Technology detection API

Submit a public URL and poll for a report with evidence. HTML uploads are not required or used. Query strings and fragments are stripped; page paths are preserved.

1. Start a scan

POST /api/detect
X-API-Key: YOUR_API_KEY
Content-Type: application/json

{"url":"https://example.com/shop","mode":"quick","refresh":false}

Modes: quick, rendered, or deep. Set refresh:true to bypass the 24-hour cache. Rendered mode requires worker Chromium support; unavailable support produces an explicit failure report.

{"task_id":"…","status":"processing","access_token":"…","mode":"quick"}

API scans are private. Keep your API key and short-lived scan token secret. Use headers rather than URL query parameters.

2. Poll for completion

GET /api/task-status/TASK_ID
X-API-Key: YOUR_API_KEY

Alternatively send the returned access_token as X-Scan-Token (valid for 30 minutes). Processing returns {"status":"processing"}. A worker failure returns status:failed and an error.

{
  "status": "completed",
  "scan_status": "complete",
  "mode": "quick",
  "cached": false,
  "scanned_at": "2026-10-06T12:00:00+00:00",
  "scanner_version": "2.1.0",
  "scan_slug": "…",
  "technologies": {
    "web servers": [{"name":"nginx","confidence":"confirmed","evidence":[
      {"source":"header","value":"server: nginx","rule_id":"…","url":"https://example.com/"}
    ]}]
  },
  "pages": [{"url":"https://example.com/","status_code":200}],
  "warnings": []
}

Always inspect scan_status: complete, partial, blocked, failed, or legacy. Job completion does not guarantee complete coverage. Confidence is an evidence label, not a calibrated percentage. Version numbers are not guessed from technology names. The flat detections field also contains technology IDs, categories and evidence.

Limits and errors

API tiers: free 50/day, starter 100/day, pro 1,000/day, enterprise unlimited. Invalid targets return 400; missing/invalid API keys return 401; exhausted quotas return 429. Private reports return 404 to unauthorized viewers.

Public access

POST /api/detect-public accepts the same body without a key (10/day). POST /api/detect-extension is intended for explicit extension actions (50/hour). These guest reports are public.

Migration from older clients

Stop sending html. Confidence is now confirmed, likely, or legacy, replacing the old fixed number. Existing API-key polling is supported. Public URL normalization removes queries for privacy. Read the detection methodology.