API.

Performance

Server-side latency measured on 2026-09-03 over 1 212 real queries from the access log (cold result cache, one request in flight, production load): domain 26 / 31 ms, subdomains 46 / 54 ms, hosts 41 / 49 ms, serial 43 / 51 ms, cert 109 / 182 ms, org 352 / 516 ms (p50 / p90). End-to-end from Europe through Cloudflare adds roughly 40–60 ms. Method and raw numbers: the measurement is repeated after major changes.

Endpoints

Exact domain lookup

GET/v1/domain/{hostname}

Certificates whose subject CN or SAN dNSName equals {hostname} exactly, as logged. A wildcard certificate for *.example.com is a distinct name and is not returned for sub.example.com — use the subdomains search to see both. History: certificates valid now or expired within the last 90 days; the full archive on Pro.

curl 'https://api.ctlogs.dev/v1/domain/example.com'

Subdomain lookup

GET/v1/subdomains/{domain}

Certificates for {domain} itself and every name under it — www.example.com, *.example.com, a.b.example.com, … Equivalent to the *.example.com query on the website. History: certificates valid now or expired within the last 90 days; the full archive on Pro.

curl 'https://api.ctlogs.dev/v1/subdomains/example.com'

Hostname list (subdomain finder)

GET/v1/hosts/{domain}

Every distinct hostname under {domain} with a certificate that is valid now or expired within the last 90 days (the apex itself included, wildcards such as *.example.com inline), one row per hostname instead of one per certificate: certs (how many of those certificates named it), first_seen / last_seen (first and latest of them) and last_not_after (expiry of the latest one); responses carry history_window_days: 90. Hostnames whose last certificate expired earlier — the history since 2013 — are in /v1/hosts-history (Pro). Rows come in reversed-name order (example.com, *.example.com, a.example.com, www.example.com, …), 100 per page with the usual has_next / next_cursor; the website shows the first page only, paging needs an API key.

curl 'https://api.ctlogs.dev/v1/hosts/example.com'

{
  "hosts": [
    {"host": "example.com", "certs": 5, "first_seen": "2025-09-02T09:14:02Z",
     "last_seen": "2026-08-30T11:02:57Z", "last_not_after": "2026-11-28T23:59:59Z"},
    {"host": "*.example.com", "certs": 2, "first_seen": "2026-02-20T08:30:15Z",
     "last_seen": "2026-05-22T08:30:15Z", "last_not_after": "2026-08-20T08:30:14Z"}
  ],
  "has_next": false,
  "next_cursor": "",
  "duration_ms": 47,
  "history_window_days": 90
}

Organization search

GET/v1/org?q={name}

Certificates by subject organization (O=). Queries of 4+ characters match case-insensitively anywhere in the name (paypal finds “PayPal, Inc.”); shorter queries must match the full name exactly (so EY still resolves). Rows from this method carry subject_cn and a domains sample instead of issuer/key columns. Costs 10 API credits per request (see limits). History: certificates valid now or expired within the last 90 days; the full archive on Pro.

curl 'https://api.ctlogs.dev/v1/org?q=paypal'

Serial lookup

GET/v1/serial/{serial}

Finds certificates by serial number: 4–42 hex characters, separators (:, -, spaces) and leading zero bytes tolerated. Serials are not globally unique, so one serial can return certificates from several CAs.

curl 'https://api.ctlogs.dev/v1/serial/0624d0ab311558780b7d5213b9631831'

Public key (SPKI) search

GET/v1/spki/{hash}

Pro plan — finds every certificate sharing one public key: {hash} is the SHA-256 of the SubjectPublicKeyInfo (64 hex characters, separators tolerated) — the value OpenSSL prints as openssl x509 -pubkey | openssl pkey -pubin -outform DER | sha256sum. Useful for tracking key reuse across certificates and CAs. A key shared by more than 1,000 certificates (shared-hosting and CDN keys) lists its first 1,000 in issuer/serial order and every page carries "truncated": true; other keys list in full.

curl -H 'Authorization: Bearer YOUR_KEY' \
  'https://api.ctlogs.dev/v1/spki/0856752f53199a673dcc955c137fe1f5b105a180528acb320bb3eddf15103a9b'

First seen in CT

GET/v1/first-seen/{hostname}

Pro plan. The earliest and latest Certificate Transparency record of one hostname: the SCT timestamp, issuer and serial of the first record, the earliest validity start (min_not_before, also mirrored as first_logged.not_before), the latest record and the latest expiry (each record is identified by issuer + serial — the certificate itself is at /v1/serial/{serial}). A hostname that never had a certificate of its own but lives under a wildcard gets the wildcard's history: matched names the record actually returned — the hostname itself, or its one-label wildcard parent such as *.example.com (a wildcard is also queryable as a name of its own). last_logged and max_not_after are null when the archive holds only the first record of the name (names seeded from our own 2025–2026 history carry no later record until the name is certified again). Backed by the archive index (2013 onwards). 1 credit; 404 when neither the name nor its wildcard parent ever appeared in CT. When only the wildcard one label below exists (*.{hostname}, which covers names under the hostname, not the hostname itself), the 404 names it: {"error": "no CT record for this name; only *.{hostname} exists"} — query that wildcard for its history.

curl -H 'Authorization: Bearer YOUR_KEY' 'https://api.ctlogs.dev/v1/first-seen/www.example.com'

{
  "name": "www.example.com",
  "matched": "www.example.com",
  "first_logged": {"sct_ts": "2015-03-12T09:14:02.331Z", "not_before": "2015-03-12T00:00:00Z",
                   "issuer": "CN=DigiCert SHA2 Secure Server CA,O=DigiCert Inc,C=US",
                   "serial": "0E64C5FBC236ADE14B172AEB41C78CB0"},
  "min_not_before": "2015-03-12T00:00:00Z",
  "last_logged": {"sct_ts": "2026-08-30T11:02:57.104Z", "issuer": "…", "serial": "…"},
  "max_not_after": "2026-11-28T23:59:59Z",
  "duration_ms": 4
}

Subdomain history

GET/v1/hosts-history/{domain}

Pro plan. Every hostname ever seen in a certificate under {domain} since 2013 (the apex and wildcards included), with the first SCT timestamp, the earliest validity start and the latest expiry; last_not_after is null when the latest record is unknown (see first-seen). Sorted by name, 100 per page, ?after=<next_cursor> for the next page; 1 credit per page. For the current surface with certificate counts use /v1/hosts.

curl -H 'Authorization: Bearer YOUR_KEY' 'https://api.ctlogs.dev/v1/hosts-history/example.com'

{
  "apex": "example.com",
  "hosts": [
    {"name": "example.com", "first_seen": "2014-01-07T18:20:11.512Z", "first_not_before": "2014-01-07T00:00:00Z",
     "last_not_after": "2026-11-28T23:59:59Z"},
    {"name": "old-staging.example.com", "first_seen": "2016-05-02T07:44:09.001Z", "first_not_before": "2016-05-02T00:00:00Z",
     "last_not_after": "2017-05-02T23:59:59Z"}
  ],
  "has_next": true,
  "next_cursor": "moc.elpmaxe.gnigats-dlo",
  "duration_ms": 61
}

BIMI mark certificates

GET/v1/bimi?q={domain or organization}

Verified and Common Mark Certificates (VMC/CMC) — the certificates behind brand logos in BIMI e-mail — as on ctlogs.dev/bimi. A query with a dot is a domain: marks whose SAN list holds it or a name under it (*. and a trailing dot are dropped). Anything else matches case-insensitively anywhere in the subject organization, the subject CN or the word mark. Add type=domain or type=org to override the guess — for an organization name with a dot, say Booking.com B.V.. Newest first, 50 rows per page with has_next / next_cursor. Every plan, the anonymous one included; 1 credit per request.

Each row carries the subject, issuer and trademark fields, the certificate’s domains, kind (VMC or CMC) and the CT log entry it came from. The logo itself is not inlined: logo_url points to a sanitised copy of the certificate’s SVG on ctlogs.dev and is absent when the certificate carries no logo; logo_hash_ok says whether the SVG matches the hash in the certificate. page_url, pem_url and der_url lead to the mark’s page and its body.

curl 'https://api.ctlogs.dev/v1/bimi?q=cnn.com'

{
  "query": "cnn.com",
  "type": "domain",
  "rows": [
    {
      "id": "f468559206fd370c",
      "kind": "VMC",
      "subject_o": "Cable News Network, Inc.",
      "subject_cn": "Cable News Network, Inc.",
      "subject_c": "US",
      "subject_dn": "SERIALNUMBER=2976730,CN=Cable News Network\\, Inc.,O=Cable News Network\\, Inc.,STREET=190 Marietta St NW,L=Atlanta,ST=Georgia,C=US",
      "issuer_dn": "CN=DigiCert Verified Mark RSA4096 SHA256 2021 CA1,O=DigiCert\\, Inc.,C=US",
      "domains": ["cnn.com"],
      "not_before": "2026-08-28T00:00:00Z",
      "not_after": "2027-09-01T23:59:59Z",
      "serial_hex": "0cb658999c795a3a19c7ee4434a810bd",
      "sha256": "c32882230aa19b1b6e50230928f4c2751602b1dad06955121f9bd4f56393b9d7",
      "is_precert": false,
      "word_mark": "",
      "mark_type": "Registered Mark",
      "trademark_office": "",
      "trademark_country": "US",
      "trademark_registration": "5817930",
      "logo_url": "https://ctlogs.dev/bimi/f468559206fd370c/logo.svg",
      "logo_hash_ok": true,
      "page_url": "https://ctlogs.dev/bimi/f468559206fd370c",
      "pem_url": "https://ctlogs.dev/bimi/f468559206fd370c.pem",
      "der_url": "https://ctlogs.dev/bimi/f468559206fd370c.der",
      "log_id": "VVlTrjCWAIBs0utSCKbJnpMYKKwQVrRCHFU2FUxfdaw=",
      "log_url": "https://gorgon.ct.digicert.com/log/",
      "entry_idx": 41616,
      "sct_ts": "2026-09-12T01:51:55.898Z"
    }
  ],
  "has_next": false,
  "next_cursor": "",
  "duration_ms": 12
}

Certificate detail

GET/v1/cert/{id}

The full record for one certificate: subject and issuer DNs, complete SAN list, validity, key and signature info, policy OIDs, precert/final fingerprints, and every CT log sighting with entry index and SCT timestamp. {id} is the id value returned by the search methods above, or a 64-hex SHA-256 fingerprint (of the precertificate or the final certificate, separators tolerated).

precert_sha256 is the SHA-256 of the precertificate DER exactly as logged (the value crt.sh shows for the precertificate), final_sha256 that of the final certificate; either can be empty when that leaf form was not logged or its hash was not retained.

curl 'https://api.ctlogs.dev/v1/cert/000000b50624d0ab311558780b7d5213b9631831'

The raw body is kept for 7 days after the certificate is first seen in CT. While it is archived, download it by appending /final.pem, /final.der, /precert.pem or /precert.der; afterwards these answer 404 {"error": "certificate body not archived"} and the originating log (see sightings) is the source. The precertificate body is there for nearly every certificate; the final body only when a log received the final certificate, which is about half of them. precert_body_archived and final_body_archived in the record say which downloads are available, and precert_body_bytes / final_body_bytes give their sizes.