Cert Spotter API

Free SSLMate Cert Spotter API with no key: search certificate transparency logs for every TLS certificate issued for a domain, with issuer, SANs and validity dates.

No API key requiredCORS enabledHTTPSFree tier

Endpoint tested and returned HTTP 200 on 21 Aug 2026

What is the Cert Spotter API?

The Cert Spotter API from SSLMate is a free, key-free interface to certificate transparency log data. Given a domain it returns the certificates issued for it, each with its SHA-256 fingerprints, DNS names, issuing CA, validity window and revocation status.

Every publicly trusted TLS certificate must be logged to certificate transparency logs before browsers will accept it, which makes those logs a complete public record of who issued what for which name. Cert Spotter indexes them and answers domain queries, so a single request tells you every certificate currently or recently covering a hostname — including ones you did not know about.

That last point is the security use. Unexpected certificates for your domain mean either shadow IT or something worse, and `include_subdomains=true` turns the query into a passive subdomain enumeration that never touches your infrastructure — the CT logs already know. This is reconnaissance without a single packet sent to the target, which is why it is safe to run against domains you do not own. Free unauthenticated use is rate limited per IP and returns a bounded slice of history; SSLMate offers keys for higher limits and complete results, but the anonymous tier answers the common questions perfectly well.

Quick facts

Base URL: https://api.certspotter.com/v1
Authentication: No API key needed for basic queries. SSLMate rate limits unauthenticated requests per IP and returns a limited window of results; an API key raises both. Certificate transparency data itself is public.
Rate limit: Unauthenticated requests are rate limited per IP and answered with HTTP 429 plus a `Retry-After` header when exceeded. Cache results — certificates do not change once issued.
Pricing: Free tier with no account. Paid SSLMate plans add higher limits, full history and monitoring alerts.
CORS: Enabled — callable directly from browser JavaScript
Official docs: Read the docs

How to use the Cert Spotter API

Every request below was executed against the live API on 21 Aug 2026, and the response shown is the real body it returned — not an illustration.

1. List certificates issued for a domain

GET https://api.certspotter.com/v1/issuances?domain=iana.org&include_subdomains=false&expand=dns_names&expand=issuer

curl

curl 'https://api.certspotter.com/v1/issuances?domain=iana.org&include_subdomains=false&expand=dns_names&expand=issuer'

JavaScript (fetch)

const res = await fetch("https://api.certspotter.com/v1/issuances?domain=iana.org&include_subdomains=false&expand=dns_names&expand=issuer");
if (!res.ok) throw new Error(`Request failed: ${res.status}`);
const data = await res.json();
console.log(data);

Python (requests)

import requests

res = requests.get("https://api.certspotter.com/v1/issuances?domain=iana.org&include_subdomains=false&expand=dns_names&expand=issuer", timeout=20)
res.raise_for_status()
print(res.json())

Response — HTTP 200

[
  {
    "id": "12983149119",
    "tbs_sha256": "12c53e43b44dd28faf59eedb1eaa1746669a6c636dde1d5212dc34f7c8a51f45",
    "cert_sha256": "146e78ef81434a17a4a787fa41a2e5410e6b677ba030761eaef1f3008f5fae01",
    "dns_names": [
      "*.iana.org",
      "iana.org"
    ],
    "pubkey_sha256": "d56f85824b6ed2ab15b9040c20b574515d9a0ab415ca253b42cbc915a11de18d",
    "issuer": {
      "friendly_name": "Sectigo",
      "pubkey_sha256": "2aa918617e4b60060fed719e9aacdbb4f3c803cc7b052fc16ce21c0177f78f69",
      "name": "C=GB, O=Sectigo Limited, CN=Sectigo Public Server Authentication CA OV R36"
    },
    "not_before": "2025-12-06T00:00:00Z",
    "not_after": "2027-01-05T23:59:59Z",
    "revoked": false
  }
]

Parameters

Parameter	Type	Required	Description
`domain`	query	Required	The domain to search for in certificate transparency logs. `iana.org`
`include_subdomains`	query	Optional	Include certificates for subdomains — effectively passive subdomain discovery. `true`
`expand`	query	Optional	Fields to include, repeatable: `dns_names`, `issuer`, `cert`, `revocation`. Without it results are minimal. `dns_names`
`match_wildcards`	query	Optional	Also match wildcard certificates that would cover the domain. `true`
`after`	query	Optional	Return only issuances with an id greater than this, for incremental polling. `12983149119`
`expired`	query	Optional	Include certificates that have already expired. `false`

Response fields

idstring: Issuance identifier. Pass the highest one back as `after` to poll for new certificates only.
dns_names[]array: Every DNS name the certificate covers, including wildcards. The field that reveals unknown subdomains.
issuer.friendly_name / namestring: The issuing CA, as a short name and as the full distinguished name.
not_before / not_afterstring: Validity window in UTC. `not_after` is your expiry monitoring field.
cert_sha256 / tbs_sha256 / pubkey_sha256string: Fingerprints of the certificate, its signed portion and its public key. `pubkey_sha256` is how you detect key reuse across certificates.
revokedboolean: Revocation status where SSLMate has determined it.

What you can build with the Cert Spotter API

Monitor for unauthorised certificates issued for your domain
Enumerate subdomains passively, without probing the target
Track upcoming certificate expiries across an estate
Audit which certificate authorities issue for your organisation
Investigate infrastructure during incident response

Common errors and how to fix them

429 with Retry-After

Unauthenticated rate limit exceeded.

Fix: Honour `Retry-After` and cache results. Certificates are immutable once issued, so repeated identical queries are pure waste.

Minimal results

No `expand` parameters were sent.

Fix: `expand` is repeatable — send `expand=dns_names&expand=issuer` to get the fields most queries actually need.

Fewer results than expected

The free tier returns a bounded window.

Fix: Unauthenticated access is limited in both rate and history. An API key returns complete results if you need exhaustive coverage.

400

The domain was malformed.

Fix: Send a bare hostname without scheme, path or port. `https://example.com/` is rejected.

Cert Spotter API — frequently asked questions

Is the Cert Spotter API free?

Yes for basic queries, with no key or account. SSLMate rate limits anonymous use per IP and caps how much history it returns; paid plans lift both and add monitoring alerts.

Is querying certificates for a domain I do not own legal and safe?

Yes. Certificate transparency logs are a public, append-only record that CAs are required to publish, and querying an index of them sends no traffic to the domain at all. This is passive reconnaissance in the strictest sense.

Can I use this to find subdomains?

Yes, and it is one of the most reliable methods available. Set `include_subdomains=true` and read the `dns_names` arrays — any subdomain that has ever had a public certificate appears, including ones with no DNS record left.

How do I monitor for new certificates continuously?

Poll with the `after` parameter set to the highest `id` you have seen. That returns only issuances newer than your last check, which makes continuous monitoring cheap.

Tools that pair with this API

SSL Certificate Decoder

Decode an SSL/TLS certificate to read its subject, issuer, validity dates, SANs, key size and SHA-256 fingerprint. Runs entirely in your browser.

CSR Decoder

Decode a PKCS#10 certificate signing request to verify the subject, key size and requested SANs before you send it to a certificate authority.

URL Parser

Parse a URL into protocol, host, port, path, query parameters and hash. Handles relative URLs with a base and shows query params in a table. Free and private.

Alternatives to Cert Spotter API

If Cert Spotter does not fit, these security & auth apis cover similar ground. Every one was called before publishing, and each links to its own reference page with a working curl command and the response it returned.

API	What it does	Auth	CORS	Last verified
Pwned Passwords	Free Have I Been Pwned password API with no key. Check if a password appears in known breaches using k-anonymity — the password never leaves your server. Tested.	No key	Yes	19 Aug 2026
Have I Been Pwned Breaches	Free Have I Been Pwned breach list API with no key: every catalogued data breach with date, affected accounts and compromised data types. Tested curl example.	No key	Yes	19 Aug 2026
NVD CVE	Free NIST National Vulnerability Database API: search CVEs by id, keyword, severity, CVSS score and date with full descriptions and references. Tested example.	No key	Yes	19 Aug 2026
CIRCL CVE Search	Free CIRCL CVE Search API with no key: query vulnerabilities by id, vendor or product, and pull the latest published CVEs. CORS enabled. Tested example.	No key	Yes	19 Aug 2026
CIRCL hashlookup	Free CIRCL hashlookup API with no key: check MD5, SHA-1 or SHA-256 file hashes against NSRL and other known-good datasets to filter out legitimate system files.	No key	No	21 Aug 2026
CISA Known Exploited Vulnerabilities	Free CISA Known Exploited Vulnerabilities catalogue as JSON, no key: every CVE with confirmed in-the-wild exploitation, with required remediation actions and due dates.	No key	No	21 Aug 2026

All Security & Auth APIs

Cert Spotter is an independent third-party service and is not affiliated with ByteTools or ByteVancer. Details on this page were verified on 21 Aug 2026; always check the official documentation before relying on this API in production, as terms and limits can change.