---
title: "Discover subdomains via Certificate Transparency logs"
method: POST
path: "/api/v1/domain/subdomains"
tags: ["Domain"]
---

# Discover subdomains via Certificate Transparency logs

`POST /api/v1/domain/subdomains`

## Request

- Base URL: `https://firstsales.io`
- URL: `https://firstsales.io/api/v1/domain/subdomains`
- Auth: none required

Queries crt.sh Certificate Transparency logs for every certificate issued for the domain and extracts unique subdomains from SAN entries. Passive/OSINT technique — no active scanning. Slower than other domain checks (crt.sh can be slow) and more tightly rate-limited: 5 requests/minute per IP.

## Request body

- object
  - `domain` string, required

## Response `200`

Discovered subdomains.

- SubdomainsResult
  - `domain` string, required
  - `subdomains` string[], required
  - `count` number, required
  - `source` 'Certificate Transparency (crt.sh)', required

## Other responses

- `400`: Invalid request — bad input, missing field, or malformed value.
- `429`: Rate limit exceeded for this endpoint. Wait Retry-After seconds and retry.
- `500`: Unexpected server error.
- `502`: Failed to query Certificate Transparency logs (crt.sh unavailable).
- `504`: Certificate Transparency lookup timed out.

---

[API](https://skmtc.dev/firstsales/apis/firstsales-public-api.md) · [All operations](https://skmtc.dev/firstsales/apis/firstsales-public-api/llms.txt) · [OpenAPI document](https://skmtc.dev/firstsales/apis/firstsales-public-api/revisions/3856191adf12?raw)