crt.sh·Domain intelligence

Subdomains from certificates

/subdomainssync$0.003 / call

Every hostname under a domain that has appeared in a public TLS certificate, deduplicated and sorted. Shows a company's products, environments and tools (app, api, docs, status, jobs, careers, shop…). Certificates that expired are skipped unless include_expired is true.

Input

domainstringrequired
Registrable domain, e.g. "hunter.io".
include_expiredboolean
Also include hostnames only seen on expired certificates (default false).

Field	Type	Required	Description
domain	string	yes	Registrable domain, e.g. "hunter.io".
include_expired	boolean	—	Also include hostnames only seen on expired certificates (default false).

Run it

curl -s https://sooma.dev/v1/run \ -H "Authorization: Bearer $SOOMA_API_KEY" \ -H "Content-Type: application/json" \ -d '{"provider":"crtsh","endpoint":"/subdomains","input":{"domain":"hunter.io"}}'

Or ask your agent: it will call inspect for this schema and run it over MCP.