Detect the full technology stack of any website. JSON over HTTPS, instant cache-first responses, no setup required for the free tier.
One-click import. Pre-configured environment variables (baseUrl, domain, apiKey) and an auto-store login script.
All endpoints are served over HTTPS at https://api.stack-spy.com. The free tier requires no authentication — just call GET /scan?domain=... and you are done.
The free tier is anonymous — no key required. Authenticated calls (Bearer JWT) unlock BuiltWith-powered insights and watchlist features. Get a token by calling POST /auth/login.
The core of Stack Spy. Returns the technology stack of any public domain. Cache-first: if the domain has been scanned within the last 30 days, you get an instant response (~50 ms).
Scan a domain. Cache-first, then triggers a fresh scan in the background if needed.
stripe.com. Protocol prefix and path are stripped automatically.ultrafast | fast (default) | full. Controls scan depth and BuiltWith inclusion.true, bypasses the 30-day cache. Use sparingly.Inspect a cached scan without triggering a new one. Returns 404 if the domain has never been scanned.
Returns the latest cached technologies for {domain}, or 404.
Aggregate statistics over the public Stack Spy index. Useful for trend reports and comparison dashboards.
Returns the frequency of each technology category across all indexed domains.
Create an account, log in, and inspect the current user. Login returns a JWT to use as Bearer token.
Create an account with email + password. Returns a JWT.
Returns a JWT. Use it as Authorization: Bearer … on subsequent calls.
Returns the authenticated user profile. Requires Bearer token.
Track domains and get notified when their stack changes. Requires a JWT.
Add a domain to your watchlist. Body: { "domain": "stripe.com" }.
List all domains you are currently watching.
Watch status & latest change diff for a single domain.
All responses are JSON, UTF-8 encoded. Successful scans look like this:
Standard HTTP status codes. Errors include a JSON body with a detail field describing the problem.
| Status | Meaning |
|---|---|
200 | OK — scan or lookup succeeded. |
400 | Bad request — missing or invalid parameter (usually domain). |
401 | Unauthorized — Bearer token missing, invalid, or expired. |
404 | Not found — usually a cache lookup with no matching scan. |
429 | Rate limited — slow down. The free tier allows 30 calls/minute per IP. |
502 | Upstream scanner error — retry in a few seconds with exponential backoff. |
/scan is capped at 30 requests/minute and 200 requests/hour per IP on the free tier. Authenticated accounts get higher limits — contact us for enterprise quotas.