / min
10% off unit prices

Growth

$79/mo

$50 free credit / month
600 requests / min
20% off unit prices

Scale

$299/mo

$250 free credit / month
1,200 requests / min
30% off unit prices

Same wallet, same key and same $2 monthly allowance as every other Data API. Prices are launch pricing read live from the billing config — GET /v1/scraper/collectors returns the price your key actually pays.

What people build with the certificate transparency API

Three shapes of work this endpoint was designed around.

Attack-surface mapping

Enumerate a domain's subdomains from CT to inventory the hosts it exposes, including the ones no link points at.

Certificate inventory

In certificates mode, list every cert covering a domain with its issuer and expiry to audit the CAs in use and spot certificates about to lapse.

Infrastructure monitoring

Re-run a domain over time and new subdomains appearing in the logs flag newly stood-up hosts before they surface anywhere else.

Certificate transparency API versus rolling your own

The differences that actually cost time when you build this in-house.

	DIY scraper	This collector
Discovery method	DNS brute-force wordlists	Every logged certificate, no guessing
Source	crt.sh, slow and timing out	certspotter, one clean pass
Two outputs	Parse raw log JSON yourself	A subdomains list or per-cert rows

What people search for

Live autocomplete demand around Certificate Transparency (subdomains), pulled with our own Keyword ideas collector.

Certificate transparency API: the POST to the certificate_transparency collector, 100 records delivered and the bill, 100 × $0.0004 = $0.04 in usage.cost_usd; zero records would cost $0. — The same call you would paste into a terminal: a Bearer key, domain, output and include_subdomains in the body, and back the envelope every QuanticData endpoint returns — type, message, payload — where count is how many records arrived and usage.cost_usd is $0.04, which is 100 × $0.0004. A run that delivers nothing costs nothing. The key is good for 60 req/min on the free tier.

Sources and standards

The platform documentation and standards this collector is built against — check any claim on this page against the primary source:

FAQ

Questions we get about the certificate transparency API.

Something else? Ask us

How is finding subdomains from CT better than brute-forcing DNS?

Brute force only finds hosts whose names you already guessed and that answer DNS; CT lists hosts that were issued a certificate, guessed or not. Since almost everything public gets a cert, the logs surface staging and internal-sounding subdomains a wordlist never reaches — with no traffic sent to the target.

What is the difference between the subdomains and certificates outputs?

Set output to subdomains for the distinct hostnames — the OSINT footprint list. Set it to certificates for one row per issued cert, each with its DNS names, issuing CA and validity dates, the view for auditing certificates rather than hosts.

Why certspotter and not crt.sh?

crt.sh is the CT search most people know and also the one that regularly times out under load. This reads certspotter instead, so a subdomain scan returns in one reliable pass rather than intermittently failing.

Does this include wildcard and sub-subdomain coverage?

By default include_subdomains is on, so certificates covering *.domain are pulled in — that is the point of a subdomain scan. The DNS names on each cert row show exactly what each certificate covers.

Is there a free certificate transparency API?

Every account gets $2 of credit every month with no card, which is about 5,000 delivered records on this endpoint at $0.0004 each. It renews monthly, and a run that delivers nothing is never billed — so a failed or blocked attempt does not eat the allowance.

How much does one run cost?

Multiply the rows you actually receive by $0.0004. A run capped at 500 records — the maximum for this collector — costs $0.2 if every row comes back, and less when the source has fewer. Volume tiers take up to 30% off, and GET /v1/scraper/collectors returns the price your key actually pays.

Run the certificate transparency API now

$2 of free credit every month, no card. Your key returns its own prices from GET /v1/scraper/collectors.

Run in dashboard

Illustration: three coloured zones of the page that is read (Certificate logs) turn into clean JSON with the fields subdomain, domain and issuer; 18 fields on every row.