Yup, those branch subdomains are stored separately from the site config. However, you can still access them! Have you seen this article about reverse engineering our API? If you can see it in our UI, you can API call it:
So, looking at the branch subdomains page on the domain settings page, what is shown there is the intersection of:
all deployed branches (and PR’s), which you can get from the API call:
This will almost certainly be WAY more than is shown in our UI; that’s the AVAILABLE branch subdomains. All of them will work with the notation: branch--site.netlify.app; the only ones shown in the UI will be ones you have explicitly clicked the button (or made the API calls) to create in our UI, and those will all have DNS records associated, so if you watch our UI build that page with API calls, it also queries for DNS Records so that it can show just the intersection of “is a deployed branch” and “has a DNS record” (probably, one pointing to Netlify and/or that site, though I have not read the code to establish that).
so that call to get the DNS records seems to be:
(note that I used the placeholder “domain_com” - please format your domain like that - _ instead of . in the hostname, when making that call).
That’s about as far as we can guide you; you should be able to write the code from there to do what you want but let us know if you see anything that feels buggy or specific calls not working as you expect (vs what happens when the UI does it)