You can use a HTTP debugger like fiddler2 to analyze the web service and remote procedure calls that SharePoint Designer makes to find this out.
For example, to get the available list templates, SPD makes an HTTP request using the DisplayPost RPC command, e.g.
POST http://[server]/[web]/_vti_bin/owssvr.dll?Cmd=DisplayPost
with an xml payload of:
<?xml version="1.0" encoding="UTF-8"?>
<ows:Batch OnError="Return" Version="12.0.0.000">
<Method ID="0,GetProjSchema">
<SetVar Name="Cmd">GetProjSchema</SetVar>
</Method>
</ows:Batch>
SPD then parses the ListTemplates node in the response to obtain a list of template names, types, and feature IDs.
To create the list from a specific template type or feature ID, SPD uses the same DisplayPost command, this time with a message body similar to:
<?xml version="1.0" encoding="UTF-8"?>
<ows:Batch OnError="Return" Version="12.0.0.000">
<Method ID="0,NewList">
<SetVar Name="Cmd">NewList</SetVar>
<SetVar Name="ListTemplate">108</SetVar>
<SetVar Name="Title">Discussion Board</SetVar>
<SetVar Name="FeatureId">00bfea716a4943fab535d15c05500108</SetVar>
<SetVar Name="RootFolder" />
<SetVar Name="LangID">1033</SetVar>
</Method>
</ows:Batch>
For an example of how to use the RPC protocol see this post on uploading files to a SharePoint document library (it uses the author.dll rather than the owssvr.dll, but the technique is similar).