Collectors · OSINT & security

Certificate transparency API in Python

Subdomains and issued certificates for a domain, from CT logs — the OSINT subdomain finder. One POST from Python with domain, rows back as JSON with 18 fields, $0.0004 per delivered record. No proxies or parsers to maintain.

Get an API key See the collector

A Python requests snippet that posts { — A Python requests call to the certificate_transparency collector returns one dict per record, at $0.0004 each.

First call

Install, call, read the rows.

pip install requests

The only dependency.

import os, requests

r = requests.post(
    "https://api.quanticdata.io/v1/scraper/collectors/certificate_transparency/run",
    headers={"Authorization": f"Bearer {os.environ['QD_API_KEY']}"},
    json={
        "domain": "github.com",
        "output": "subdomains",
        "max_results": 100,
    },
    timeout=120,
)
r.raise_for_status()
run = r.json()["payload"]
print(run["count"], "rows,", run["cost"]["usd"], "USD")
for row in run["results"]:
    print(row.get("subdomain"), row.get("domain"), row.get("id"), row.get("dns_names"))

Python: one Certificate Transparency (subdomains) run (Trova sottodomini), printing subdomain, domain, id, dns_names

The key comes from an environment variable, never from the code. The run answers in the same request when it finishes in time; payload.results holds the rows and payload.cost what they cost.

Request parameters

What the collector takes.

Input of the Certificate Transparency (subdomains) collector
Parameter	Type	Required	Meaning
`domain`	string	yes	Bare domain, e.g. example.com.
`output`	string: `certificates`, `subdomains`	no (default certificates)	'subdomains' (distinct hostnames) or 'certificates' (one row per cert).
`include_subdomains`	boolean	no (default true)	Include certs covering *.domain (the point of a subdomain scan).
`max_results`	integer	no (default 50)	How many records to deliver at most (1–500). You pay only for delivered records.

Response fields

18 fields per record.

Fields of each row (record)
Field	Type	What it holds
`rank`	integer	1-based position.
`subdomain`	string, nullable	Hostname (output=subdomains).
`domain`	string, nullable	The queried domain (output=subdomains).
`id`	string, nullable	certspotter issuance id (output=certificates).
`dns_names`	string[]	DNS names on the certificate (output=certificates).
`issuer`	string, nullable	Issuing CA (output=certificates).
`not_before`	string, nullable	Validity start (output=certificates).
`not_after`	string, nullable	Validity end (output=certificates).
`revoked`	boolean, nullable	Revocation flag (output=certificates).
`issuer_dn`	string, nullable	Issuer distinguished name (certificates).
`validity_days`	integer, nullable	Validity window in days (certificates).
`expired`	boolean, nullable	Whether the certificate has expired (certificates).
`wildcard`	boolean, nullable	Whether it covers a wildcard name (certificates).
`pubkey_sha256`	string, nullable	SHA-256 of the public key (certificates).
`certificates`	integer, nullable	Certificates naming this hostname (subdomains).
`first_seen`	string, nullable	Earliest certificate for this hostname (subdomains).
`last_seen`	string, nullable	Latest certificate for this hostname (subdomains).
`issuers`	string[], nullable	Certificate authorities that issued for this hostname (subdomains).

Add ?format=csv to the runs endpoint to get the same rows as CSV.

Long runs

Run in the background, then poll.

A run that needs more time can go to the background: send "async": true, get 202 with the run id, and poll the runs endpoint until the status is done. Reading a run is free.

import os, time, requests

H = {"Authorization": f"Bearer {os.environ['QD_API_KEY']}"}
r = requests.post("https://api.quanticdata.io/v1/scraper/collectors/certificate_transparency/run", headers=H,
                  json={**{"domain":"github.com","output":"subdomains","max_results":100}, "async": True}, timeout=30)
run_id = r.json()["payload"]["run_id"]
while True:
    run = requests.get(f"https://api.quanticdata.io/v1/scraper/collectors/runs/{run_id}", headers=H, timeout=30).json()["payload"]
    if run["status"] in ("done", "failed"):
        break
    time.sleep(5)
print(run["status"], run["count"])

Python: background run and polling

Errors

What can come back, and what is billed.

Collector run errors
Status	Meaning	Billed
`400`	The input does not match the collector (`payload.errors`)	No
`401`	Missing or wrong API key	No
`402`	Balance and free credit do not cover the run: top up	No
`422`	The input can never resolve; retrying the same input cannot help	No
`424`	The run failed at the source (blocked, timed out, layout changed); safe to retry	No
`429`	Rate limit or a per-account brake; wait for `Retry-After`	No

Only delivered rows are billed: a run that delivers nothing costs nothing.

Price

$0.0004 per delivered record.

What Certificate Transparency (subdomains) rows cost at list price
Rows	Cost
1	$0.0004
1,000	$0.40
10,000	$4.00

Up to 500 records per run; split larger jobs into several runs. The $2 free credit every month covers about 5,000 records. No subscription; paid tiers lower the unit price. All collector prices: collector pricing.

Before you run it

Questions developers ask

Is there a free Certificate Transparency (subdomains) API?

Every account gets $2 of free usage each month, about 5,000 records of this collector at $0.0004 each, with no card.

Do I have to handle proxies, retries or blocks?

No. The collector runs on our network and handles them; a run blocked at the source returns 424 and is not billed.

How many rows can one run return?

Up to 500 records per run (the max_results input, where the collector has one).

Can an AI agent run it?

Yes: the MCP server exposes it as the run_collector tool, with the same input and price. See the MCP server.

Run it on the free credit.

Create an API key, export it as QD_API_KEY and run the example. $0.0004 per delivered record, no subscription.

Get an API key Certificate transparency API