Subdomain API
Every known subdomain of a domain, from one API call.
Query a dataset of 6.3B+ unique subdomains with a single key. Get JSON with timestamps, a compact list or plain text back.
GET /api/domain/{domain}
curl https://api.assetdiscovery.io/api/domain/example.com \
-H 'Api-Key: YOUR_API_KEY'200 OK · application/json
{
"domain": "example.com",
"total": 4521,
"subdomains": [
"api.example.com",
"auth.example.com",
"cdn.example.com",
"dev.api.example.com",
"mail.example.com",
…
]
}Dataset
The data behind every query
- Unique subdomains
- 6.3B+
- Deduplicated hostnames, wildcards folded into their base name
- Registered domains
- 717M+
- Across gTLDs and ccTLDs, queryable by their apex name
- Continuously merged
- Live
- Each record carries last_seen, so you know how current a host is
Sources
- Certificate transparency logs
- Passive DNS
- Our own passive discovery
Built for bug bounty recon, attack surface monitoring and asset inventories.
Getting started
From sign-up to first response
- Step 1
Create a free account
Sign up with email, GitHub or Google. Verify your email to activate the key.
- Step 2
Copy your API key
Your key is shown once at creation. Store it in your secret manager or shell profile.
- Step 3
Query any domain
Send GET /api/domain/{domain} with the Api-Key header and read the subdomains back.
Formats
Choose the response shape that fits your pipeline
- JSON
default - Every hostname your plan allows, as a flat array with the total.
- Plain text
?format=txt - One host per line. Pipe it straight into httpx, dnsx or nuclei.
- Full records
?format=full - Each host with first_seen and last_seen, plus total and your plan and quota in meta.
Pricing
Start free, upgrade when you need every result
Monthly plans. Cancel any time.
FAQ
Frequently asked questions
Something else? Email support@assetdiscovery.io