---
title: "Get Subdomains Delta"
method: GET
path: "/v1/domains/{domain}/subdomains/delta"
tags: ["subdomains"]
---

# Get Subdomains Delta

`GET /v1/domains/{domain}/subdomains/delta`

## Request

- Base URL: `https://api.ctindex.io`
- URL: `https://api.ctindex.io/v1/domains/{domain}/subdomains/delta`
- Auth: one of:
  - API key in header `X-API-Key`
  - HTTP bearer

Diff the domain's subdomain inventory against a past point in time.

Classifies every observed subdomain relative to ``since``:

* **added** — first observed after ``since`` (new in the inventory).
* **removed** — was in the inventory at ``since`` but **no certificate
  naming it has been observed since then**. "Removed" strictly means the
  name **rolled out of CertIndex's observation window** — CT logs only
  record issuance, so this is NOT evidence the host was decommissioned
  or its certificate revoked. A host with a long-lived cert and no
  re-issuance will drift into this class while still being live.
* **unchanged** — present at ``since`` and re-observed since then.

Each class list is truncated at ``limit`` (largest cert_count first);
the ``*_count`` fields always carry full class totals. For very large
apexes the underlying scan is bounded (``results_partial=true``).

## Path parameters

- `domain` string, required

## Query parameters

- `since` string, required: ISO-8601 datetime — the reference point to diff the current subdomain inventory against.
- `limit` integer: Maximum entries returned PER class (added/removed/unchanged).

## Cookies

- `ctix_session` string, nullable

## Response `200`

Successful Response

- SubdomainDeltaResponse: Changed-since view of a domain's subdomain inventory (task #613). Classification is purely OBSERVATION-based: * ``added`` — first observed after ``since``. * ``removed`` — was in the inventory at ``since`` but no certificate naming it has been observed since then. This means the name rolled out of CertIndex's observation window; it does NOT mean the host was decommissioned or its certificate revoked. * ``unchanged`` — in the inventory at ``since`` and re-observed since.
  - `domain` string, required
  - `since` string, date-time, required
  - `generated_at` string, date-time, required
  - `added` SubdomainDeltaEntry[]
    - `subdomain` string, required
    - `first_seen` string, date-time, nullable
    - `last_seen` string, date-time, nullable
    - `cert_count` integer
  - `removed` SubdomainDeltaEntry[]
    - `subdomain` string, required
    - `first_seen` string, date-time, nullable
    - `last_seen` string, date-time, nullable
    - `cert_count` integer
  - `unchanged` SubdomainDeltaEntry[]
    - `subdomain` string, required
    - `first_seen` string, date-time, nullable
    - `last_seen` string, date-time, nullable
    - `cert_count` integer
  - `added_count` integer
  - `removed_count` integer
  - `unchanged_count` integer
  - `truncated` boolean
  - `results_partial` boolean

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/ctindex/apis/certindex-api.md) · [All operations](https://skmtc.dev/ctindex/apis/certindex-api/llms.txt) · [OpenAPI document](https://skmtc.dev/ctindex/apis/certindex-api/revisions/d5bc0ec85bc9?raw)