# Subdomain Finder API — Certificate Logs & DNS, No Key (`insight.solutions/subdomain-finder-api`) Actor

Find a domain's subdomains in public certificate-transparency logs (crt.sh and Cert Spotter), resolve each over DNS-over-HTTPS (A, AAAA, CNAME) and optionally check which answer on the web: status, title, server. Hostnames only. No API key, no login.

- **URL**: https://apify.com/insight.solutions/subdomain-finder-api.md
- **Developed by:** [Insight Solutions](https://apify.com/insight.solutions) (community)
- **Categories:** Developer tools, SEO tools, Business
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $0.30 / 1,000 subdomains

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.
Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## Subdomain Finder API — Certificate Logs & DNS, No Key

**Every subdomain a company has ever had a certificate for, checked against DNS today.** Give this Actor a domain — `apify.com`, `www.basecamp.com`, or a full URL — and it reads the public **Certificate Transparency** logs through two independent services (crt.sh and Cert Spotter), merges what they know, resolves every name over DNS-over-HTTPS, and, if you ask, checks which ones answer on the web. One row per hostname: where it was found, how many certificates named it and when, its A/AAAA/CNAME records, and its HTTP status, title and server.

No API key. No login. No wordlist guessing. **Hostnames only** — there is no personal data in this Actor's output at all. **$0.50 per 1,000 subdomains**, DNS included; a run that finds nothing costs nothing.

### Try it in 30 seconds

```json
{
  "domains": ["apify.com"],
  "sources": ["crtsh", "certspotter"],
  "resolveDns": true,
  "checkHttp": false
}
```

That block is the Store prefill — paste it and run. For `apify.com` the 2026-10-07 captures hold 36 subdomains, 14 of which have had no valid certificate for months or years. Most of the run is crt.sh thinking: it took 11–16 seconds per domain in our captures.

Want to know which hosts are actually up? Add `"checkHttp": true` (and `"onlyResolving": true` to drop the names that no longer exist).

**Price** — $0.50 per 1,000 subdomains on the FREE tier (+ $0.001 per run), DNS resolution included; the optional HTTP check is $0.30 per 1,000 hosts checked. Summary rows, diagnostic rows and names you filter out are free. Pay-per-event, limited permissions — works over the Apify MCP server (`mcp.apify.com`) and with agentic (x402) payments.

**From code** — `client.actor("insight.solutions/subdomain-finder-api").call(run_input={…})` with `apify-client`, or `POST https://api.apify.com/v2/acts/insight.solutions~subdomain-finder-api/run-sync-get-dataset-items`.

### What comes back

One `subdomain` row per hostname — this one built from the 2026-10-07 apify.com captures:

```jsonc
{
  "ok": true,
  "rowType": "subdomain",            // "subdomain" | "domain" (summary) | "diagnostic"
  "input": "apify.com",
  "domain": "apify.com",             // the apex that was searched
  "hostname": "odoo.apify.com",
  "isApex": false,
  "isWildcard": false,               // true when *.odoo.apify.com is on a certificate
  "depth": 1,                        // labels below the apex

  // --- certificate evidence ---
  "sources": ["crtsh", "certspotter"],   // which sources listed it
  "certCount": 6,                    // distinct certificates naming it
  "firstSeen": "2025-12-07T14:41:19.000Z",  // earliest not_before
  "lastSeen": "2027-01-01T10:08:22.000Z",   // latest not_after
  "issuers": ["Let's Encrypt"],      // most recently used first, ≤ 5

  // --- DNS, today ---
  "dnsStatus": "ok",                 // ok | nxdomain | servfail | timeout | error
  "a": ["34.52.252.219"],
  "aaaa": [],
  "cname": null,
  "resolves": true,

  // --- HTTP check (null unless checkHttp is on) ---
  "httpStatus": null,
  "httpFinalUrl": null,
  "httpTitle": null,
  "httpServer": null,
  "httpMs": null,
  "httpScheme": null,
  "httpError": null,

  "error": null,
  "errorType": null,
  "scrapedAt": "2026-10-07T21:04:40.000Z",
  "source": "crtsh+certspotter",
  "sourceUrl": "https://crt.sh/?q=%25.apify.com&output=json"
}
```

Read `sdk.apify.com` from the same run next to it: `"sources": ["crtsh"]`, `"certCount": 27`, `"lastSeen": "2023-04-25T06:30:50.000Z"` — a host that had certificates for five years and none since 2023. The certificate history and today's DNS answer, side by side, are the point: **a name that is in the logs but gives `nxdomain` is retired infrastructure; a name that resolves but has no current certificate is worth a second look.**

After each domain's last subdomain row comes one free `domain` summary row:

```jsonc
{
  "ok": true,
  "rowType": "domain",
  "domain": "apify.com",
  "subdomainCount": 36,
  "resolvingCount": 18,
  "liveCount": 0,                    // HTTP check was off
  "wildcardCount": 4,
  "certificateCount": 529,           // distinct certificates under apify.com
  "sourceCounts": { "crtsh": 36, "certspotter": 20, "hackertarget": null },
  "sourceStatus": { "crtsh": "ok", "certspotter": "ok", "hackertarget": null },
  "sourceMs": { "crtsh": 15927, "certspotter": 659, "hackertarget": null },
  "droppedOutsideApex": 36,          // other companies' names on shared certificates
  "droppedInvalid": 0,
  "filteredCount": 0,
  "undeliveredCount": 0,
  "truncated": false,
  "diagnosticTypes": []
}
```

Anything that could not be read is a free `diagnostic` row (`ok: false`) with an `errorType` and a sentence in `error`:

| `errorType` | When |
|---|---|
| `source-unavailable` | crt.sh (or Cert Spotter, or HackerTarget) did not answer after its retries. The other sources' names are still delivered. |
| `source-rate-limited` | Cert Spotter answered 429 (its anonymous quota), HackerTarget's daily quota is spent, or crt.sh answered 429 three times. |
| `invalid-input` | The entry is not a domain: an IP address, a bare public suffix such as `co.uk`, a hostname without a TLD. |
| `timeout` | The run's time budget ran out before a domain was searched, or with some of its names not yet resolved. |
| `no-results` | The sources answered but listed no name under the domain, or `onlyResolving` left nothing. |

### Use cases

- **Attack-surface inventory.** Find the staging hosts, forgotten admin panels and regional sites a company has put certificates on, and see which still resolve.
- **Dangling DNS.** A row with `cname` set and `resolves: false` is a CNAME whose target no longer exists — the classic subdomain-takeover pattern. Check it before someone else does.
- **SEO and migrations.** Every hostname that ever served HTTPS — old blog domains, `www` variants, regional sites — so redirects and canonicals can be audited.
- **Sales and market intelligence.** Subdomains name the tools a company runs (`status.`, `trust.`, `odoo.`, `discord.`): a cheap signal of their stack and their SaaS vendors.
- **Monitoring your own domains.** Schedule it weekly and diff the output: a new name in the logs is a new certificate somebody requested.

### How it works

1. **Read the domain.** Scheme, path, port and `www.` are dropped and the registrable domain is kept: `docs.example.co.uk` searches `example.co.uk`; under a public suffix such as `github.io` the user's own site (`octocat.github.io`) is the domain. One domain sent three ways is searched once.
2. **Ask the certificate sources, in parallel.** crt.sh (`https://crt.sh/?q=%25.<domain>&output=json`) has the deep history. Cert Spotter (`api.certspotter.com/v1/issuances`) has the newest certificates — every one it listed in our capture was still valid; pages are followed with `after=<last id>` while a page comes back full (100), up to ten pages. HackerTarget's host search, if you turned it on, is asked after them.
3. **Merge.** Names are lower-cased, trailing dots removed, and anything that is not a hostname — an email identity from an S/MIME certificate, an IP, a name with a space — is dropped and counted, never shown. Names that belong to other domains (shared certificates list dozens of companies) are dropped and counted. crt.sh lists every certificate twice (precertificate and final certificate); those are folded, and a certificate both sources saw is counted once — matched on its validity window and the names it covers, because the two services expose no common identifier. Wildcards are folded into their parent (`*.staging.apify.com` → `staging.apify.com`, `isWildcard: true`) unless you keep them. The list is sorted — the apex first, then alphabetical — and capped at `maxSubdomainsPerDomain`.
4. **Resolve.** Each name gets an A lookup and, if it exists, an AAAA lookup, over DNS-over-HTTPS: Cloudflare first, Google if Cloudflare does not give a DNS answer. NXDOMAIN is an answer and is not asked twice. A CNAME is read from the resolver's answer chain, including on NXDOMAIN, which is how a dangling CNAME shows up.
5. **Check (optional).** One GET to `https://<host>/`, and one to `http://<host>/` only if https got no answer. Any HTTP status counts as an answer. The first 64 KB of an HTML body is read for its `<title>`; redirects are followed (up to ten) and the final URL kept. Never HEAD. Hosts with no address are not checked.
6. **Deliver.** Rows are pushed in list order, in batches of 25 as they finish, charged only after they are in your dataset, and each domain ends with its summary row.

**Why it keeps working when crt.sh does not.** crt.sh is a free public service and is often overloaded: it is given 60 seconds, then retried after 5 seconds and again after 15. If it still will not answer you get a free `source-unavailable` row and Cert Spotter's names — resolved, delivered and billed as usual. The retries are cut short when they would eat into the last 30 seconds of the run (or the last quarter of a short run), so there is always time left to resolve what the other source found.

**Being a good citizen.** At most two domains are searched at once, so crt.sh never sees more than two queries from a run. A Cert Spotter 429 is reported, not dodged from another IP. A refused exit IP (HTTP 403) is retried once from a fresh proxy session, then reported. Pages of one source are spaced 250–600 ms apart.

### Input reference

| Field | Type | Default | What it does |
|---|---|---|---|
| `domains` | array of strings | — (required) | Domains, hosts or URLs. Reduced to the registrable domain and de-duplicated. |
| `sources` | array | `["crtsh", "certspotter"]` | Any of `crtsh`, `certspotter`, `hackertarget` (opt-in). |
| `includeWildcards` | boolean | `false` | Keep `*.x` names as rows of their own instead of folding them into `x`. Wildcard rows are never resolved or HTTP-checked. |
| `resolveDns` | boolean | `true` | A/AAAA (and CNAME from the answer) over DNS-over-HTTPS. Included in the row price. |
| `onlyResolving` | boolean | `false` | Leave out names with no A/AAAA address. Left-out names are free. Turns `resolveDns` on. |
| `checkHttp` | boolean | `false` | The HTTP live check. Billed per host requested. |
| `includeExpired` | boolean | `true` | Let expired certificates count as evidence. Off keeps only names on at least one unexpired certificate. |
| `maxSubdomainsPerDomain` | integer | `1000` | Cap on rows per domain, after sorting. 1–10,000. |
| `maxConcurrency` | integer | `8` | Names resolved/checked in parallel. 1–20. |
| `maxRunSecs` | integer | `240` | Wall-clock budget for the run. 30–3,600. |
| `proxyConfiguration` | object | `{ "useApifyProxy": true }` | Apify datacenter proxy by default. |

### Output reference

| Field | On | Meaning |
|---|---|---|
| `hostname`, `domain`, `isApex`, `depth` | subdomain | The name, its apex, and how many labels below the apex it sits. |
| `isWildcard` | subdomain | A wildcard certificate covers names under this host (or this is the wildcard row). |
| `sources` | subdomain | Which sources listed it. |
| `certCount`, `firstSeen`, `lastSeen` | subdomain | Distinct certificates naming it; earliest start, latest expiry. 0 / null for a name only HackerTarget knows. |
| `issuers` | subdomain | Issuing organisations, newest first, ≤ 5 — from crt.sh (the Cert Spotter request used carries no issuer). |
| `dnsStatus`, `a`, `aaaa`, `cname`, `resolves` | subdomain | Today's DNS answer. `aaaa` is null when the AAAA lookup failed. Null when `resolveDns` is off. |
| `httpStatus`, `httpFinalUrl`, `httpTitle`, `httpServer`, `httpMs`, `httpScheme`, `httpError` | subdomain | The HTTP check. Null unless `checkHttp` is on and the host had an address. |
| `subdomainCount` … `diagnosticTypes` | domain | The per-domain summary (see the example above). |
| `error`, `errorType` | diagnostic | What went wrong. |
| `ok`, `rowType`, `input`, `scrapedAt`, `source`, `sourceUrl` | every row | Bookkeeping; every row has every column, null where it does not apply. |

The dataset has five views in Console: **Overview**, **Live check**, **DNS**, **Certificates** and **Per-domain summary**.

### Pricing

**$0.50 per 1,000 subdomains.** Pay-per-event, with DNS resolution and the proxy inside that number.

| Event | What triggers it | FREE | Starter | Scale | Business |
|---|---|---|---|---|---|
| **Subdomain** *(primary)* | One `subdomain` row written to your dataset | $0.0005 | $0.0005 | $0.0004 | $0.0003 |
| HTTP check | One hostname the HTTP check sent a request to (`checkHttp` only) | $0.0003 | $0.0003 | $0.0003 | $0.0003 |
| Run started | Once per run, after the first paid row | $0.001 | $0.001 | $0.001 | $0.001 |

**Worked example — the prefill.** `apify.com`, DNS on: 36 rows × $0.0005 + $0.001 = **$0.019**.

**Worked example — with the live check.** `basecamp.com`, `onlyResolving` and `checkHttp` on: crt.sh lists 75 hostnames; if 40 of them resolve, that is 40 × $0.0005 + 40 × $0.0003 + $0.001 = **$0.033**, and the 35 that do not resolve are free.

An HTTP check is billed when its request was sent, whether or not the host answered — "nothing listens on 443 or 80" is a result. A host with no DNS address is never checked and never billed for a check.

#### What you are never charged for

- the per-domain summary row;
- every diagnostic row — a source that was down or rate-limited, an entry that was not a domain, a domain with no names, a domain the time budget never reached;
- names left out by `onlyResolving`, names past `maxSubdomainsPerDomain`, and names the run did not reach before `maxRunSecs` ran out;
- a run whose domains were usable but produced no subdomain row: it finishes **SUCCEEDED** with zero results, a status message naming the diagnostic rows ("0 results. 2 diagnostic row(s) explain why — 1 source-unavailable, 1 source-rate-limited. Nothing was charged."), and bills **nothing at all**, start fee included. A run finishes **FAILED** only when there was nothing usable to attempt (no domains, none that parsed, no source selected) or the Actor itself hit an error.

Set a maximum total charge on a run (`ACTOR_MAX_TOTAL_CHARGE_USD`) and the Actor reserves budget for each hostname — the row and, with `checkHttp`, its check — before resolving it. A name the remaining budget cannot cover is never looked up. The run finishes SUCCEEDED with the ceiling named in its status message, and everything already delivered is yours.

### Limits, and the ones that might bite

- **Certificate logs only know names that had a publicly trusted certificate.** Internal hosts, hosts covered only by a wildcard certificate, and hosts that never served HTTPS are invisible to them — `isWildcard` tells you where the logs stop seeing. HackerTarget (opt-in) adds some DNS-seen hosts; nothing here guesses names from a wordlist.
- **crt.sh is slow and sometimes down.** 11–16 seconds per domain in our captures, and it can time out on very large domains. An answer past 32 MB is abandoned to protect the run's memory, with a `source-unavailable` row. Cert Spotter's names still arrive.
- **Cert Spotter shows current certificates and has a small anonymous quota.** Every certificate in our capture was unexpired, so its history is short; the response advertised `x-ratelimit-limit: 10`. A run over many domains will hit it and get `source-rate-limited` rows for the rest; crt.sh still covers them. Up to ten pages (1,000 certificates) are read per domain.
- **HackerTarget allows a few dozen anonymous queries a day** and is off by default. Its IP addresses are not used: every name is resolved fresh.
- **Cross-source certificate matching is by validity window and names.** crt.sh and Cert Spotter share no identifier, so `certCount` treats two certificates with identical validity to the second and identical names under the domain as one. Where several such certificates exist, the source that saw more of them sets the count.
- **DNS is what public resolvers say, from where the run is.** Split-horizon names that only resolve inside a company network show `nxdomain`. CDN-backed names may resolve to different addresses elsewhere.
- **The HTTP check is one GET from a datacenter IP.** Some hosts refuse datacenter traffic (a 403 is still recorded as an answer). Only the final URL of a redirect chain is reported, not each hop. Titles are read from HTML only, and only from the first 64 KB.
- **Wildcard rows** (`includeWildcards`) are patterns, so they are never resolved or checked; `onlyResolving` therefore drops them.
- **The upstream formats may change.** crt.sh, Cert Spotter and HackerTarget are free services with no contract; if one changes its output, that source's rows turn into free `source-unavailable` diagnostics until the Actor is updated, and the other sources keep working.

### Use it from an AI agent, or from code

One JSON object in, one flat array out — the shape agent runtimes want. The Actor runs with **limited permissions**, uses **pay-per-event** pricing and never enters Standby, so it works over the Apify MCP server and with x402 agentic payments. The **Integrations** tab pushes results to Slack, a webhook, Zapier, Make, Google Sheets, Snowflake or BigQuery.

```bash
curl -X POST "https://api.apify.com/v2/acts/insight.solutions~subdomain-finder-api/run-sync-get-dataset-items?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"domains":["apify.com"],"onlyResolving":true}'
```

```python
## pip install apify-client
from apify_client import ApifyClient

client = ApifyClient("<APIFY_TOKEN>")
run = client.actor("insight.solutions/subdomain-finder-api").call(run_input={
    "domains": ["basecamp.com"],
    "onlyResolving": True,
    "checkHttp": True,
})

for row in client.dataset(run["defaultDatasetId"]).iterate_items():
    if row["rowType"] != "subdomain":
        continue
    print(row["hostname"], row["a"], row["httpStatus"], row["httpTitle"])
```

### FAQ

**Does it find every subdomain?**
No tool can promise that. It finds every name that appears on a publicly trusted certificate (crt.sh, Cert Spotter) or in HackerTarget's host index, if you turn it on. Hosts that never had a certificate of their own are the gap; `isWildcard` shows where a wildcard certificate hides them.

**Why do so many names come back `nxdomain`?**
Because certificate logs remember everything. 14 of the 36 apify.com names in our capture have had no valid certificate for months or years — integrations that moved, a 2019 `www` certificate, a test host. `firstSeen`/`lastSeen` date them; `onlyResolving` drops the ones that no longer exist, for free.

**Does it scan ports, brute-force names or log in anywhere?**
No. It reads three public search services and two public DNS resolvers. With `checkHttp` on, it sends one GET (two at most: https, then http) to each host that has an address. Nothing else touches the target.

**What happens when crt.sh is down?**
You get a free `source-unavailable` row, Cert Spotter's names — resolved and billed as usual — and a status message that says so. For apify.com that was 20 names instead of 36.

**What does `isWildcard` mean?**
That a certificate for `*.<hostname>` exists. Names under it can be served without appearing in any log.

**Can I search many domains in one run?**
Yes. Two are searched at a time, out of courtesy to crt.sh; raise `maxRunSecs` for long lists. Cert Spotter's anonymous quota will run out on long lists — those domains still get crt.sh's names and a free `source-rate-limited` row.

**Is there any personal data in the output?**
No. Rows contain hostnames, IP addresses, certificate dates, issuer organisations and, with the HTTP check, a page title and server header. Email identities found on certificates are dropped, and an email address you send as input is recorded as its domain.

### Legal and data-protection notes

- **Public records only.** Certificate Transparency logs are public by design: every publicly trusted certificate is logged so that anyone can audit it. DNS answers are public. The Actor never logs in, never sends cookies or credentials, and never uses anybody's API key.
- **The HTTP check touches the target.** One or two ordinary GET requests per host. Use it on domains you own or are authorised to assess, and follow the rules of any security programme you work under.
- **Not affiliated with** crt.sh, Sectigo, SSLMate (Cert Spotter), HackerTarget, Cloudflare, Google or any company whose hostnames appear in the output. Names and trademarks belong to their owners and are used only to describe which public sources were read.

### Our other Actors

Every Insight Solutions Actor is pay-per-result with no browser, no login and no API key, and every one of them returns free diagnostic rows instead of billing for failures. Prices are per 1,000 results.

**Video, audio & social**

- [YouTube Transcript API](https://apify.com/insight.solutions/youtube-transcript-api) — captions as timed segments, text, SRT or VTT, with language fallback and translation.
- [YouTube Comments API](https://apify.com/insight.solutions/youtube-comments-api) — comments and replies with likes, pinned and hearted flags, newest or top sort.
- [YouTube Channel API](https://apify.com/insight.solutions/youtube-channel-api) — a channel's videos, Shorts and live streams, plus YouTube search.
- [Podcast Search, Episodes & Charts API](https://apify.com/insight.solutions/podcast-api) — Apple Podcasts search, charts and full episode feeds.
- [Bluesky Scraper](https://apify.com/insight.solutions/bluesky-scraper) — profiles, posts, followers and follows from the public AT Protocol API.
- [Telegram Channel Scraper](https://apify.com/insight.solutions/telegram-channel-scraper) — posts, views and channel stats from public Telegram channels.
- [Substack Scraper](https://apify.com/insight.solutions/substack-scraper) — posts with full free text, comments and publication profiles.
- [Hacker News API](https://apify.com/insight.solutions/hacker-news-api) — stories, comments, users, front page and a structured "Who is hiring?" parser from the official HN APIs.
- [GitHub Repos, Trending & Releases API](https://apify.com/insight.solutions/github-repos-api) — repository facts, trending lists, releases and search, no token needed for small runs.
- [Discourse Forum API](https://apify.com/insight.solutions/discourse-forum-api) — topics, posts and categories from any Discourse community via its own JSON endpoints, usernames only.

**News, documents & the web**

- [Google News Search, Topics & Real Article URLs](https://apify.com/insight.solutions/google-news-api) — news search and topic feeds with the publisher's real URL decoded.
- [Website to Markdown — Content Extractor for LLMs & RAG](https://apify.com/insight.solutions/website-content-extractor) — any site as clean Markdown, text and heading-aware chunks.
- [WordPress Posts & Pages API](https://apify.com/insight.solutions/wordpress-posts-api) — posts and pages from any WordPress site as clean text or Markdown, with categories, tags and images.
- [Website Metadata API](https://apify.com/insight.solutions/website-metadata-api) — any URL's meta tags, Open Graph, Twitter cards, hreflang, feeds, JSON-LD and microdata, with normalised Product, Article, Event and FAQ entities.
- [Internet Archive API](https://apify.com/insight.solutions/internet-archive-api) — archive.org search, item metadata, files and reviews.
- [Wayback Machine Toolkit](https://apify.com/insight.solutions/wayback-toolkit) — archived URL inventories, snapshots and text diffs between dates.
- [Website Technology Detector](https://apify.com/insight.solutions/website-tech-detector) — the tech stack behind any site, with the evidence for each detection.
- [Domain Intelligence API](https://apify.com/insight.solutions/domain-intelligence-api) — DNS, RDAP registration, TLS certificate and HTTP facts in one row per domain.
- [SEO Page Audit](https://apify.com/insight.solutions/seo-page-audit) — sitemap crawl with on-page checks, structured data and broken-link reports.
- [Keyword Suggestions API](https://apify.com/insight.solutions/keyword-suggestions-api) — Google, YouTube, Bing, Amazon and eBay autocomplete with alphabet and question expansions.
- [Website Contact Extractor](https://apify.com/insight.solutions/website-contact-extractor) — emails, phone numbers and social profiles from any list of websites.
- [Web Search Results API](https://apify.com/insight.solutions/web-search-api) — Bing and DuckDuckGo organic results with snippets, no key, no browser.
- [Company Enrichment API](https://apify.com/insight.solutions/company-enrichment-api) — a domain in, a company profile out: firmographics, contacts, tech stack, DNS and hiring signal.
- [Company Dossier API](https://apify.com/insight.solutions/company-dossier-api) — one company in, twelve sections out: profile, tech, contacts, DNS, open roles, news, SEC filings, federal awards, recalls, YC batch and apps.
- [Press Releases API](https://apify.com/insight.solutions/press-releases-api) — GlobeNewswire and PR Newswire releases plus any newsroom feed, by keyword, company, ticker or subject.
- [Federal Register API](https://apify.com/insight.solutions/federal-register-api) — rules, proposed rules, notices and the Public Inspection desk with dockets, comment deadlines and CFR references.
- [Academic Papers Search API](https://apify.com/insight.solutions/academic-papers-api) — OpenAlex, Crossref, arXiv and PubMed in one row per paper: abstract, citations, open-access PDF, authors and venue.
- [RSS & Atom Feed Monitor](https://apify.com/insight.solutions/rss-feed-monitor) — any RSS, Atom or JSON feed (or an OPML file) in, only the new items out, with keyword filters and a webhook.
- [Website Change Monitor](https://apify.com/insight.solutions/website-change-monitor) — watch any pages, diff the text between runs, get change rows with added/removed lines, keyword alerts and a webhook.
- [Wikipedia & Wikidata API](https://apify.com/insight.solutions/wikipedia-api) — article text, search, daily pageviews and Wikidata entity facts, any language edition.

**Business, finance & jobs**

- [Congress & Insider Trades API](https://apify.com/insight.solutions/congress-insider-trades-api) — STOCK Act periodic transaction reports and SEC Form 4 insider trades in one schema.
- [Federal Contracts, Grants & Lobbying API](https://apify.com/insight.solutions/federal-contracts-grants-api) — SAM.gov opportunities, USAspending awards, Grants.gov notices and Senate lobbying filings in one schema.
- [SEC EDGAR API](https://apify.com/insight.solutions/sec-edgar-api) — filings, XBRL financials and full-text search by ticker or CIK.
- [Clinical Trials & FDA API](https://apify.com/insight.solutions/clinical-trials-fda-api) — ClinicalTrials.gov studies plus openFDA recalls, labels, approvals, 510(k)s and adverse-event reports.
- [Product & Vehicle Recalls API](https://apify.com/insight.solutions/product-recalls-api) — CPSC, NHTSA, FDA and USDA recalls, vehicle complaints and ratings, plus a VIN decoder.
- [Y Combinator Companies, Batches & Founders](https://apify.com/insight.solutions/yc-companies-directory) — the YC directory with founders and social links, filterable by batch, industry and hiring status.
- [Career Site Jobs API](https://apify.com/insight.solutions/ats-jobs-api) — jobs straight from Greenhouse, Lever, Ashby, Workable and 10+ other ATS career sites.
- [Workday Jobs API](https://apify.com/insight.solutions/workday-jobs-api) — every posting on any Workday career site, with facets, search, posted dates and full descriptions.
- [New Job Postings Monitor](https://apify.com/insight.solutions/job-postings-monitor) — new, closed and changed postings on the career sites you watch.
- [Hiring Signals API — Open Roles & Hiring Surge by Company](https://apify.com/insight.solutions/hiring-signals-api) — one row per company per run: open roles, what opened and closed, department and seniority breakdowns, and a hiring-surge flag.
- [Remote Jobs API](https://apify.com/insight.solutions/remote-jobs-api) — RemoteOK, Remotive, We Work Remotely, Himalayas, Jobicy and more in one schema, deduplicated.
- [Shopify Products API](https://apify.com/insight.solutions/shopify-products-api) — any Shopify store's catalogue, variants, prices and stock signals.
- [WooCommerce Products API](https://apify.com/insight.solutions/woocommerce-products-api) — any WooCommerce store's catalogue, prices, variants and stock through its public Store API.
- [Shopify App Store API](https://apify.com/insight.solutions/shopify-app-store-api) — Shopify App Store listings by category, collection or developer: pricing plans, ratings and merchant reviews.
- [Luma Events API](https://apify.com/insight.solutions/luma-events-api) — upcoming Luma events by city, category or calendar: dates, venue, price, capacity and organiser calendar, no host names.
- [Shopify Store Monitor](https://apify.com/insight.solutions/shopify-store-monitor) — price drops, sales, restocks, sell-outs and new products on any Shopify store, one row per change.
- [Public Tenders API](https://apify.com/insight.solutions/public-tenders-api) — EU TED, UK Find a Tender and Contracts Finder notices by keyword, CPV code, country, stage and deadline.
- [Nonprofit & IRS 990 Lookup API](https://apify.com/insight.solutions/nonprofit-990-api) — search US nonprofits and get EIN, NTEE code and multi-year Form 990 financials.
- [OpenStreetMap Places API](https://apify.com/insight.solutions/osm-places-api) — businesses and points of interest by category and area from OpenStreetMap: name, address, coordinates, website, phone, opening hours.

**Apps & games**

- [App Store & Google Play Reviews API](https://apify.com/insight.solutions/app-reviews-api) — reviews from both stores with ratings, versions and developer replies.
- [App Store Top Charts & App Search API](https://apify.com/insight.solutions/app-charts-api) — Apple top charts by country and genre, plus app search and details.
- [App Store Keyword Rank Tracker](https://apify.com/insight.solutions/app-store-keyword-rank-tracker) — where any app ranks for any keyword on the App Store and Google Play, with rank changes and ASO suggestions.
- [Steam Reviews API](https://apify.com/insight.solutions/steam-reviews-api) — Steam reviews with playtime, helpfulness and game details.
- [Steam Game Data API](https://apify.com/insight.solutions/steam-store-stats-api) — prices, tags, review scores, live player counts and top charts.
- [Sports Scores & Schedules API](https://apify.com/insight.solutions/sports-scores-api) — scores, schedules, standings, teams and headlines for the NFL, NBA, MLB, NHL, soccer and more, no key.
- [App Store Monitor](https://apify.com/insight.solutions/app-store-monitor) — App Store and Google Play listings watched between runs: new versions with release notes, price, rating and listing changes, one row per change.

# Actor input Schema

## `domains` (type: `array`):

One entry per domain to search. A **bare domain** (`apify.com`), a **host** (`www.apify.com`, `docs.apify.com`) or a **full URL** (`https://apify.com/store`) all work: everything reduces to the registrable domain, so `docs.example.co.uk` searches all of `example.co.uk`, and one domain listed three ways is searched — and billed — once. Under a public suffix such as `github.io` the registrable domain is the user's own (`octocat.github.io`); a bare public suffix (`co.uk`, `github.io`) and an IP address are refused with a free diagnostic row.

## `sources` (type: `array`):

Where names come from. **crt.sh** has the deepest certificate history (back to 2017 for apify.com) but is slow — 11 to 16 seconds per domain in our captures — and sometimes down; it is retried twice, and if it still fails you get a free `source-unavailable` row and the other sources' names. **Cert Spotter** is fast and lists only certificates that have not expired yet; its anonymous quota is small, and a 429 becomes a free `source-rate-limited` row. **HackerTarget** (opt-in) adds names seen in DNS rather than on certificates; it allows a few dozen anonymous queries a day.

## `includeWildcards` (type: `boolean`):

A wildcard certificate name such as `*.staging.apify.com` is not a host — it says `staging.apify.com` has subdomains the logs cannot list. **Off** (default): it is folded into the `staging.apify.com` row, which gets `isWildcard: true`. **On**: it is a row of its own (billed like any row), never resolved or HTTP-checked, because there is nothing to connect to.

## `resolveDns` (type: `boolean`):

Look every name up over DNS-over-HTTPS — A and AAAA, with any CNAME read from the answer — Cloudflare first, Google if Cloudflare does not answer. This is what tells a live host from a name that only exists in old certificates (`dnsStatus: nxdomain`). Included in the per-subdomain price.

## `onlyResolving` (type: `boolean`):

Leave out every name without an A or AAAA address today. Left-out names are free and counted in the summary row's `filteredCount`. Turns DNS resolution on.

## `checkHttp` (type: `boolean`):

For every name with an address, one GET to `https://<host>/` — and to `http://<host>/` only if https gets no answer at all — recording the status (any status counts as live, a 403 included), the final URL after redirects, the `server` header, the page `<title>` (read from the first 64 KB) and the response time. 10 seconds per request. Billed as a separate `http-check` event, once per host actually requested, whether or not it answered.

## `includeExpired` (type: `boolean`):

**On** (default): a name seen only on certificates that have since expired is still found — that is how retired staging hosts and old regional sites turn up — and `firstSeen`/`lastSeen` carry the dates. **Off**: only names on at least one unexpired certificate are kept.

## `maxSubdomainsPerDomain` (type: `integer`):

A cap on rows per domain, applied after sorting (the apex first, then alphabetical). The summary row's `truncated` says when it cut the list. Names past the cap are never resolved or billed.

## `maxConcurrency` (type: `integer`):

How many names are resolved and checked at once. The certificate sources are asked for at most two domains at a time whatever this says — crt.sh is a free public service.

## `maxRunSecs` (type: `integer`):

Wall-clock budget for the whole run. The certificate sources stop early enough to leave time to resolve what they found. When the budget runs out, every row already written is kept, and names not reached are left out, not billed, and counted in a free `timeout` row.

## `proxyConfiguration` (type: `object`):

The certificate sources, the DNS resolvers and ordinary web servers all answer datacenter addresses, so the default is Apify's datacenter proxy.

## Actor input object example

```json
{
  "domains": [
    "apify.com",
    "https://basecamp.com/pricing",
    "www.bbc.co.uk"
  ],
  "sources": [
    "crtsh",
    "certspotter"
  ],
  "includeWildcards": false,
  "resolveDns": true,
  "onlyResolving": false,
  "checkHttp": false,
  "includeExpired": true,
  "maxSubdomainsPerDomain": 1000,
  "maxConcurrency": 8,
  "maxRunSecs": 240,
  "proxyConfiguration": {
    "useApifyProxy": true
  }
}
```

# Actor output Schema

## `results` (type: `string`):

One row per subdomain found in the certificate logs: the hostname, which source found it, its certificate history, its DNS answer and, when asked for, what answered over HTTP. Each domain ends with a free summary row; anything that could not be read is a free diagnostic row saying why. Delivered as JSON items in the default dataset.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "domains": [
        "apify.com"
    ],
    "sources": [
        "crtsh",
        "certspotter"
    ],
    "resolveDns": true,
    "checkHttp": false,
    "proxyConfiguration": {
        "useApifyProxy": true
    }
};

// Run the Actor and wait for it to finish
const run = await client.actor("insight.solutions/subdomain-finder-api").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {
    "domains": ["apify.com"],
    "sources": [
        "crtsh",
        "certspotter",
    ],
    "resolveDns": True,
    "checkHttp": False,
    "proxyConfiguration": { "useApifyProxy": True },
}

# Run the Actor and wait for it to finish
run = client.actor("insight.solutions/subdomain-finder-api").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "domains": [
    "apify.com"
  ],
  "sources": [
    "crtsh",
    "certspotter"
  ],
  "resolveDns": true,
  "checkHttp": false,
  "proxyConfiguration": {
    "useApifyProxy": true
  }
}' |
apify call insight.solutions/subdomain-finder-api --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,insight.solutions/subdomain-finder-api"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/GOLL5zZWwdrvbgZZE/builds/faR49ruKdDpfTIRs1/openapi.json