Developer Tools

Passive OSINT & Recon API API

The Passive OSINT & Recon API returns passive subdomain and infrastructure discovery as clean JSON.

4 actionsLive JSON1,000 free creditsMCP-ready

🤖 Using an AI assistant? Copy this link into ChatGPT / Claude / Cursor — it reads every endpoint and parameter instantly and tells you if this API fits your use case.

The primary subdomains endpoint returns a domain's discovered subdomains (sorted and unique), a per-source matrix, per-source status and a coverage summary — all from passive sources, with no active scanning. You can also enrich a domain or an IP and batch many targets. It is built for security research, attack-surface mapping and recon workflows that need passive OSINT without running intrusive scans. One ReefAPI key, one shared credit pool, the standard envelope.

Live example

Real request and response JSON

Captured from the indexed primary action, subdomains, on Jul 18, 2026, 5:19 PM UTC.

Captured request

{
  "method": "POST",
  "url": "https://api.reefapi.com/passive-osint/v1/subdomains",
  "headers": {
    "x-api-key": "$REEF_KEY",
    "content-type": "application/json"
  },
  "body": {
    "domain": "hackerone.com"
  }
}

Captured response

{
  "ok": true,
  "meta": {
    "api": "passive-osint",
    "endpoint": "subdomains",
    "mode": "live",
    "latency_ms": 18034.7,
    "record_count": 11,
    "bytes": 8920,
    "cache_hit": false,
    "sources_succeeded": [
      "certspotter",
      "hackertarget"
    ],
    "capped": false
  },
  "data": {
    "domain": "hackerone.com",
    "subdomains": [
      "a.ns.hackerone.com",
      "api.hackerone.com",
      "b.ns.hackerone.com"
    ],
    "count": 11,
    "source_matrix": {
      "hackerone.com": [
        "certspotter"
      ],
      "api.hackerone.com": [
        "certspotter",
        "hackertarget"
      ],
      "support.hackerone.com": [
        "certspotter",
        "hackertarget"
      ],
      "www.hackerone.com": [
        "certspotter",
        "hackertarget"
      ],
      "mta-sts.hackerone.com": [
        "certspotter",
        "hackertarget"
      ],
      "gslink.hackerone.com": [
        "certspotter",
        "hackertarget"
      ],
      "mta-sts.forwarding.hackerone.com": [
        "certspotter",
        "hackertarget"
      ],
      "mta-sts.managed.hackerone.com": [
        "certspotter",
        "hackertarget"
      ],
      "docs.hackerone.com": [
        "certspotter",
        "hackertarget"
      ],
      "a.ns.hackerone.com": [
        "hackertarget"
      ],
      "b.ns.hackerone.com": [
        "hackertarget"
      ]
    },
    "sources": {
      "crtsh": {
        "ok": false,
        "count": 0,
        "note": "source timed out after 18s (slow upstream — partial result returned)"
      },
      "certspotter": {
        "ok": true,
        "count": 9,
        "note": null
      },
      "otx": {
        "ok": false,
        "count": 0,
        "note": "source timed out after 18s (slow upstream — partial result returned)"
      },
      "hackertarget": {
        "ok": true,
        "count": 10,
        "note": null
      },
      "wayback": {
        "ok": false,
        "count": 0,
        "note": "source timed out after 18s (slow upstream — partial result returned)"
      }
    },
    "coverage_note": "Passive discovery aggregates public CT logs, passive-DNS and archive indexes. It is inherently PARTIAL and the passive ecosystem is FRAGMENTED — each source samples a different slice (live measurement: independent aggregators and our sources overlap only partially), so aggregating many sources maximises coverage but CANNOT claim a complete inventory. Active brute-force/zone-transfer would be needed for completeness and is out of scope. Sources that returned data: certspotter, hackertarget."
  }
}

Actions

What the Passive OSINT & Recon API API does

Action	Description	Concrete use case	Key params
subdomains	Passive subdomain discovery across crt.sh + certspotter + OTX + hackertarget + Wayback, deduped, with a per-source matrix and an honest coverage note	Ops teams call subdomains to get passive subdomain discovery across crt.sh + certspotter + OTX + hackertarget + Wayback, dedup….	domain, sources
domain	One-call unified passive report: subdomains + DNS summary + SSL summary + archive first/last-seen + threat blocklist flags, each section degrading independently	Developer tools call domain to get one-call unified passive report.	domain, sources, include_pii
ip	Passive IP enrichment: rDNS (PTR) + ASN/org/country (Team-Cymru + RDAP) + threat blocklist flags + shared-host neighbours (reverse-IP + OTX IPv4 passive-DNS)	Validation workflows call ip to get passive IP enrichment.	ip, include_pii
batch	Compact passive report (subdomain count+list, DNS, threat, archive-first-seen) across up to 10 domains in one call	Data-quality teams call batch to get compact passive report (subdomain count+list, DNS, threat, archive-first-seen) across up to 1….	domains

Code samples

Call subdomains from your stack

curl -X POST https://api.reefapi.com/passive-osint/v1/subdomains \
  -H "x-api-key: $REEF_KEY" \
  -H "content-type: application/json" \
  -d '{"domain":"hackerone.com"}'

import requests

r = requests.post(
    "https://api.reefapi.com/passive-osint/v1/subdomains",
    headers={"x-api-key": REEF_KEY},
    json={
  "domain": "hackerone.com"
},
)
print(r.json()["data"])

const res = await fetch("https://api.reefapi.com/passive-osint/v1/subdomains", {
  method: "POST",
  headers: {
    "x-api-key": process.env.REEF_KEY,
    "content-type": "application/json",
  },
  body: JSON.stringify({
  "domain": "hackerone.com"
}),
});
const { ok, data, meta, error } = await res.json();

MCP one-liner

Ask your MCP-connected assistant: call reefapi.passive-osint.subdomains with {"domain":"hackerone.com"}.

Use cases

Who uses this API and why

Security teams call subdomains to map an organization's external attack surface passively.
Recon workflows use domain and ip to enrich a target with infrastructure context.
Threat-intel tools use batch to run passive discovery across many domains at once.

FAQ

Questions developers ask before integrating

What is the Passive OSINT & Recon API API?

Passive OSINT & Recon API API is a ReefAPI endpoint group for passive osint & recon api It returns live JSON through POST requests under /passive-osint/v1.

Is the Passive OSINT & Recon API API free to try?

Yes. ReefAPI starts with 1,000 free credits, no card required. Passive OSINT & Recon API calls use the same shared credit balance as every other ReefAPI engine.

Do I need a Passive OSINT & Recon API login or account?

No login to Passive OSINT & Recon API is needed for the API response. You call ReefAPI with your x-api-key header, and the playground can run live examples before you create a production key.

How fresh is the Passive OSINT & Recon API data?

The page example is captured from a live subdomains call, and production requests fetch live data through ReefAPI rather than a static sample.

How many credits does the Passive OSINT & Recon API API use?

Passive OSINT & Recon API actions currently cost 1-3 credits per successful call. Failed or blocked calls are free, and all APIs draw from one credit pool.

Can I call Passive OSINT & Recon API from an AI assistant or MCP client?

Yes. Connect ReefAPI once through MCP and your assistant can call passive-osint actions with the same key, credit pool and JSON envelope used by normal REST requests.

Is the Passive OSINT & Recon API API a Passive OSINT & Recon API scraper?

It is the managed alternative to a DIY Passive OSINT & Recon API scraper. Instead of building and maintaining your own scraper — proxies, headless browsers, captcha and constant breakage — you call one ReefAPI endpoint and get the same passive osint & recon api back as clean JSON.

Why does my Passive OSINT & Recon API scraper keep getting blocked?

Most Passive OSINT & Recon API scrapers break on anti-bot defenses, rate limits and IP bans that need rotating residential proxies and browser fingerprinting to clear. ReefAPI handles all of that for you — no proxies, no captchas, no maintenance — and returns live JSON. Blocked or failed calls are free.

docs / passive-osint

Passive OSINT & Recon API

base /passive-osint/v14 endpoints

post/passive-osint/v1/subdomains2 credits

Passive subdomain discovery across crt.sh + certspotter + OTX + hackertarget + Wayback, deduped, with a per-source matrix and an honest coverage note

Parameter		Allowed / range	Description
domain	required	—	The registrable domain to enrich (a bare host like example.com; a full URL or leading www. is accepted and normalized). NOT a person.
sources	optional	crtsh · certspotter · otx · hackertarget · wayback	Which passive sources to query (comma-separated string or array). Defaults to all five. Unknown names are ignored.

Try in playground →

post/passive-osint/v1/domain3 credits

One-call unified passive report: subdomains + DNS summary + SSL summary + archive first/last-seen + threat blocklist flags, each section degrading independently

Parameter		Allowed / range	Description
domain	required	—	The registrable domain to enrich (a bare host like example.com; a full URL or leading www. is accepted and normalized). NOT a person.
sources	optional	crtsh · certspotter · otx · hackertarget · wayback	Which passive sources to query (comma-separated string or array). Defaults to all five. Unknown names are ignored.
include_pii = false	optional	—	If true, reveal the RDAP abuse mailbox / contact email. Default false → contact emails are masked (R17 privacy hygiene).

Try in playground →

post/passive-osint/v1/ip1 credit

Passive IP enrichment: rDNS (PTR) + ASN/org/country (Team-Cymru + RDAP) + threat blocklist flags + shared-host neighbours (reverse-IP + OTX IPv4 passive-DNS)

Parameter		Allowed / range	Description
ip	required	—	A single IPv4 address to enrich (rDNS + ASN/org/country + threat + shared-host neighbours).
include_pii = false	optional	—	If true, reveal the RDAP abuse mailbox / contact email. Default false → contact emails are masked (R17 privacy hygiene).

Try in playground →

post/passive-osint/v1/batch3 credits

Compact passive report (subdomain count+list, DNS, threat, archive-first-seen) across up to 10 domains in one call

Parameter		Allowed / range	Description
domains	required	—	Up to 10 domains. A JSON array or a comma/space/newline-separated string. Each gets a compact passive report.

Try in playground →

Example request · subdomains

curl -X POST https://api.reefapi.com/passive-osint/v1/subdomains \
  -H "x-api-key: $REEF_KEY" \
  -H "content-type: application/json" \
  -d '{"domain":"hackerone.com"}'

Response shape

{
  "ok": true,
  "data": { /* the result */ },
  "meta": {
    "latency_ms": 240,
    "record_count": 12,
    "completeness_pct": 100
  },
  "error": null
}