Request demo

Subdomain Finder API

List Every Subdomain the Index Knows Under a Domain.

The Subdomain Finder API takes a registered domain and returns the subdomains Deepinfo’s index holds under it, each one a full domain record rather than a bare hostname, so its A records, certificate and web data arrive with it.

Talk to us about access Subdomain Finder reference

domain acme.example GET /discovery/subdomain-finder?domain=acme.example

  1. Subdomains
    • vpn.acme.examplelevel 1 · A 203.0.113.24 · SSL to 2026-12-01 · parent WHOIS expiry 2027-03-14
    • staging.acme.examplelevel 1 · A 198.51.100.7
    • mail.eu.acme.examplelevel 2 · A 203.0.113.60

result_count 3 · each a full record

Hostnames That Arrive With Their Records.

Each subdomain record carries its parent’s WHOIS next to its own DNS, so ownership and resolution come back in one object.

GET https://api.deepinfo.com/v1/discovery/subdomain-finder Reference
ParameterTypeDescription
domainstringRequiredA registered domain, for example deepinfo.com.
pageintegerOptionalPage number, from 1.
page_sizeintegerOptionalResults per page.
orderingstringOptionalField to sort by. Prefix - for descending.
exportbooleanOptionalReturn the result as an export instead of a page. Default false.
export_formatstringOptionaljson or csv.
export_scopestringOptionalHow much of each record to include: basic, default or extended.

Request

curl "https://api.deepinfo.com/v1/discovery/subdomain-finder?domain=acme.example&page_size=25" \
  -H "apikey: YOUR_API_KEY"

Response

200 OK · application/json 
{
  "page": 1,
  "page_size": 25,
  "result_count": 3,
  "results": [
    {
      "punycode": "vpn.acme.example",
      "unicode": "vpn.acme.example",
      "is_idn": false,
      "subdomain_level_count": 1,
      "domain": {
        "punycode": "acme.example",
        "whois": {
          "registrar": "…",
          "expiry_date": "2027-03-14T00:00:00Z"
        }
      },
      "dns": {
        "a": { "ip_addresses": ["203.0.113.24"] }
      },
      "ssl": {
        "validity": { "end_date": "2026-12-01T23:59:59Z" }
      }
    },
    {
      "punycode": "staging.acme.example",
      "unicode": "staging.acme.example",
      "is_idn": false,
      "subdomain_level_count": 1,
      "dns": {
        "a": { "ip_addresses": ["198.51.100.7"] }
      }
    },
    {
      "punycode": "mail.eu.acme.example",
      "unicode": "mail.eu.acme.example",
      "is_idn": false,
      "subdomain_level_count": 2,
      "dns": {
        "a": { "ip_addresses": ["203.0.113.60"] }
      }
    }
  ]
}

Export the Whole List as One File.

Set export=true to get the result as JSON or CSV instead of a page. export_scope decides how much of each record comes with it: basic, default or extended.

In CSV, nested fields flatten into dotted column names. The parent domain’s WHOIS dates and registrar sit on each hostname’s row.

Export parameters in the reference
curl "https://api.deepinfo.com/v1/discovery/subdomain-finder?domain=deepinfo.com&export=true&export_format=csv&export_scope=basic" \
  -H "apikey: YOUR_API_KEY"

Hostname Lists Feed These Workflows.

Attack Surface Management

List the hostnames under each of your domains and compare them with what your CMDB says you run.

Use case

Third-Party Risk

See what a supplier exposes under its own domain before you connect it to yours.

Use case

M&A Due Diligence

Map a target’s hostnames from the outside, instead of relying on the list in the data room.

Use case

Subsidiary Oversight

Run the call across each group company’s domain and keep one list of what the group has online.

Use case

Keep the List Current.

Feed Daily Discovered Subdomains The subdomains added to the index each day, as one file. Read Discovery Domain Detail The full record for one name, in the shape this call returns. Read Discovery All TLDs Registrations of one name under other extensions. Read

See This Data at Work in the Deepinfo Platform

External Attack Surface Management runs these lookups continuously over your assets and raises what changes as issues, and Deep Search & Insights opens the whole index to your analysts.

Questions About Subdomain Finder API

Where do the subdomains come from?

From Deepinfo’s own index, which also runs discovery in the platform. The response does not attribute a source or a first-seen date to each hostname.

Can we query a domain we don’t own?

Yes. The call reads Deepinfo’s index, so it works for any registered domain: a supplier, an acquisition target or a domain under investigation.

Does the list show which subdomains are live?

Each record carries its DNS records and the outcome of Deepinfo’s last web visit in webdata.connection_status, as the index last observed them. To check one host as it is now, call DNS or Web Data.

How do we track new subdomains over time?

Diff successive calls, or take the Daily Discovered Subdomains feed. For your domains, Asset Discovery in EASM does this continuously and asks your team to approve what it finds.

Can we see which subdomains changed most recently?

Sort with ordering. ordering=-ssl_last_change_date puts the most recent certificate change first, and each record also carries dns_last_change_date for DNS changes.

How is the Subdomain Finder API priced?

As part of an API services plan, priced by volume and frequency, separately from the platform. See Data & API pricing.

See What Sits Under Your Domain.

Run the finder against your own domains with our team on a short call.

Talk to us about access All API services