Enumerate subdomains
securitytrails_subdomainsList known subdomains of a domain in one API query, returning fully-qualified hostnames for resolution or scanning. Includes total_count and has_more to verify complete results.
Instructions
List known subdomains of a domain as fully-qualified hostnames, ready to feed into resolution or scanning. Costs one API query regardless of how many hostnames exist, so prefer a single call with a high limit over paging with offset — each page is separately billed. The response always reports total_count and has_more so a truncated result is never mistaken for a complete one.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | maximum hostnames to return (default 100) | |
| domain | Yes | apex domain, e.g. example.com | |
| offset | No | number of hostnames to skip before returning | |
| children_only | No | only direct children (one label deep) rather than the full tree | |
| response_format | No | "markdown" for a compact human-readable summary, "json" for the full raw API payload | markdown |
| include_inactive | No | include subdomains with no current DNS resolution |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| apex | Yes | ||
| note | No | ||
| limit | Yes | ||
| offset | Yes | ||
| has_more | Yes | ||
| returned | Yes | ||
| hostnames | Yes | fully-qualified hostnames | |
| next_offset | No | offset to pass for the next page, when has_more | |
| total_count | Yes | total subdomains SecurityTrails holds for this apex |