Subdomain Finder

## Subdomain Finder API Find the subdomains of any domain in one call. Each subdomain comes with the IPv4 address it resolves to and whether it is proxied by Cloudflare: a quick way to map an organisation's attack surface, inventory its web assets, review DNS, or research a competitor's infrastructure. ### Endpoint - **`GET /v1/subdomain-finder/?domain=jojapi.com`**: every subdomain found for the domain, each with `ip` and `cloudflare`, and `scan_date`, the moment (UTC) the subdomains were collected. ```json { "scan_date": "2026-10-18 20:46:34", "subdomains": [ { "subdomain": "demo.jojapi.com", "ip": null, "cloudflare": false }, { "subdomain": "docs.jojapi.com", "ip": "172.66.3.9", "cloudflare": true }, { "subdomain": "www.jojapi.com", "ip": "188.114.96.2", "cloudflare": true } ] } ``` ### Notes - Pass a domain (`example.com`) or a URL; for `https://example.com/page` the host name is used. - Results can come from an earlier scan of the domain; `scan_date` tells you when. Most lookups answer in a few seconds. - Large domains return thousands of subdomains in one response. - `ip` is `null` when the subdomain did not resolve to an address. - `cloudflare: true` means the subdomain's address belongs to Cloudflare, so the origin server's own address is not visible. - No scan can promise a complete list: subdomains that were never publicly visible may be missing. ### Errors and billing Errors are JSON, `{"error": {"message": "…", "code": "…"}}`, with a stable `code`: | Status | `code` | Meaning | Charged | | --- | --- | --- | --- | | 400 | `domain_required` | the `domain` parameter is missing or empty | no | | 400 | `invalid_domain` | the value is not a valid domain | only when the lookup ran; text that cannot be a domain name at all (a space, `<`, `\|`) is refused before any lookup | | 400 | `no_subdomains_found` | the lookup ran and found no subdomains | yes | | 503 | `service_unavailable` | the lookup could not be completed; retry later | no |