ct.subdomains

stable Advanced

Certificate Transparency subdomain discovery: unexpired certificates for *.domain (crt.sh).

GET /v1/ct/subdomains

What you get#

A list of Ct results in Onekey's unified shape, in data (an array). An empty array is a normal, successful answer and is charged like any other; a source that reports "nothing found" as an error returns a free 404 not_found instead.

What it costs#

Advanced · 5 credits for a fresh fetch, charged only when it succeeds.
Free when served from cache (0.2 credit for a cached response over 100 KB).
Free if the request is invalid (never charged) or the source fails or reports not found (refunded).

Parameters#

Name	Type	Required	Default	What it is	Constraints
`domain`	string	yes	(required)	Registrable domain	max 253 chars; must match `(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+(?:xn--[a-z0-9-]{2,59}\|[a-z]{2,63})`; trimmed, lowercased

Request#

curl "https://api.onekey.dev/v1/ct/subdomains?domain=example.com" \
  -H "x-api-key: YOUR_API_KEY"

Try it

Add your key to run this call right here. No key? Get one free. The key stays in this tab.

Recorded response#

A real Ct response, recorded and returned in Onekey's shape. Fields the platform does not provide are null.

json

{
  "success": true,
  "data": [
    {
      "entity": {
        "id": "29557945233",
        "name": "example.com"
      },
      "ext": {
        "names": "*.example.com\nexample.com",
        "issuer": "C=GB, O=Sectigo Limited, CN=Sectigo Public Server Authentication CA DV E36",
        "notBefore": "2026-09-24T00:00:00Z",
        "notAfter": "2026-12-21T09:32:54Z",
        "serialNumber": "2caeeaf0743459d7e5f82a75123c58f3"
      }
    },
    {
      "entity": {
        "id": "28361964045",
        "name": "example.com"
      },
      "ext": {
        "names": "*.example.com\nexample.com",
        "issuer": "C=US, O=SSL Corporation, CN=Cloudflare TLS Issuing ECC CA 3",
        "notBefore": "2026-07-29T22:10:08Z",
        "notAfter": "2026-10-27T22:17:21Z",
        "serialNumber": "0624d0ab311558780b7d5213b9631831"
      }
    }
  ],
  "metadata": {
    "platform": "ct",
    "endpoint": "subdomains",
    "cached": false,
    "stale": false,
    "age_s": 0,
    "fetched_at": "2026-01-01T12:00:00+00:00",
    "credits_charged": 5,
    "request_id": "7f3a9c2e5b1d4c8fa2e6d0b9c4f18e37"
  },
  "error": null
}

Field mapping#

How this endpoint's source fields become Onekey's unified schema. Fields the source lacks come back as null.

Source path	Onekey field	Transform
`id`	`entity.id`	`toString`
`common_name`	`entity.name`	-
`name_value`	`ext.names`	-
`issuer_name`	`ext.issuer`	-
`not_before`	`ext.notBefore`	`toIsoDate`
`not_after`	`ext.notAfter`	`toIsoDate`
`serial_number`	`ext.serialNumber`	-

Caching and freshness#

Fresh for about 1 hour. Repeat calls in that window are served from cache and are free.
Between 1 hour and 1 day the cached copy is still served instantly and marked stale: true while Onekey refreshes it in the background.
If the source is down when a refresh is needed, the last copy can be served for up to 1 day more (marked stale).
A "not found" is remembered for 5 minutes and is free.
The cache is shared across all customers, which is what keeps repeat calls cheap.

What can go wrong#

Status	Code	What to do
401	`unauthorized`	Check the `x-api-key` header.
402	`insufficient_credits`	Add credits; your balance must cover the price.
404	`not_found`	Unknown endpoint path.
422	`invalid_params`	Fix the parameters using the table above. Free.
429	`rate_limited`	Wait `Retry-After` seconds, then retry.
502	`upstream_error`	The source failed. Refunded; retry with backoff.

See Errors for the full list and retry guidance.

Status: stable (verified against the live source).