Subdomain Enumeration API — 5 sources, always-on DNS brute, never empty.

import requests

domain = "cloudflare.com"
url = f"https://domain-intelligence-api.p.rapidapi.com/domain/{domain}/subdomains"
headers = {
    "X-RapidAPI-Host": "domain-intelligence-api.p.rapidapi.com",
    "X-RapidAPI-Key": "YOUR_RAPIDAPI_KEY",
}
r = requests.get(url, headers=headers, timeout=30)
data = r.json()
print(f"Found {data['count']} subdomains")
for sub in data["subdomains"][:10]:
    print(f"  - {sub}")

// Node 18+ has built-in fetch - no import needed
const domain = "cloudflare.com";
const res = await fetch(
  `https://domain-intelligence-api.p.rapidapi.com/domain/${domain}/subdomains`,
  { headers: {
      "X-RapidAPI-Host": "domain-intelligence-api.p.rapidapi.com",
      "X-RapidAPI-Key": "YOUR_RAPIDAPI_KEY",
  }}
);
const data = await res.json();
console.log(`Found ${data.count} subdomains`);
console.log(data.subdomains.slice(0, 10));

<?php
$domain = "cloudflare.com";
$ch = curl_init("https://domain-intelligence-api.p.rapidapi.com/domain/$domain/subdomains");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_TIMEOUT, 30);
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    "X-RapidAPI-Host: domain-intelligence-api.p.rapidapi.com",
    "X-RapidAPI-Key: YOUR_RAPIDAPI_KEY",
]);
$data = json_decode(curl_exec($ch), true);
curl_close($ch);
echo "Found " . $data["count"] . " subdomains";