Every subdomain under any apex, in one call.

Pass an apex domain. Get back every subdomain Deepinfo has observed, sourced across passive DNS, certificate transparency, active scanning, and web crawling.

Talk to us Browse API docs

WHAT THIS API RETURNS

Every subdomain, across four discovery surfaces.

The Subdomain Finder API queries the indexed subdomain corpus that drives Deepinfo's own discovery pipeline. Pass an apex domain and the API returns every subdomain observed under it across passive DNS, certificate transparency, active scanning, and web crawling.

Each result is a fully qualified subdomain. Results are paginated by default; use the export flag to retrieve the full set as a downloadable file. The corpus reports approximately 2B subdomains at internet scale, deduplicated across discovery surfaces.

Use this when you need the working set of hostnames under any apex, including ones you don't own (vendor portfolios, customer-tenant apexes, acquired entities). For continuous monitoring, pair with the Daily Discovered Subdomains feed.

REQUEST

One endpoint, one required parameter.

Endpoint:

GET https://api.deepinfo.com/v1/discovery/subdomain-finder?domain={domain}

Parameters:

Name	In	Type	Required	Description
domain	query	string	Yes	An apex domain such as `deepinfo.com`.
page	query	integer	No	Page number for paginated responses. Defaults to 1.
page_size	query	integer	No	Page size for paginated responses. Defaults to a sensible per-endpoint limit; see docs.
ordering	query	string	No	Field to sort by; prefix with `-` for descending order.
export	query	boolean	No	When true, returns the full result set as a downloadable export instead of paginated JSON.
export_format	query	enum	No	Format of the export when `export=true`. Typically `json` or `csv`.
export_scope	query	enum	No	Subset of fields to include in the export. See the docs for per-endpoint scopes.

Authentication is by API token in the request header. See docs.deepinfo.com for the full request reference.

SAMPLE RESPONSE

See what the API returns.

Real response structure for the Every subdomain under any apex, in one call endpoint. Field coverage may vary based on query parameters and data availability.

JSON RESPONSE

{
  "_request": {"domain": "deepinfo.com"},
  "results": [
    {"fqdn": "www.deepinfo.com", "first_seen": "2018-06-13", "sources": ["passive_dns", "active_scan", "ct_log"]},
    {"fqdn": "api.deepinfo.com", "first_seen": "2019-02-08", "sources": ["passive_dns", "ct_log"]},
    {"fqdn": "docs.deepinfo.com", "first_seen": "2019-04-22", "sources": ["passive_dns", "ct_log", "web_crawl"]},
    {"fqdn": "dashboard.deepinfo.com", "first_seen": "2020-01-14", "sources": ["passive_dns", "ct_log"]},
    {"fqdn": "status.deepinfo.com", "first_seen": "2021-07-30", "sources": ["passive_dns", "ct_log"]}
  ],
  "pagination": {"page": 1, "page_size": 50, "total": 247}
}

STRUCTURED VIEW

Request

Domain

deepinfo.com

Results

Count

First fqdn

www.deepinfo.com

First first seen

2018-06-13

First sources

passive_dns, active_scan, ct_log

Pagination

Page

Page size

Total

247

Sample response shown. Real responses depend on query parameters, data availability, and API version. Talk to us for full schema documentation.

USE CASES

“Subdomain enumeration during attack-surface reviews used to combine three open-source tools and a passive-DNS API. One call covering passive DNS plus certificate transparency plus active scanning consolidated all of that.”

— Security Data Engineer, Attack Surface Management Vendor

CONTINUE EXPLORING

Other discovery APIs.

API

GET STARTED

Run a finder against your apex, or scope it to a vendor portfolio.

We'll set up token access and answer schema questions on a call.

Talk to us Browse API docs

Every subdomain under any apex, in one call.

Every subdomain, across four discovery surfaces.

One endpoint, one required parameter.

See what the API returns.

Workflows this API plugs into directly.

Attack Surface Management

Third-Party Risk Management

Mergers and Acquisitions Due Diligence

Other discovery APIs.

Search the global domain corpus, by any field.

Everything Deepinfo knows about one domain, in one call.

Every TLD permutation of a name, in one call.

Find every domain that looks like yours.

Find every domain registered to an email.

Domains registered at the same moment.

Run a finder against your apex, or scope it to a vendor portfolio.