Certificate Transparency Subdomain & Certificate Monitor (NEWAPI31)

Search public Certificate Transparency history for up to five supplied DNS domains. Each Dataset item represents one distinct crt.sh certificate ID across the whole run. It includes names found in that certificate, not a claim that a host exists or that a certificate is deployed there.

Input

{"domains":["example.org"],"includeExpired":true,"maxRecords":20}

Input	Bound	Meaning
domains	1–5 valid DNS names	Queries are sequential; duplicate input names are removed.
includeExpired	boolean	Defaults to true for historical discovery; false sends exclude=expired to crt.sh.
maxRecords	1–250	Maximum distinct certificate IDs published and charged. Default 20.

No live TLS handshake or current site certificate inspection is performed. not_after and days_until_expiry describe the historical CT certificate, which may not be deployed on any site. expiry_basis is always historical_ct_certificate. A wildcard pattern such as *.example.org is kept in wildcard_patterns and is not treated as an observed concrete hostname.

Output and missing data

Default Dataset rows are JSON via the Apify Dataset API and CSV via ?format=csv; both work in Clay and n8n. matching_subdomains, wildcard_patterns, and queried_domains are arrays in JSON (serialized cells in CSV). The output schema exposes links. RUN_SUMMARY in the default key-value store contains counts, truncation, and per-domain source errors; errors do not create paid Dataset rows.

Fields: cert_id, logged_at, not_before, not_after, common_name, matching_subdomains, wildcard_patterns, issuer_ca_name, days_until_expiry, serial_number, queried_domains, source, source_url, expiry_basis, and missing_source_fields. issuer_ca_name is the source's unmodified issuer DN, not a verified CA brand. The normal crt.sh search JSON has no log timestamp: logged_at is null and listed in missing_source_fields. Missing and malformed dates are null; no field is inferred from the live TLS service. The source can contain precertificates or duplicate SAN search matches; certificate IDs are deduplicated within a run.

Source, limits, and reliability

The Actor calls https://crt.sh/?q=<domain>&output=json once per domain. The public service has no published official JSON pagination, API quota, guaranteed SLA, or commercial service grant identified during review on 2026-10-27. Use is intentionally small and best effort. The Actor waits two seconds between domain requests, allows up to three attempts on timeouts/429/5xx with exponential backoff, uses a 45-second attempt timeout, a 270-second run deadline, and rejects responses over 8 MiB. For broad domains, the server may be slow or reject a request; errors appear in RUN_SUMMARY. Because there is no reliable server pagination, a result set over the 250-row output cap is marked truncated; no claim of complete domain coverage is made. A source error produces no paid item for that domain. A run with no results may be successful with zero charge.

No proxy, credential, secret, or customer domain is written to logs. The Actor does not access other hosts based on CT results.

Pay per event

Configure exactly USD $0.0045 per apify-default-dataset-item in Apify Console, and remove/price at zero any start or other chargeable event. One event is billed only when a unique, validated certificate row is successfully written to the default Dataset. Duplicate source hits, retried HTTP requests, skipped out-of-scope rows, errors, and summary writes are never charged. The Apify Python SDK reports spending limits from Actor.push_data; the Actor stops after the limit is reached. The price is $4.50 per 1,000 successful unique rows, before any platform-specific discount or tax. Verify the actual effective Store pricing in Console before release.

Local checks

python3 -m unittest discover -s tests -v
docker build -t newapi31:local .

For Apify CLI deployment, run apify validate-schema, apify push, test a cloud run and then configure the synthetic Dataset event price in the Actor's monetization settings. Publishing is contingent on source suitability and a confirmed effective price.