CT Logs

What It Does

Queries crt.sh for CT log entries matching the domain. Returns deduplicated entries with issuer name, log entry timestamp, and crt.sh certificate ID. When `truncated: true`, the `pagination.next_offset` field gives the cursor for the next page. The optional `since` parameter filters to entries logged at or after the supplied timestamp — pair it with a short polling interval to detect unauthorized issuance in near real time.

Why It's Useful

CT log entries reveal patterns invisible in the active certificate alone: CA changes over time, certificate churn rates, subdomain discovery through historical SANs, and detection of unauthorized issuance. With `since` filtering plus the 30-minute cache, this endpoint becomes a polling-friendly monitor rather than a one-shot historical view.

Use Cases

Parameters

Response Fields

Code Examples

curl "https://api.edgedns.dev/v1/domain/ct-logs" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -d "domain=example.com"

const response = await fetch(
  'https://api.edgedns.dev/v1/domain/ct-logs?domain=example.com',
  {
    headers: {
      'Authorization': 'Bearer YOUR_API_KEY'
    }
  }
);

const data = await response.json();
console.log(data);

import requests

response = requests.get(
    'https://api.edgedns.dev/v1/domain/ct-logs',
    headers={'Authorization': 'Bearer YOUR_API_KEY'},
    params={
    'domain': 'example.com'
    }
)

data = response.json()
print(data)

Related Endpoints

External References

Learn more about the standards and protocols behind this endpoint.