Chaos.beta
Browse the API reference

Platforms

All platform subdomains

Every subdomain across every program on one platform, walked program by program with a cursor. Keep following meta.next_cursor until it is null to collect the complete list. Add format=txt for a plain host list (next cursor is returned in the X-Next-Cursor header).

GEThttps://chaos.thescope.top/api/v1/platforms/{slug}/subdomainsscope: read

Path parameters

slugstringrequired

Platform slug.

Query parameters

cursorstringoptional

Cursor returned as meta.next_cursor by the previous page. Omit for the first page.

limitintegeroptionaldefault 1000

Rows to return (max 10000).

programstringoptional

Filter to a single program by name — matches any program whose domain contains the text (e.g. tesla returns tesla.com subdomains only). Omit for the whole platform.

activebooleanoptionaldefault true

Set false to include hosts that are no longer seen in Chaos.

formatstringoptionaldefault json

Response format.

jsontxt

Example response

200 application/json
{ "data": [ { "host": "api.tesla.com", "domain": "tesla.com", "is_active": true } ], "meta": { "count": 1000, "next_cursor": "ZDkx…", "has_more": true } }

Errors

400invalid_bodyA POST body was missing or was not valid JSON.
400invalid_domainThe supplied domain is not a valid root domain.
400invalid_queryA required query parameter was missing or too short.
400invalid_idA path id was not a UUID.
401missing_tokenNo Authorization or X-API-Key header was sent.
401invalid_tokenThe token is malformed or unknown.
401revoked_tokenThe token was revoked by its owner.
404not_foundThe domain, platform, scan or endpoint does not exist.
404unknown_platformThe platform slug is not one of the tracked programs.
405method_not_allowedThe HTTP verb is not supported on that path.
500query_failedA database query failed while serving the request.
500server_errorAn unexpected error occurred.

Full catalogue with fixes on the errors page.

Previous

Platform domains

Next

Platform new hosts

GETTry it

Kept in this browser tab only and sent straight to this API.

https://chaos.thescope.top/api/v1/platforms/hackerone/subdomains?limit=1000&active=true&format=json
curl "https://chaos.thescope.top/api/v1/platforms/hackerone/subdomains?limit=1000&active=true&format=json" \
  -H "Authorization: Bearer chs_live_xxxxxxxxxxxx"