https://<api-host>

API reference

Five endpoints over one index of observed hostnames. Search is open and needs no token; find, top and stream are in closed beta.

00

Overview

The index behind these endpoints holds observed hostnames, combining certificate transparency data with several historical and public sources plus its own probing. Each row stores three things — the apex, the subdomain and the first-seen date. Certificate metadata is not retained.

Names are never deleted from the index. A returned hostname is a record that the name was observed at some point, not a guarantee that it resolves today.

All endpoints are HTTP GET except MCP, which is a POST. Responses are newline-delimited plain text unless you ask for JSON. Swap https://<api-host> in the examples below for the host you point at.

02

Find names containing a string

GET/v1/find?q=<search>closed beta

Searches indexed names for a matching substring across every apex — the cross-organisation counterpart to search. Try it on the explore page.

curl -s "https://<api-host>/v1/find?q=login"
03

Top apex domains

GET/v1/top?n=<number>closed beta

Returns apexes ranked by how many subdomains the index holds for them.

curl -s "https://<api-host>/v1/top?n=100"
04

Live stream

GET/v1/streamclosed beta

A Server-Sent Events stream of newly indexed names. Keep the connection open and handle each event as it arrives.

curl -N "https://<api-host>/v1/stream"
05

MCP endpoint

POST/mcpfree · no token

An MCP interface for agent clients. The free tier exposes the search tool, which takes an apex domain and returns the indexed subdomains.

mcp client config
{
"mcpServers": {
"subdomains": {
"type": "http",
"url": "https://<api-host>/mcp"
}
}
}
06

Limits

100

requests per IP per day

Free /v1/search

none

API token required

Free /v1/search

eTLD+1

apex must be

example.com, not www.example.com

This app proxies search through its own route handler and caches each upstream response for fifteen minutes, so repeated lookups of the same domain cost one request against the daily budget rather than one per visitor.

07

Quick reference

PurposeEndpoint
Subdomain search/v1/search?apex=example.com
JSON/v1/search?apex=example.com&format=json
First-seen dates/v1/search?apex=example.com&dates=1
JSON + dates/v1/search?apex=example.com&format=json&dates=1
Search indexed names/v1/find?q=login
Top apexes/v1/top?n=100
Live stream/v1/stream
MCP/mcp
08

curl cookbook

Plain text
curl -s "https://<api-host>/v1/search?apex=devbit.in"
JSON
curl -s "https://<api-host>/v1/search?apex=devbit.in&format=json"
JSON with dates
curl -s "https://<api-host>/v1/search?apex=devbit.in&format=json&dates=1"
Pretty-print with jq
curl -s "https://<api-host>/v1/search?apex=devbit.in&format=json" | jq
Save to a file
curl -s "https://<api-host>/v1/search?apex=devbit.in&format=json" -o subdomains.json