Live
Service status
Check live service health and documented failure responses before you integrate.
Category
DNS & Network
Endpoints
2
Key Features
7
Frequently Asked Questions
4
Used by people at amazing companies
Trust signals before you integrate
Transparent docs, authenticated requests, and visible reliability details make it easier to evaluate DomScan before you ship.
OpenAPI
API artifacts
OpenAPI, Swagger, Postman, CLI, SDK, and MCP links are one click away.
API keys
Protected access
Authenticated endpoints use API keys with clear credit costs before you call them.
10,000
Free allowance
Start with 10,000 monthly credits and upgrade only when usage grows.
What this API helps you ship
Use this page as a production brief: endpoints, examples, response shape, and the workflow pieces needed to plug DomScan into your own product.
Embed domain checks, DNS intelligence, risk signals, or enrichment into onboarding, search, and internal tools.
Replace repeated manual lookups with scheduled jobs, alerting, and reproducible investigation steps.
Use predictable fields, documented status codes, and credit costs instead of scraping provider pages.
Feed agents, dashboards, SOAR playbooks, and CRMs through OpenAPI, SDK, Postman, or MCP.
Integration workflow
A simple path from first request to repeatable production usage.
Authenticate once
Send your API key with the documented header and keep requests consistent across services.
Query with examples
Start from the curl and HTTP samples, then map the parameters into your application code.
Operate and monitor
Use status codes, credit costs, and response fields to build retries, logs, and alerts.
Developer kit
Jump from this page into machine-readable docs, request collections, SDKs, or agent tooling.
OpenAPI schema
Generate clients or inspect every request and response shape.
Postman collectionImport ready-made requests for manual testing and team handoff.
SDKs and CLIUse maintained packages and command-line workflows instead of writing boilerplate.
MCP integrationExpose domain intelligence to AI agents and internal assistant workflows.
Parameters and response map
Scan the inputs, output fields, and status codes before wiring the endpoint into your client.
Parameter
domainverifyinclude_wildcardsprefer_cachelimitdomains
Example Response
domainsubdomainswildcardssummarysummary.total_foundsummary.returnedsummary.verified_countsummary.unverified_countsummary.sources_usedsummary.apex_includedsummary.wildcard_suppressed_countsummary.wildcard_returned_count
HTTP Status Codes
200202400401402429503504
Endpoints
GET
/v1/subdomains
domainverifyinclude_wildcardsprefer_cachelimit
POST
/v1/subdomains/bulk
domainsverifyinclude_wildcardslimit
Trust signals before you integrate
Transparent docs, authenticated requests, and visible reliability details make it easier to evaluate DomScan before you ship.
Service status
API artifacts
OpenAPI, Swagger, Postman, CLI, SDK, and MCP links are one click away.
API keys
Protected access
Authenticated endpoints use API keys with clear credit costs before you call them.
Free allowance
Sign Up for Free
Start with 10,000 monthly credits and upgrade only when usage grows.
Active
Example Request
Start from the curl and HTTP samples, then map the parameters into your application code.
Key Features
Cache-only polling
Use prefer_cache=1 to serve cached data only. A miss returns 202, queues a refresh, and refunds the request credits.
Passive collection
DomScan does not brute-force labels, scan ports, or crawl the target site.
Asset Discovery
Review public evidence for forgotten or shadow IT hostname candidates.
Security Assessment
Use returned hostname evidence as one input to an authorized security review.
Certificate date evidence
CT-backed entries report the earliest certificate not-before value found. Passive fallback entries can return null.
Clear retry behavior
Cache-only misses return 202 with Retry-After. An all-source failure without stale cache returns 503. Both responses refund credits.
Structured API output
Inspect source, first_seen, verification, wildcard, cache, and coverage fields in JSON.
Example Request
curl -H "X-API-Key: $DOMSCAN_API_KEY" "https://domscan.net/v1/subdomains?domain=example.com&sources=ct&verify=yes&include_wildcards=yes"Example Response
{
"domain": "example.com",
"subdomains": [
{
"name": "api.example.com",
"source": "crtsh",
"first_seen": "2026-01-18T09:24:00Z",
"verified": true,
"dns_records": {
"A": ["192.0.2.10"],
"CNAME": null
}
}
],
"wildcards": [
{
"pattern": "*.example.com",
"source": "crtsh",
"first_seen": "2025-11-04T14:10:00Z"
}
],
"summary": {
"total_found": 1,
"returned": 1,
"verified_count": 1,
"unverified_count": 0,
"sources_used": ["crtsh"],
"apex_included": false,
"wildcard_suppressed_count": 1,
"wildcard_returned_count": 1
},
"intelligence_summary": {
"data_sources": ["crtsh"],
"source_count": 1,
"cache_status": "live",
"returned_count": 1,
"total_found": 1,
"truncated": false,
"limit": 500,
"verification_requested": true,
"include_wildcards": true,
"verified_count": 1,
"verified_ratio": 1,
"live_dns_record_count": 1,
"apex_included": false,
"wildcard_suppressed_count": 1,
"wildcard_returned_count": 1,
"first_seen_oldest": "2026-01-18T09:24:00Z",
"first_seen_newest": "2026-01-18T09:24:00Z",
"warning_count": 0
},
"meta": {
"query_time_ms": 842,
"cached": false
}
}Frequently Asked Questions
Is this legal?
The endpoint reads public datasets and, when requested, sends DNS queries only for names it already found. It does not brute-force labels, scan ports, or crawl target sites. You are responsible for using the results within your authorization and local law.
How complete is the discovery?
No. Every passive source has gaps. Internal names, hosts absent from the source datasets, and names that never appeared on public certificates or archives can be missing. Treat the response as evidence, not a complete inventory.
What does a 202 response mean?
A 202 means no fresh or stale result was ready for a cache-only request. DomScan queued a background refresh, returned Retry-After, and refunded the request credits.
Can this find vulnerabilities?
No. The endpoint returns hostname evidence and optional DNS resolution. It does not test the returned hosts for vulnerabilities.
Related Tools & Resources
HTTP Status Codes
We document the HTTP status codes you should handle so you can distinguish successful responses, auth issues, credits, rate limits, missing data, and upstream failures.
OK
200
Request successful
Accepted
202
Cache-only subdomain miss accepted for background refresh. No credits are charged; retry after the Retry-After delay.
Bad Request
400
Invalid parameters
Unauthorized
401
Missing or invalid API key/session.
Payment Required
402
Not enough credits to run this request.
Too Many Requests
429
Rate limit exceeded
Service Unavailable
503
Upstream service unavailable or temporarily rate limited.
Gateway Timeout
504
Upstream lookup timed out.
Discover Subdomains