> ## Documentation Index
> Fetch the complete documentation index at: https://wiki.darknetsearch.com/llms.txt
> Use this file to discover all available pages before exploring further.

# SSL Transparency Logs

> Search certificate transparency logs for certificates issued against your domains and surface unknown subdomains and stale hosts

Search certificate transparency logs for every TLS certificate issued against your domains. Each certificate is a public record of a host that exists, so this is the fastest way to find subdomains, shadow IT, and stale hosts you never registered yourself.

This source is **synchronous** — one call returns the matching certificates in the same response.

### Search

Send your domain as the `query` parameter (3–1024 characters). The default field is `domain`, so a bare domain matches it. To scope by issue date, add a `createdAt` clause with the `AND`, `OR`, and `NOT` operators. Because the query syntax uses `:`, let `curl -G --data-urlencode` handle the encoding.

```bash theme={"dark"}
# All certificates issued against acme.com
curl -G https://client-api.leak.center/api/service/certificate_database_search/ \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  --data-urlencode "query=acme.com" \
  --data-urlencode "size=50"
```

```bash theme={"dark"}
# Narrow to certificates first seen on a given day
curl -G https://client-api.leak.center/api/service/certificate_database_search/ \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  --data-urlencode "query=acme.com AND createdAt:2026-01-15"
```

The full endpoint reference is [`certificate_database_search`](https://client-api.leak.center/scalar-docs/#tag/certificates/GET/service/certificate_database_search/).

This source costs **0 credits** per call and is throttled at **10,000 requests per day**.

### Request parameters

| Parameter | Type    | Required | Notes                                                                                                                                                                                             |
| --------- | ------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `query`   | string  | Yes      | 3–1024 chars. Default field is `domain`, so `acme.com` matches the domain. Searchable fields: `domain`, `createdAt`. Operators: `AND`, `OR`, `NOT`. Example: `acme.com AND createdAt:2026-01-15`. |
| `size`    | integer | No       | Page size. Default `10`, min `10`, max `1000`.                                                                                                                                                    |
| `page`    | integer | No       | Zero-based page index. Default `0`.                                                                                                                                                               |
| `sort`    | string  | No       | Sort field and direction. Default `createdAt,desc`.                                                                                                                                               |
| `org_id`  | integer | No       | Subsidiary organization ID. For system-level users searching a child organization.                                                                                                                |

### What comes back

The response is a paginated envelope. The certificates are in `content`; the surrounding fields describe the page you are on.

Page envelope fields:

* `content` — array of certificate records (see below).
* `hasContent` — `true` when this page holds at least one certificate.
* `number` — current page index (zero-based).
* `size` — page size used for this request.
* `totalElements` — total certificates matching the query.
* `totalPages` — total pages available.
* `numberOfElements` — count of certificates on this page.
* `first` / `last` — booleans flagging the first and last page.
* `follow_up_token` — token that replays this exact search later.

Each item in `content` is one certificate:

* `id` — the certificate's record ID.
* `createdAt` — when the record was indexed (`YYYY-MM-DD HH:MM:SS`).
* `domain` — the domain or host the certificate was issued for.
* `notBefore` — start of the certificate's validity window (`YYYY-MM-DD HH:MM:SS`).
* `notAfter` — end of the validity window (`YYYY-MM-DD HH:MM:SS`).
* `algorithm` — the signature algorithm.
* `fingerprint` — the certificate fingerprint.
* `serialNumber` — the certificate serial number.
* `issuer` — the certificate authority that signed it.
* `cvssScore` — risk score attached to the record, when present.

```json theme={"dark"}
{
  "content": [
    {
      "id": "a1b2c3d4",
      "createdAt": "2026-01-15 09:42:11",
      "domain": "vpn-test.acme.com",
      "notBefore": "2026-01-14 00:00:00",
      "notAfter": "2026-04-14 23:59:59",
      "algorithm": "SHA256-RSA",
      "fingerprint": "9F:2A:11:7C:5D:E0:44:8B",
      "serialNumber": "03:e1:9a:7f:22:10",
      "issuer": "R3, Let's Encrypt",
      "cvssScore": null
    }
  ],
  "hasContent": true,
  "number": 0,
  "size": 50,
  "totalElements": 1,
  "totalPages": 1,
  "numberOfElements": 1,
  "first": true,
  "last": true,
  "follow_up_token": "f0e1d2c3-b4a5-6789-0123-456789abcdef"
}
```

Match each `domain` against your asset inventory. Anything you do not recognize — a `vpn-test` host, a forgotten staging subdomain, a certificate from an unexpected issuer — is a lead to investigate, and a `notAfter` date in the past flags a stale host that may still be reachable.