Technology fingerprinting endpoint

Tech Stack Detection API

Identify the technologies powering a public website without maintaining your own detection signatures. The endpoint checks HTTP headers, meta tags, script and stylesheet URLs, HTML patterns, cookies, and DOM indicators, then returns categorized results with confidence levels and specific evidence.

Get an API key Read documentation

Web pages passing through a processing grid and becoming structured data cards

Endpoint

POST /v1/tech-stack

A working request

Set your key once in a server-side environment variable, then send a JSON request.

cURL

curl --request POST \
  --url "https://api.tooltrace.io/v1/tech-stack" \
  --header "X-ToolTrace-Key: ${TOOLTRACE_KEY}" \
  --header "Content-Type: application/json" \
  --data '{
  "url": "https://example.com",
  "render": "auto"
}'

Response scope

What the API returns

The response is structured for software, with source evidence kept beside the extracted or inspected data.

Categorized technology detections
Confidence levels with supporting evidence
CMS, framework, and library identification
Analytics and tag manager detection
CDN, hosting, and web server identification
Font, video, and security tool detection
Fetch status and response evidence

Practical uses

Lead qualification

Enrich CRM records with technology data to prioritize outreach for prospects using specific platforms, frameworks, or services.

Competitive intelligence

Track technology adoption across competitor domains to identify migration trends, vendor changes, and infrastructure decisions.

Security and compliance

Audit the client-side technology surface of your own properties or approved targets as part of vendor review and risk assessment workflows.

Implementation guidance

Use the result with context.

Detection depends on observable signals

The API matches against known patterns in HTTP responses, HTML source, script URLs, stylesheet references, and meta tags. Technologies that leave no public fingerprint or that are obscured by proxies, custom builds, or aggressive minification may not be detected.

Static detection analyzes the initial HTTP response. Browser-rendered detection executes JavaScript first, which can reveal client-side frameworks and dynamically loaded scripts at a higher credit cost.

Confidence reflects evidence strength

A detection marked high matched multiple independent signals, such as a meta generator tag and characteristic script URLs. A detection marked likely matched a single pattern that could occasionally appear in other contexts.

Use the evidence array to understand exactly which signals triggered each detection. This is useful for filtering results in automated pipelines or validating detections against your own knowledge of a domain.

Authentication, limits, and errors

Send your key through the X-ToolTrace-Key header from server-side code. Read credit and rate-limit headers after every request. Validation, blocked destination, authentication, plan, and upstream fetch errors use structured responses that applications should handle by code rather than message text.

Use a dedicated key for each environment. Review current fields in the interactive API reference and compare usage limits on the pricing page.