# ctlogs.dev Certificate Transparency API

> REST API over a continuously updated index of all public Certificate
> Transparency logs - billions of TLS/SSL certificates searchable by domain,
> organization, serial number or fingerprint. Engineered for speed: API
> response time is a primary development focus.

ctlogs.dev API: the fastest way to query Certificate Transparency - billions
of certificates, ~30-50 ms typical latency, JSON, cursor paging. Free without
a key (100 requests per hour per client, one request at a time, from a
shared keyless pool) or with a free key from https://account.ctlogs.dev/
(10 000 credits/month, 100 requests per hour, non-commercial use).
Every plan covers all currently valid certificates plus those expired
within the last 90 days - the full current attack surface of a domain.
Pro adds the deep archive: certificates back to 2013, first-seen dates
per hostname (/v1/first-seen), historical subdomain discovery
(/v1/hosts-history) and public-key search (/v1/spki). Responses carry
history_truncated=true when older records exist beyond your plan.

## API

Base URL: https://api.ctlogs.dev/v1 - all responses are JSON. Search methods
return up to 100 rows plus cursor pagination (repeat the request with
?after=<next_cursor>).

Performance (measured 2026-09-03 on real queries, cold cache, server-side
p50 / p90): domain 26 / 31 ms, subdomains 46 / 54 ms, hosts 41 / 49 ms,
serial 43 / 51 ms, cert 109 / 182 ms, org 352 / 516 ms. End-to-end adds
the Cloudflare round trip (~40-60 ms from Europe).

- /v1/domain/{host}: certificates matching the exact hostname.
  curl 'https://api.ctlogs.dev/v1/domain/example.com'
- /v1/subdomains/{host}: certificates for {host} and its subdomains.
  curl 'https://api.ctlogs.dev/v1/subdomains/example.com'
- /v1/hosts/{domain}: subdomain finder - every distinct hostname ever certified
  under {domain} (apex + wildcards inline), one row per hostname with certs
  count, first_seen / last_seen, last_not_after and the live DNS verdict
  (dns + a records). 100 per page; the website shows page 1 only, paging
  needs an API key.
  curl 'https://api.ctlogs.dev/v1/hosts/example.com'
- /v1/org?q={name}: certificates by subject organization (exact or substring).
  curl 'https://api.ctlogs.dev/v1/org?q=PayPal%2C%20Inc.'
- /v1/serial/{hex}: certificates by serial number (4-42 hex chars,
  separators tolerated).
  curl 'https://api.ctlogs.dev/v1/serial/0624d0ab311558780b7d5213b9631831'
- /v1/spki/{hash}: certificates sharing one public key ({hash} = SHA-256 of
  the SubjectPublicKeyInfo, 64 hex, separators tolerated). Pro plan; costs 10
  API credits per request, like /v1/org. A key shared by more than 1,000
  certificates lists its first 1,000 (issuer/serial order) with
  "truncated": true on every page.
  curl -H 'Authorization: Bearer YOUR_KEY' 'https://api.ctlogs.dev/v1/spki/0856752f53199a673dcc955c137fe1f5b105a180528acb320bb3eddf15103a9b'
- /v1/first-seen/{host}: Pro plan. Earliest and latest CT record of one exact
  hostname (SCT timestamp, validity, issuer, serial, log, entry index) from
  the archive index (2013 onwards); 404 when the name never appeared;
  last_logged / max_not_after are null when only the first record is known.
  curl -H 'Authorization: Bearer YOUR_KEY' 'https://api.ctlogs.dev/v1/first-seen/www.example.com'
- /v1/hosts-history/{domain}: Pro plan. Every hostname ever certified under
  {domain} since 2013 with first_seen, first_not_before, last_not_after and
  last_log (the last two null when the latest record is unknown); 100 per
  page, ?after=<next_cursor>.
  curl -H 'Authorization: Bearer YOUR_KEY' 'https://api.ctlogs.dev/v1/hosts-history/example.com'
- /v1/usage: the key's plan and remaining monthly quota (plus the hourly
  window for free keys), free of charge - not paced, not counted, not
  deducted. Key required. Every keyed response also carries
  X-RateLimit-Limit / X-RateLimit-Remaining. A request ct-search rejects as
  malformed (400) is refunded; a 404 is a real lookup and stays paid.
  curl -H 'Authorization: Bearer YOUR_KEY' 'https://api.ctlogs.dev/v1/usage'
- /v1/cert/{id}: the full record of one certificate; {id} is the id value
  from search results, or a 64-hex SHA-256 fingerprint. The raw body is kept
  for 7 days after the certificate is first seen in CT: while it is archived
  (precert_body_archived / final_body_archived in the record, with their
  sizes in precert_body_bytes / final_body_bytes), append /final.pem,
  /final.der, /precert.pem or /precert.der; 404 afterwards. The
  precertificate body exists for nearly every certificate, the final body
  only when a log received the final certificate (about half).
  curl 'https://api.ctlogs.dev/v1/cert/000000b50624d0ab311558780b7d5213b9631831'

## Docs

- API documentation: https://api.ctlogs.dev/
- Web search UI: https://ctlogs.dev/
- Monitored CT logs and coverage: https://ctlogs.dev/logs