# Certificate transparency API — $0.0004/record

> Certificate transparency API: Subdomains and issued certificates for a domain, from CT. $0.0004 per delivered record, nothing delivered means nothing charged.

[Home](https://quanticdata.io/)/[Collectors](https://quanticdata.io/collectors/)/*Certificate transparency API*

# Certificate transparency API

Every publicly-trusted TLS certificate is written to a Certificate Transparency log, which makes CT the one place a domain's subdomains reveal themselves without brute force — if a host got a cert, it is in the logs. This endpoint reads those logs through certspotter and returns either the distinct subdomains of a domain or one row per certificate, each with its DNS names, issuing CA and validity window.

[Get my free API key](https://app.quanticdata.io/register) [See the request](/collectors/certificate-transparency-api/#integration)

$0.0004 per delivered record · $2 free every month · Failed runs never billed

POST /v1/scraper/collectors/certificate_transparency/run

```
$ curl $QD/certificate_transparency/run \
    -H "Authorization: Bearer $QD_API_KEY" \
    -d '{"domain": "github.com", "output": "subdomains", "max_results": 100}'
{ "status": "done", "count": 100,
  "results": [
    {
      "subdomain": "…",
      "domain": "…",
      "id": "…",
      "dns_names": […] } ],
  "cost": 0.04 }
# 100 records × $0.0004 · nothing delivered, nothing charged
```

**$0.0004 / record**5,000 records on the free $2 every month

**Semantic input**domain, output, include_subdomains — no URL lists

**Up to 500**records per run, pagination handled for you

**No browser**read over HTTP/TLS — cheaper and faster than rendering

On this page: [What it is](/collectors/certificate-transparency-api/#what) [Output fields](/collectors/certificate-transparency-api/#output) [Inputs](/collectors/certificate-transparency-api/#input) [Pricing](/collectors/certificate-transparency-api/#pricing) [Integration](/collectors/certificate-transparency-api/#integration) [Use cases](/collectors/certificate-transparency-api/#use-cases) [Versus the alternatives](/collectors/certificate-transparency-api/#compare) [FAQ](/collectors/certificate-transparency-api/#faq)

## What a certificate transparency API does

Ask for `subdomains` and you get the deduplicated hostnames CT has seen for the domain — the map of a target's public footprint that a DNS brute-force would take hours to approximate and still miss. Ask for `certificates` and each row is an issued cert: the DNS names it covers, who issued it, when it is valid from and until, and whether it is revoked.

The source matters here: this reads certspotter rather than crt.sh, the well-known CT search that is also famously slow and prone to timing out. Because issuance is logged whether or not the host is currently live, CT surfaces staging, internal-sounding and forgotten subdomains that never appear in search results — which is why it is the OSINT subdomain finder rather than a nice-to-have.

Input is meaning, not a URL *domain* *output* *include_subdomains* *max_results*

## What one record looks like

Every delivered record carries these fields. Nullable means the source did not publish it — the field stays empty instead of being guessed.

| Field | Type | What it holds |
| --- | --- | --- |
| `rank` | integer | 1-based position. |
| `subdomain` | string · nullable | Hostname (output=subdomains). |
| `domain` | string · nullable | The queried domain (output=subdomains). |
| `id` | string · nullable | certspotter issuance id (output=certificates). |
| `dns_names` | string[] | DNS names on the certificate (output=certificates). |
| `issuer` | string · nullable | Issuing CA (output=certificates). |
| `not_before` | string · nullable | Validity start (output=certificates). |
| `not_after` | string · nullable | Validity end (output=certificates). |
| `revoked` | boolean · nullable | Revocation flag (output=certificates). |

## Inputs

The whole request. Anything you leave out falls back to the default shown in the catalog.

| Input | Type | Required | What it does |
| --- | --- | --- | --- |
| `domain` | string | yes | Bare domain, e.g. example.com. |
| `output` | string | no | 'subdomains' (distinct hostnames) or 'certificates' (one row per cert). One of: `certificates`, `subdomains`. |
| `include_subdomains` | boolean | no | Include certs covering *.domain (the point of a subdomain scan). |
| `max_results` | integer | no | How many records to deliver at most (1–500). You pay only for delivered records. |

Pricing

## Certificate transparency API pricing

$0.0004 per delivered record. A run that delivers nothing costs nothing: blocked pages, challenges and retries are on us, and the $2 monthly allowance covers about 5,000 records before you spend anything.

**$0.0004**per delivered record*$0.4 per 1,000 delivered records*

**5,000 records**on the free allowance*$2 every month, no card*

**Zero rows**zero charge*blocks, captchas and retries are on us*

**−30%**on volume tiers*the catalog returns your key's price*

### Pay as you go

$0/mo

- $2 free credit / month

- 60 requests / min

- List unit prices

### Starter

$19/mo

- $15 free credit / month

- 300 requests / min

- 10% off unit prices

Most popular

### Growth

$79/mo

- $50 free credit / month

- 600 requests / min

- 20% off unit prices

### Scale

$299/mo

- $250 free credit / month

- 1,200 requests / min

- 30% off unit prices

Same wallet, same key and same $2 monthly allowance as every other [Data API](https://quanticdata.io/web-data-api-for-ai/). Prices are launch pricing read live from the billing config — `GET /v1/scraper/collectors` returns the price your key actually pays.

Integration

## One POST, typed rows

Base URL `https://api.quanticdata.io/v1`, Bearer auth, the same key as every other Data API. Endpoint: `POST /v1/scraper/collectors/certificate_transparency/run`.

```
curl -X POST https://api.quanticdata.io/v1/scraper/collectors/certificate_transparency/run \
  -H "Authorization: Bearer $QD_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"domain":"github.com","output":"subdomains","max_results":100}'
```

```
import requests

r = requests.post(
    "https://api.quanticdata.io/v1/scraper/collectors/certificate_transparency/run",
    headers={"Authorization": f"Bearer {QD_API_KEY}"},
    json={
        "domain": "github.com",
        "output": "subdomains",
        "max_results": 100
    },
    timeout=120,
)
for row in r.json()["payload"]["results"]:
    print(row)
```

```
const res = await fetch(
  "https://api.quanticdata.io/v1/scraper/collectors/certificate_transparency/run",
  {
    method: "POST",
    headers: {
      Authorization: `Bearer ${process.env.QD_API_KEY}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({"domain":"github.com","output":"subdomains","max_results":100}),
  },
);
const { payload } = await res.json();
console.table(payload.results);
```

```
claude mcp add quantumproxies \
  -e QUANTUMPROXIES_API_KEY=qd_live_your_key_here \
  -- npx -y quantumproxies-mcp

# then, in the chat:
> run the certificate_transparency collector with domain="github.com" and output="subdomains"
```

## What people build with the certificate transparency API

Three shapes of work this endpoint was designed around.

### Attack-surface mapping

Enumerate a domain's subdomains from CT to inventory the hosts it exposes, including the ones no link points at.

### Certificate inventory

In certificates mode, list every cert covering a domain with its issuer and expiry to audit the CAs in use and spot certificates about to lapse.

### Infrastructure monitoring

Re-run a domain over time and new subdomains appearing in the logs flag newly stood-up hosts before they surface anywhere else.

## Certificate transparency API versus rolling your own

The differences that actually cost time when you build this in-house.

|  | DIY scraper | This collector |
| --- | --- | --- |
| Discovery method | DNS brute-force wordlists | Every logged certificate, no guessing |
| Source | crt.sh, slow and timing out | certspotter, one clean pass |
| Two outputs | Parse raw log JSON yourself | A subdomains list or per-cert rows |

## FAQ

Questions we get about the certificate transparency API.

[Something else? Ask us →](mailto:hello@quanticdata.io)

### How is finding subdomains from CT better than brute-forcing DNS?

Brute force only finds hosts whose names you already guessed and that answer DNS; CT lists hosts that were issued a certificate, guessed or not. Since almost everything public gets a cert, the logs surface staging and internal-sounding subdomains a wordlist never reaches — with no traffic sent to the target.

### What is the difference between the subdomains and certificates outputs?

Set `output` to `subdomains` for the distinct hostnames — the OSINT footprint list. Set it to `certificates` for one row per issued cert, each with its DNS names, issuing CA and validity dates, the view for auditing certificates rather than hosts.

### Why certspotter and not crt.sh?

crt.sh is the CT search most people know and also the one that regularly times out under load. This reads certspotter instead, so a subdomain scan returns in one reliable pass rather than intermittently failing.

### Does this include wildcard and sub-subdomain coverage?

By default `include_subdomains` is on, so certificates covering *.domain are pulled in — that is the point of a subdomain scan. The DNS names on each cert row show exactly what each certificate covers.

### Is there a free certificate transparency API?

Every account gets $2 of credit every month with no card, which is about 5,000 delivered records on this endpoint at $0.0004 each. It renews monthly, and a run that delivers nothing is never billed — so a failed or blocked attempt does not eat the allowance.

### How much does one run cost?

Multiply the rows you actually receive by $0.0004. A run capped at 500 records — the maximum for this collector — costs $0.2 if every row comes back, and less when the source has fewer. Volume tiers take up to 30% off, and `GET /v1/scraper/collectors` returns the price your key actually pays.

## Run the certificate transparency API now

$2 of free credit every month, no card. Your key returns its own prices from `GET /v1/scraper/collectors`.

[Get my free API key](https://app.quanticdata.io/register)

Related: [All 65 collectors](https://quanticdata.io/collectors/) [Wayback Machine API](https://quanticdata.io/collectors/wayback-machine-api/) [Company Data API](https://quanticdata.io/collectors/company-data-api/) [Email Scraper API](https://quanticdata.io/collectors/email-scraper-api/) [Documentation](https://quanticdata.io/docs/)

---

Source: https://quanticdata.io/collectors/certificate-transparency-api/ · Site index for AI: https://quanticdata.io/llms.txt