issued.live paid plans are open: Basic $39, Plus $99, Pro $199
Paid plans are open on issued.live today: Basic at $39 a month, Plus at $99 and Pro at $199. Basic reads the extended record on the website and takes the daily files. Plus opens the keyed lookups, and Pro adds the sweeps that run across the corpus.
issued.live reads the public Certificate Transparency logs, resolves DNS from seven vantage points and loads ICANN zone files. It observes third-party infrastructure and operates none of it.
Free covers the public record for any domain with no account and no key: certificate, issuer, expiry, hosting address and current DNS. The cap is 1,000 requests a day per client address, resetting at 00:00 UTC.
Two boundaries separate the three paid plans. One runs between the website and the API. The other is how many heavy queries you may hold open at once.
Website access against API access
Basic, at $39 a month
Basic runs at 60 requests a minute with no daily cap, and carries the domains and dns daily files in csv.zst and json.zst. Every dataset has a sample row on the download catalog.
Basic also opens the extended record on the website for any domain you look up. That is certificate internals, DNS per vantage point and the full address history on the page, plus registration and expiry dates and the registrar. The domain timeline sits there too, every dated event in order.
Its keyed surface ends there. The advanced queries start at Plus.
Plus, at $99 a month
Plus runs at 300 requests a minute and moves those same answers onto your key. It suits a hunter working one lead at a time: an address, a certificate, a name.
Reverse IP and CIDR return every hostname our resolvers have recorded answering at an address or a range. Each row carries first_seen, last_seen and an observed count.
Pivots by certificate, SPKI or JA4X return the other names on a certificate and everything sharing a public key. The extended record and the domain timeline come by API as well, the timeline carrying gap_seconds on each event.
Plus takes the same two daily files as Basic, and runs one advanced query at a time.
Concurrency: how many sweeps run at once
Pro, at $199 a month
Pro runs at 1,200 requests a minute and adds the sweeps. Pattern search runs a name grammar across the corpus, and batch lookup answers up to 500 domains in one call. The provisioning feed and the newly registered domains feed are both cursor-paged.
Pro also takes the dns_vantage, certificates and address_history datasets as daily files, and runs two advanced queries at once.
What takes a concurrency slot
Advanced queries are bounded by how many run at once on your key: one on Plus, two on Pro. The per-minute ceiling meters the public record API instead.
Five endpoints take a slot: reverse IP, range, pattern search, batch lookup and the provisioning feed. The certificate, key, domain and newly-registered-domain endpoints are point lookups and take none. The slot is yours alone.
Why the gate sits there
The cost of a range query is the reason. A cold reverse-IP range can read hundreds of millions of rows and hold its database connection for the better part of 18 seconds. Enough of those at once would exhaust the connection pool and stall every other request on the site.
A request over the gate waits five seconds for a slot and then returns 503 timeout rather than queueing. An unbounded queue would turn one slow query into a pile-up, with every request holding a connection until they all expire together.
A range covers at most 256 addresses, an IPv4 /24, for the same reason. A CIDR expands into its individual addresses, so the address count is the query's cost.
The four plans side by side
| Capability | Free | Basic | Plus | Pro |
|---|---|---|---|---|
| Price a month | $0 | $39 | $99 | $199 |
| Rate | 1,000 a day per address | 60 a minute | 300 a minute | 1,200 a minute |
| Public record for one domain | Yes | Yes | Yes | Yes |
| Extended record and timeline on the website | No | Yes | Yes | Yes |
| Extended record and timeline by API | No | No | Yes | Yes |
| Reverse IP, CIDR and the key pivots | No | No | Yes | Yes |
| Pattern search, batch lookup and the feeds | No | No | No | Yes |
| Daily files | None | domains, dns | domains, dns | all five datasets |
| Full weekly snapshot | No | Its datasets | Its datasets | All five |
| Advanced queries in flight | None | None | One | Two |
| Published SHA-256 checksums | Yes | Yes | Yes | Yes |
| Ad-free pages, sign-in and billing | No | Yes | Yes | Yes |
Every paid plan includes a full weekly snapshot of the datasets it covers, for seeding a new system before the daily deltas take over. The checksums stay unkeyed on every plan, Free included, so a file you already hold can be verified without an account.
What a keyed call looks like
Authentication is a bearer token in an Authorization header. There is no key parameter on the query string, because query strings land in access logs, proxy logs and browser history.
curl -sS "https://issued.live/api/v1/range/157.240.17.0-24?limit=5000&after=" \ -H "Authorization: Bearer YOUR_KEY"
Write the CIDR prefix slash as a hyphen. A literal slash is a path separator and will not route.
Reading the response
The limit parameter defaults to 500 and tops out at 50000, and an out-of-range value is clamped. truncated:true is what tells you rows remain.
Pagination is the after cursor. Send ?after= empty to begin, then pass back each response's next_cursor, whose absence ends the walk. page, offset, skip and cursor each answer 400, after a spell when all four were accepted and ignored.
Each hosts[] row carries the hostname, its registrable domain, the address, first_seen, last_seen and observed. Set format=ndjson to stream one object per line, which also happens automatically at a limit of 5000 or more.
Bounding the window server-side
first_seen_from and first_seen_to filter on first-observation time at the server, and either bound may be sent alone. They take RFC3339, "YYYY-MM-DD HH:MM:SS", "YYYY-MM-DD" or unix seconds, and no zone means UTC. A malformed or reversed window answers 400.
The reasoning for treating those two parameters differently is published in the Pro API reference: "A limit is a preference, so we clamp it and answer the question you meant. A timestamp asserts which rows you want, and substituting a different window is how you end up with a gap you cannot see."
Why the other limits sit where they do
The free daily cap is sized for an interactive visitor or a small script. It stops one scraper monopolizing a backend everyone shares.
The per-minute ceilings smooth bursts, and they point at the files. Paging an API for the whole corpus is slower for you and more expensive for us than one download.
File downloads run one per file per day, shared between the download page and your key, and that allowance resets at 00:00 UTC. Each file is generated once a day, and re-downloading the same one is the main way bulk access gets expensive.
If a limit blocks legitimate work, tell us. These are sized to protect the service, and we would rather adjust one than lose the use case.
Who should stay on Free
Anyone reading a handful of domains a day from a shell is served by Free. The daily cap covers an interactive visitor and most small scripts, and there is no key to manage.
Anyone asking what a certificate looked like in 2019 should use crt.sh, which answers that for nothing. Our queryable certificate window is 14 days.
Registrant contact details and long whois histories sit elsewhere too, and we collect neither. The comparison page weighs this service against AllZonefiles.io, Domains-Monitor, WhoisXML API and crt.sh, and says where each of them wins.
How long each dataset is kept
Certificate detail is queryable for 14 days and then ages out of the database. The daily certificates file that recorded it is archived permanently, and that archive starts with the files for September 17, 2026.
The 14-day window is a decision about interaction. It covers the moment a hunter first finds a name and wants SANs, SPKI, JA4X and the hashes on screen. A month-old certificate is archival research, and a file serves that better.
The window is short because of what certificates cost to store. Three 32-byte hashes come to 42% of that table at roughly 10 GiB each, and hashes resist compression, so the bill grows in a straight line with the window. A 13-month hot window was costed at about 3.6 TB and declined.
DNS change history runs 18 months, because age and value move in opposite directions in a change log. Registration data, address history and the reverse-IP index have no expiry. The about page carries the full retention table.
Billing and sign-in
Billing is monthly through PayPal. There is no password: you sign in with a code sent to your email, then manage your key and billing from the same page.
Cancel any time in PayPal and the billing page follows within minutes. Access runs to the end of the period you have paid for. The feature matrix and the subscribe buttons are on pricing.
Daniel Jones checked every price, rate, limit and capability above against issued.live's own pricing, about, compare and downloads pages on September 18, 2026. The API mechanics come from the Pro API reference, last updated September 15, 2026, and he reviewed the post before publication. More about the author.
