API reference
Five endpoints over one index of observed hostnames. Search is open and needs no token; find, top and stream are in closed beta.
Overview
The index behind these endpoints holds observed hostnames, combining certificate transparency data with several historical and public sources plus its own probing. Each row stores three things — the apex, the subdomain and the first-seen date. Certificate metadata is not retained.
Names are never deleted from the index. A returned hostname is a record that the name was observed at some point, not a guarantee that it resolves today.
All endpoints are HTTP GET except MCP, which is a POST. Responses are newline-delimited plain text unless you ask for JSON. Swap https://<api-host> in the examples below for the host you point at.
Search subdomains
/v1/search?apex=<domain>free · no tokenReturns every indexed name under an apex, one per line. This is the endpoint behind the search page.
| Parameter | Required | Description |
|---|---|---|
| apex | yes | The eTLD+1 to search. Passing a subdomain returns a 400 that names the correct apex. |
| format | no | Set to json for JSON output. This is format, not output — output=json is ignored. |
| dates | no | Set to 1 to include the first-seen date on every name. |
Watch the parameter name. JSON is requested with format=json. Passing output=json silently returns plain text.
[ { "first_seen": "2026-04-27T00:00:00Z", "sub": "devbit.in" }, { "first_seen": "2026-04-27T00:00:00Z", "sub": "www.devbit.in" }, { "first_seen": "2026-07-11T00:00:00Z", "sub": "test.devbit.in" }]invalid apex: not an apex (eTLD+1 is github.com)Find names containing a string
/v1/find?q=<search>closed betaSearches indexed names for a matching substring across every apex — the cross-organisation counterpart to search. Try it on the explore page.
curl -s "https://<api-host>/v1/find?q=login"Top apex domains
/v1/top?n=<number>closed betaReturns apexes ranked by how many subdomains the index holds for them.
curl -s "https://<api-host>/v1/top?n=100"Live stream
/v1/streamclosed betaA Server-Sent Events stream of newly indexed names. Keep the connection open and handle each event as it arrives.
curl -N "https://<api-host>/v1/stream"MCP endpoint
/mcpfree · no tokenAn MCP interface for agent clients. The free tier exposes the search tool, which takes an apex domain and returns the indexed subdomains.
{ "mcpServers": { "subdomains": { "type": "http", "url": "https://<api-host>/mcp" } }}Limits
100
requests per IP per day
Free /v1/search
none
API token required
Free /v1/search
eTLD+1
apex must be
example.com, not www.example.com
This app proxies search through its own route handler and caches each upstream response for fifteen minutes, so repeated lookups of the same domain cost one request against the daily budget rather than one per visitor.
Quick reference
| Purpose | Endpoint | |
|---|---|---|
| Subdomain search | /v1/search?apex=example.com | |
| JSON | /v1/search?apex=example.com&format=json | |
| First-seen dates | /v1/search?apex=example.com&dates=1 | |
| JSON + dates | /v1/search?apex=example.com&format=json&dates=1 | |
| Search indexed names | /v1/find?q=login | |
| Top apexes | /v1/top?n=100 | |
| Live stream | /v1/stream | |
| MCP | /mcp |
curl cookbook
curl -s "https://<api-host>/v1/search?apex=devbit.in"curl -s "https://<api-host>/v1/search?apex=devbit.in&format=json"curl -s "https://<api-host>/v1/search?apex=devbit.in&format=json&dates=1"curl -s "https://<api-host>/v1/search?apex=devbit.in&format=json" | jqcurl -s "https://<api-host>/v1/search?apex=devbit.in&format=json" -o subdomains.json