Does this run browser JavaScript?
No. Detection is a single bounded HTTP fetch plus a static signature catalog. Browser-rendered stacks may be under-reported.
Tech Stack Detection API
Passive fetch
Evidence
SSRF-safe
One domain. An explainable stack.
Detect publicly visible technologies from a single page fetch. Confidence, evidence, and categories without a commercial data-provider key.
38 · signatures2 MB · body cap12s · timeoutCache · 15 min
Detect a public stack.
This calls GET /detect against an allowlisted domain. Click to run. Production accepts any public hostname.
Request builder
Allowlisted domains only. No freeform hosts.
GET /detect
Output preview
Live response from the API, plus the exact request to reproduce it.
domain: datpaq.comcount: n/a
Run the request to list detected technologies.
Why Tech Stack Detection API
Public signals, not a crawl.
Passive signatures
HTML, meta tags, script URLs, link URLs, and response headers against a static catalog.
Evidence on every hit
Each technology includes evidence strings so you can tell a direct match from an implied one.
Category counts
Results include a category map for CMS, frameworks, analytics, and more.
SSRF-guarded fetch
Private networks, unsafe redirects, and DNS rebinding destinations are blocked.
Short page cache
Successful pages stay in process for about 15 minutes so repeat lookups stay cheap.
No JS execution
v1 does not run a browser. Client-only stacks can be under-reported by design.
/api/v1/tech-stack-detection
Endpoints, at a glance.
One GET detect route: pass a domain, optionally a same-host page URL, and receive an explainable technology list.
GET/api/v1/tech-stack-detection/detect
Detect stack
Required domain, optional same-host url. Returns technologies, evidence, and category counts.
| Parameter | Type | Required | Description |
|---|---|---|---|
| domain | string | yes | Hostname or URL to analyze, 3 to 253 characters. |
| url | string | no | Same-host HTTP or HTTPS page URL. Defaults to the domain root. |
Error reference
Failures you can plan for.
Failures include a machine-readable reason such as ssrf-blocked.
400Validation Error
Invalid domain or URL mismatch. Rejected before fetch.
401Authentication Error
Missing or invalid gateway API key. Send x-api-key or api_key with every request.
403SSRF Blocked
Unsafe target or redirect. Outbound destination blocked.
413Response Too Large
Body exceeds 2 MB.
429Rate Limit Error
More than 120 requests in a 15-minute window.
502Upstream Error
Fetch timeout, error, or non-success status.
Example error response
{
"success": false,
"error": { "code": "SSRF_BLOCKED", "message": "URL blocked by SSRF policy" },
"reason": "ssrf-blocked",
"correlationId": "req_abc123"
}FAQ
API questions developers ask first.
Can I pass a full page URL?
Yes. url is optional and must stay on the same host as domain. If omitted, the service fetches the domain root.
How large is the catalog?
v1 ships a static 38-signature catalog. Results are sorted by confidence and include evidence so you can tell direct signals from implied technologies.
Is outbound fetching SSRF-safe?
Yes. DNS results are validated, private destinations are blocked, redirects are rechecked, and bodies cap at 2 MB with a 12 second timeout.
How do I authenticate requests?
Send your Datpaq API key as an x-api-key header or an api_key query parameter. Keys are created in the Datpaq dashboard and a free tier is included.
Turn a domain into a technology profile.
Passive, SSRF-safe detection with confidence, evidence, and category counts for enrichment and research.