Skip to main content

CT Logs

developer
GET/v1/domain/ct-logs

Searches Certificate Transparency (CT) logs for recent certificates issued for a domain via the crt.sh aggregator. Returns up to 20 deduplicated entries. Unlike the SSL endpoint which analyzes the active certificate, this searches historical records across CT logs aggregated by crt.sh.

What It Does

Queries Certificate Transparency log aggregators (crt.sh) for recent certificates issued for the domain. Returns up to 20 deduplicated entries with issuer name, log entry timestamp, and crt.sh certificate ID. The truncated field indicates if more entries exist beyond the limit.

Why It's Useful

Recent CT log entries reveal patterns invisible in the active certificate alone: CA changes over time, certificate churn rates, subdomain discovery through historical SANs, and detection of unauthorized issuance. The truncated field indicates when more entries exist beyond the 20-entry limit.

Use Cases

Security Researcher

Historical Subdomain Enumeration

Discover subdomains from expired and historical certificates that no longer appear in the active certificate or DNS records.

Find forgotten subdomains and legacy infrastructure not visible through current DNS enumeration.

Security Operations

Unauthorized Issuance Detection

Search CT log history for certificates issued by unauthorized CAs or for unexpected subdomains.

Detect rogue certificate issuance that could indicate domain compromise or CA misbehavior.

PKI Administrator

Certificate Lifecycle Analysis

Analyze CA usage patterns over time — certificate rotation frequency, issuer changes, and automation effectiveness.

Optimize certificate management by identifying lifecycle patterns and automation gaps.

Parameters

NameTypeRequiredDescription
domainstringRequiredThe domain to search CT logs forExample: example.com

Response Fields

FieldTypeDescription
domainstringThe queried domain
certificatesarrayCertificate entries from CT logs with issuer, timestamp, and id
sctsarrayLegacy field — certificate entries with logName, timestamp, and version
hasSCTsbooleanWhether certificate entries were found in CT logs
countnumberTotal certificate entries found
truncatedbooleanWhether results were truncated (more entries may exist beyond the limit)
sourcestringData source (crt.sh aggregator)
notestringAdditional context about the CT log search

Code Examples

cURL
curl "https://api.edgedns.dev/v1/domain/ct-logs" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -d "domain=example.com"
JavaScript
const response = await fetch(
  'https://api.edgedns.dev/v1/domain/ct-logs?domain=example.com',
  {
    headers: {
      'Authorization': 'Bearer YOUR_API_KEY'
    }
  }
);

const data = await response.json();
console.log(data);
Python
import requests

response = requests.get(
    'https://api.edgedns.dev/v1/domain/ct-logs',
    headers={'Authorization': 'Bearer YOUR_API_KEY'},
    params={
    'domain': 'example.com'
    }
)

data = response.json()
print(data)

Read the full CT Logs guide

Why it matters, real-world use cases, parameters, response fields, and how to call it from Claude, ChatGPT, or Gemini via MCP.

Read the guide →

Related Endpoints

External References

Learn more about the standards and protocols behind this endpoint.

Try This Endpoint

Test the CT Logs endpoint live in the playground.