Sonar API

Development / No Auth Required Beginner HTTPS CORS
Free to Use Varies (check documentation)

Overview

Sonar provides a fast DNS enumeration API built on Project Sonar's large passive DNS dataset, allowing you to look up subdomains associated with any domain. It is useful for security researchers and developers doing reconnaissance or asset discovery. No authentication is needed to use the public Sonar API endpoint.

Beginner Tip

Query the /subdomains/ endpoint with your target domain to retrieve a list of known subdomains from the passive DNS database — useful for mapping attack surfaces during security research.

Available Data

Sonar data via REST API

Example Response

JSON Response
{
  "status": "success",
  "data": {
    "result": "Data from Sonar",
    "description": "Project Sonar DNS Enumeration API",
    "timestamp": "2025-01-15T10:00:00Z"
  }
}

Field Reference

[] (array of strings) A flat array of subdomain strings found for the queried domain

Implementation Example

Request
const url = "https://github.com/Cgboal/SonarSearch";
const response = await fetch(url);
if (!response.ok) throw new Error(`Request failed: ${response.status}`);
const data = await response.json();
console.log(data);

What Can You Build?

Note: These code examples are AI-generated and unverified. Always refer to the official API documentation for accurate usage.

Common Errors & Troubleshooting

404 Not Found The domain has no records in the Sonar dataset
The dataset covers common domains; uncommon or new domains may return no results — this is expected behavior
Empty array [] No subdomains indexed for the queried domain
Try a well-known domain like github.com to verify the API is working, then accept that your target may have no indexed data
Connection timeout The public Sonar endpoint can be intermittently unavailable
Retry after a few minutes; consider self-hosting using the open-source SonarSearch repository on GitHub for reliability

Metadata Score Breakdown

Estimated from metadata — endpoint not independently tested

This score is estimated from observable metadata — HTTPS support, authentication model, declared CORS, and documentation reachability — because the API requires authentication or exposes no publicly testable endpoint. The five-signal breakdown is only shown for live-tested APIs.

Metadata estimate · endpoint not independently tested

Technical Specifications

Auth No Auth
HTTPS REQUIRED
CORS YES
Category Development
Difficulty Beginner
Verified: 2026-04-04

Related Tags

Similar APIs

View All →