{ "openapi": "3.0.1", "info": { "title": "Subdomain Takeover Checker: Dangling DNS & Service Fingerprints", "description": "Check hostnames for dangling CNAMEs and takeover-prone hosting fingerprints (GitHub Pages, Heroku, S3, Azure, Shopify, Netlify, Vercel…). Passive DNS-over-HTTPS plus a plain HTTP(S) GET. Clear verdicts, evidence snippets, bulk input, optional Certificate Transparency discovery.", "version": "0.1", "x-build-id": "AdQASRw8JZcp4Hupr" }, "servers": [ { "url": "https://api.apify.com/v2" } ], "paths": { "/acts/sysadmin-toolbox~subdomain-takeover-checker/run-sync-get-dataset-items": { "post": { "operationId": "run-sync-get-dataset-items-sysadmin-toolbox-subdomain-takeover-checker", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } }, "/acts/sysadmin-toolbox~subdomain-takeover-checker/runs": { "post": { "operationId": "runs-sync-sysadmin-toolbox-subdomain-takeover-checker", "x-openai-isConsequential": false, "summary": "Executes an Actor and returns information about the initiated run in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/runsResponseSchema" } } } } } } }, "/acts/sysadmin-toolbox~subdomain-takeover-checker/run-sync": { "post": { "operationId": "run-sync-sysadmin-toolbox-subdomain-takeover-checker", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } } }, "components": { "schemas": { "inputSchema": { "type": "object", "required": [ "hostnames" ], "properties": { "hostnames": { "title": "Hostnames / subdomains", "type": "array", "description": "Hostnames to check. One per line (comma- or space-separated lists work too). URLs and email addresses are reduced to their host (https://www.example.com/page, user@example.com). Duplicates are removed; invalid entries are listed in SUMMARY. Max 10,000 hostnames per run.", "items": { "type": "string" } }, "discoverFromCt": { "title": "Discover subdomains from Certificate Transparency", "type": "boolean", "description": "For each apex domain in the hostname list, pull additional hostnames from Certificate Transparency (Cert Spotter, with crt.sh fallback). Useful when you only know the apex and want forgotten subdomains. Cap per apex is maxSubdomainsPerDomain.", "default": false }, "maxSubdomainsPerDomain": { "title": "Max CT subdomains per apex", "minimum": 1, "maximum": 2000, "type": "integer", "description": "Only used when discoverFromCt is on. Caps how many CT names are added per apex domain.", "default": 200 }, "httpCheck": { "title": "HTTP(S) fingerprint check", "type": "boolean", "description": "GET http:// and https:// for each hostname (short timeout, small body, few redirects) and match provider 'not found / unclaimed' page fingerprints. Turn off for DNS-only dangling-CNAME checks.", "default": true }, "onlyFindings": { "title": "Only output findings", "type": "boolean", "description": "If on, the dataset only gets VULNERABLE / LIKELY / POSSIBLE / DANGLING rows. OK, NO_RECORD and ERROR are still counted in SUMMARY.", "default": false }, "concurrency": { "title": "Parallel lookups", "minimum": 1, "maximum": 100, "type": "integer", "description": "DNS-over-HTTPS and HTTP requests in flight at once.", "default": 20 }, "dnsResolver": { "title": "DNS-over-HTTPS resolver", "enum": [ "cloudflare", "google" ], "type": "string", "description": "Public resolver used for lookups. SERVFAIL, timeouts and HTTP errors are retried and then sent to the other resolver.", "default": "cloudflare" }, "timeoutSecs": { "title": "Timeout per request (seconds)", "minimum": 1, "maximum": 30, "type": "integer", "description": "Per DNS-over-HTTPS and HTTP request.", "default": 5 } } }, "runsResponseSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "id": { "type": "string" }, "actId": { "type": "string" }, "userId": { "type": "string" }, "startedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "finishedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "status": { "type": "string", "example": "READY" }, "meta": { "type": "object", "properties": { "origin": { "type": "string", "example": "API" }, "userAgent": { "type": "string" } } }, "stats": { "type": "object", "properties": { "inputBodyLen": { "type": "integer", "example": 2000 }, "rebootCount": { "type": "integer", "example": 0 }, "restartCount": { "type": "integer", "example": 0 }, "resurrectCount": { "type": "integer", "example": 0 }, "computeUnits": { "type": "integer", "example": 0 } } }, "options": { "type": "object", "properties": { "build": { "type": "string", "example": "latest" }, "timeoutSecs": { "type": "integer", "example": 300 }, "memoryMbytes": { "type": "integer", "example": 1024 }, "diskMbytes": { "type": "integer", "example": 2048 } } }, "buildId": { "type": "string" }, "defaultKeyValueStoreId": { "type": "string" }, "defaultDatasetId": { "type": "string" }, "defaultRequestQueueId": { "type": "string" }, "buildNumber": { "type": "string", "example": "1.0.0" }, "containerUrl": { "type": "string" }, "usage": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "integer", "example": 1 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 }, "PROXY_UNBLOCKER_UNITS": { "type": "integer", "example": 0 } } }, "usageTotalUsd": { "type": "number", "example": 0.00005 }, "usageUsd": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "number", "example": 0.00005 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 }, "PROXY_UNBLOCKER_UNITS": { "type": "integer", "example": 0 } } } } } } } } } }