API.

Performance

Server-side latency measured on 2026-09-03 over 1 212 real queries from the access log (cold result cache, one request in flight, production load): domain 26 / 31 ms, subdomains 46 / 54 ms, hosts 41 / 49 ms, serial 43 / 51 ms, cert 109 / 182 ms, org 352 / 516 ms (p50 / p90). End-to-end from Europe through Cloudflare adds roughly 40–60 ms. Method and raw numbers: the measurement is repeated after major changes.

Endpoints

Exact domain lookup

GET/v1/domain/{hostname}

Certificates whose subject CN or SAN dNSName equals {hostname} exactly, as logged. A wildcard certificate for *.example.com is a distinct name and is not returned for sub.example.com — use the subdomains search to see both.

curl 'https://api.ctlogs.dev/v1/domain/example.com'

Subdomain lookup

GET/v1/subdomains/{domain}

Certificates for {domain} itself and every name under it — www.example.com, *.example.com, a.b.example.com, … Equivalent to the *.example.com query on the website.

curl 'https://api.ctlogs.dev/v1/subdomains/example.com'

Hostname list (subdomain finder)

GET/v1/hosts/{domain}

Every distinct hostname that ever appeared as a certificate name under {domain} (the apex itself included, wildcards such as *.example.com inline), one row per hostname instead of one per certificate: certs (how many certificates named it), first_seen / last_seen (first and latest certificate), last_not_after (expiry of the latest one), and the live answer of ctlogs.dev’s own resolver — dns (ok, nxdomain, nodata, servfail, parked, …) with a records when resolved. Rows come in reversed-name order (example.com, *.example.com, a.example.com, www.example.com, …), 100 per page with the usual has_next / next_cursor; the website shows the first page only, paging needs an API key.

curl 'https://api.ctlogs.dev/v1/hosts/example.com'

{
  "hosts": [
    {"host": "example.com", "certs": 41, "first_seen": "2015-03-12T09:14:02Z",
     "last_seen": "2026-08-30T11:02:57Z", "last_not_after": "2026-11-28T23:59:59Z",
     "dns": "ok", "a": ["93.184.216.34"]},
    {"host": "*.example.com", "certs": 6, "first_seen": "2019-01-08T17:40:11Z",
     "last_seen": "2025-12-01T08:30:15Z", "last_not_after": "2026-03-01T08:30:14Z"}
  ],
  "has_next": false,
  "next_cursor": "",
  "duration_ms": 47
}

Organization search

GET/v1/org?q={name}

Certificates by subject organization (O=). Queries of 4+ characters match case-insensitively anywhere in the name (paypal finds “PayPal, Inc.”); shorter queries must match the full name exactly (so EY still resolves). Rows from this method carry subject_cn and a domains sample instead of issuer/key columns. Costs 10 API credits per request (see limits).

curl 'https://api.ctlogs.dev/v1/org?q=paypal'

Serial lookup

GET/v1/serial/{serial}

Finds certificates by serial number: 4–42 hex characters, separators (:, -, spaces) and leading zero bytes tolerated. Serials are not globally unique, so one serial can return certificates from several CAs.

curl 'https://api.ctlogs.dev/v1/serial/0624d0ab311558780b7d5213b9631831'

Public key (SPKI) search

GET/v1/spki/{hash}

Requires an API key — this search is disk-heavy, so it is not served anonymously; request a key at [email protected]. Finds every certificate sharing one public key: {hash} is the SHA-256 of the SubjectPublicKeyInfo (64 hex characters, separators tolerated) — the value OpenSSL prints as openssl x509 -pubkey | openssl pkey -pubin -outform DER | sha256sum. Useful for tracking key reuse across certificates and CAs.

curl -H 'Authorization: Bearer YOUR_KEY' \
  'https://api.ctlogs.dev/v1/spki/0856752f53199a673dcc955c137fe1f5b105a180528acb320bb3eddf15103a9b'

Certificate detail

GET/v1/cert/{id}

The full record for one certificate: subject and issuer DNs, complete SAN list, validity, key and signature info, policy OIDs, precert/final fingerprints, and every CT log sighting with entry index and SCT timestamp. {id} is the id value returned by the search methods above, or a 64-hex SHA-256 fingerprint (of the precertificate or the final certificate, separators tolerated).

precert_sha256 is the SHA-256 of the precertificate DER exactly as logged (the value crt.sh shows for the precertificate), final_sha256 that of the final certificate; either can be empty when that leaf form was not logged or its hash was not retained.

curl 'https://api.ctlogs.dev/v1/cert/000000b50624d0ab311558780b7d5213b9631831'

While the raw body is archived, it can be downloaded by appending /final.pem, /final.der, /precert.pem or /precert.der.