How Can I Use the Merklemap Search API?

Merklemap exposes a Search API for programmatically querying subdomains and SSL/TLS certificates, plus a separate Live Domains API for real-time streams of newly discovered hostnames. Both are documented on the site, and the Search API is the one to use for batch lookups and custom analysis. The catch: the available page evidence confirms these APIs exist and what they're for, but it does not publish authentication details, endpoints, rate limits, or request formats — so you'll need to read the official API docs before writing any code.

What the Search API is for

According to Merklemap's own documentation index, the Search API lets you "programmatically search for subdomains and certificates." That maps to two practical jobs:

• Bulk enumeration — pull subdomain and certificate records for many domains in one automated run instead of typing each into the web UI.
• Tool integration — feed results into your own recon scripts, dashboards, or security tooling.

The underlying data comes from Certificate Transparency logs, which Merklemap indexes and stores. The site describes the result as a view of an organization's "digital assets and trust infrastructure," including historical records so you can track changes over time.

Search API vs. Live Domains API

Merklemap documents two distinct programmatic interfaces. Pick based on whether you want to query on demand or subscribe to a stream.

If your goal is "give me everything for these 500 domains," use the Search API. If your goal is "tell me when a new subdomain appears," the Live Domains API is the fit.

How to get started

The site's documentation is organized into an Introduction, a "How It Works" section, and dedicated pages for the Search API and Live Domains API. The practical sequence:

1. Read the Search API doc page first. It's where authentication and request details live. The page evidence does not include them, so don't assume a scheme — check the source.
2. Confirm your access tier. Merklemap has a pricing page, which suggests access levels may differ. Whether the API requires a paid plan is not stated in the available material, so verify before building.
3. Start with a single-domain query to confirm your auth works and to see the response shape.
4. Scale to batch queries once the single call behaves as expected.
5. Add the Live Domains API separately if you need streaming rather than polling.

What you can do with the results

The site frames the value around proactive security: uncovering hidden assets, monitoring attack surface, and identifying certificate issues such as misconfigurations, weak ciphers, or expired certificates. Concretely, API output supports:

• Attack-surface mapping — enumerate subdomains that may expose sensitive services.
• Certificate hygiene checks — spot expiring or misconfigured TLS certificates across a portfolio.
• Change tracking — use historical data to monitor certificate renewals and detect shifts over time.

Common sticking points

• Skipping the docs. The most likely failure is guessing at endpoints or auth. The documentation pages are the authoritative source; the marketing pages are not.
• Assuming free access. A pricing page exists, but the evidence doesn't say the API is free or paid. Check your plan before you build a pipeline on it.
• Confusing the two APIs. Querying the Search API in a loop won't give you real-time discovery — that's the Live Domains API's job.
• Treating CT data as complete. CT-based enumeration reflects what's been logged in certificates, which is broad but not identical to every hostname that exists.

For anything beyond these general steps — exact endpoints, auth method, rate limits, and pricing — go directly to Merklemap's Search API documentation and pricing page.