Search the subdomain index.
Give it an apex domain and you get every subdomain on file, plus the date each name first showed up.
Free · no token · 100 requests per IP per day
Index
How the index is built.
The index reads every usable CT log in Chrome's and Apple's programs as entries land: Static CT (Let's Encrypt Sunlight, Geomys, Cloudflare Raio) and legacy RFC 6962 (Google Argon, Sectigo, DigiCert). It parses each certificate in memory, pulls out the SAN hostnames, then throws the rest away.
That only covers new entries. Older names come from retired CT logs replayed from the Internet Archive, plus Common Crawl, ICANN CZDS zone files, ProjectDiscovery Chaos, and HaGeZi DNS blocklists.
A prober also works through common hostnames against known apexes on a loop, and anything it turns up joins the same index.
The index normalizes every name by apex and keeps three fields:
(apex, subdomain, first-seen). It holds no certificate
metadata and never deletes a name.
API
Query it directly.
No token. 100 requests per IP per day. Returns one subdomain per line by
default. apex must be an eTLD+1; use ?format=json
for JSON or &dates=1 to include first-seen dates.
Token access (higher limits and the endpoints above) is in closed beta. Paid plans are not available yet.
MCP
For agent clients.
Streamable HTTP endpoint for agent clients. Shares the free
/v1/search budget (same counter). One tool, search:
pass an apex, get every indexed subdomain. No token; free tier does not probe.
CLI
On by default in subfaster.
A subdomain enumerator that queries this index directly. Its
crt source runs by default and takes no key, so
subfaster -d namecheap.com reaches the free API on a fresh
install.