TechSpy API

Quickstart

1. 1

   Generate a key on the API settings page (Plus or Max plan).

2. 2

   Send a POST to /api/analyze with your key in the Authorization header.

3. 3

   Read the JSON — tech_stack is grouped by category, each finding named and versioned.

curl -X POST https://techspy.hi-daniel.com/api/analyze \
  -H "Authorization: Bearer ts_YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://stripe.com",
    "static_analysis": true,
    "dns_scan": true,
    "subdomain_analysis": true
  }'

Authentication

Every request is authenticated with a Bearer API key. Keys are prefixed ts_, generated on the API settings page, and available on the Max plan. The key is shown once at creation — store it securely; only a hash is kept on our side.

Authorization: Bearer ts_YOUR_API_KEY

Regenerating a key invalidates the old one immediately. If a key leaks, revoke it from the settings page.

POST /api/analyze

There is a single endpoint. Which stages run is controlled entirely by the boolean flags in the body — so one call can be a fast tech-stack read or a full deep audit.

Parameters

JSON body. Only url is required; every stage flag defaults off except static_analysis.

Response

200 OK with the analysis. Sections beyond tech_stack only appear when their flag was set. Each finding carries a confidence marker; a blocked scan is reported honestly in warnings rather than faked.

{
  "url": "https://stripe.com",
  "status": "completed",
  "analyzed_at": "2026-07-07T18:20:04.512Z",
  "tech_stack": {
    "Framework": [{ "name": "Next.js", "version": "14" }],
    "Hosting & CDN": [{ "name": "Cloudflare" }],
    "Analytics": [{ "name": "Segment" }],
    "Payment": [{ "name": "Stripe" }]
  },
  "dns": {
    "cdn": "Cloudflare",
    "dns_provider": "Cloudflare",
    "email_provider": "Google Workspace",
    "tls_issuer": "Let's Encrypt",
    "email_security": { "spf": "pass", "dmarc": "reject" },
    "scorecard": { "grade": "A", "overall": 92, "security": 88 }
  },
  "subdomains": [{ "hostname": "dashboard.stripe.com" }],
  "layers": { "app": { "label": "Application", "subdomains": ["dashboard.stripe.com"] } },
  "api_domains": [],
  "pages_analyzed": ["stripe.com"],
  "warnings": null,

  "static_analysis": true,
  "dns_scan": true,
  "subdomain_analysis": true,
  "deep_scan": false,
  "interact": false
}

Rate limits & tiers

API calls draw on the same allowances as the app. Every response includes an X-RateLimit-Remaining header.

Over a limit, the API returns 402 with a message — any credits consumed on a rejected call are refunded automatically.

Errors

Errors return a JSON body of the form { "error": "…" } with the status below.

Account & saved scans

Check your budget before scanning, then read back saved scans and their strategy analysis. None of these use credits.

curl https://techspy.hi-daniel.com/api/account \
  -H "Authorization: Bearer ts_YOUR_API_KEY"

{
  "email": "you@company.com",
  "tier": "plus",
  "api_access": true,
  "daily_scans": { "limit": 30, "used": 4, "remaining": 26, "resets_at": "2026-10-01T00:00:00.000Z" },
  "credits": { "deep_scan": 9, "interact": 5 }
}

null limit / remaining means unlimited (Max).

Automation endpoints

Beyond the scan endpoint, these power the Zapier triggers and let you pull report feeds, sync saved scans, and manage domain monitoring directly with your API key.

curl https://techspy.hi-daniel.com/api/zapier/reports \
  -H "Authorization: Bearer ts_YOUR_API_KEY"

curl https://techspy.hi-daniel.com/api/zapier/scans \
  -H "Authorization: Bearer ts_YOUR_API_KEY"

curl https://techspy.hi-daniel.com/api/zapier/watches \
  -H "Authorization: Bearer ts_YOUR_API_KEY"

curl -X POST https://techspy.hi-daniel.com/api/zapier/watches \
  -H "Authorization: Bearer ts_YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://stripe.com"}'

curl -X DELETE "https://techspy.hi-daniel.com/api/zapier/watches?id=wch_1a2b3c" \
  -H "Authorization: Bearer ts_YOUR_API_KEY"

curl "https://techspy.hi-daniel.com/api/zapier/changes?type=tech" \
  -H "Authorization: Bearer ts_YOUR_API_KEY"

MCP for AI agents

TechSpy runs as a remote MCP server so Claude Code, Cursor and other agents can scan sites and read results as native tools. It uses Streamable HTTP at https://techspy.hi-daniel.com/api/mcp and your API key — same daily scans and credits as the REST API. See what agents can do with it.

Claude Code

claude mcp add --transport http techspy https://techspy.hi-daniel.com/api/mcp \
  --header "Authorization: Bearer ts_YOUR_API_KEY"

Cursor (~/.cursor/mcp.json)

{
  "mcpServers": {
    "techspy": {
      "url": "https://techspy.hi-daniel.com/api/mcp",
      "headers": { "Authorization": "Bearer ts_YOUR_API_KEY" }
    }
  }
}

Any client that supports remote Streamable HTTP servers with a custom header works the same way. The key is also accepted without the Bearer prefix or as an x-api-key header.

Out of scans or credits, a tool returns the API's 402 message unchanged so the agent can tell you why.

Command-line (CLI)

The techspy CLI wraps the same API for terminals, scripts and coding agents. Node 18+, no install needed with npx.

export TECHSPY_API_KEY=ts_YOUR_API_KEY     # or: npx techspy login

npx techspy scan stripe.com
npx techspy scan stripe.com --dns --subdomains --json
npx techspy account
npx techspy scans list
npx techspy analysis <scan-id> --generate

--json prints machine-readable output, and exit codes tell agents what happened without parsing text: 3 invalid key, 4 out of scans or credits (402), 5 rate limited, 6 not found.

Use with Zapier (no app required)

You don't need a published Zapier integration to automate TechSpy. Add a Webhooks by Zapier → Custom Request action and point it at the endpoint with your key:

Method:  POST
URL:     https://techspy.hi-daniel.com/api/analyze
Headers: Authorization | Bearer ts_YOUR_API_KEY
         Content-Type  | application/json
Data:    { "url": "{{trigger.domain}}", "dns_scan": true }

Map any field from an earlier Zap step into url, and use the returned JSON in later steps.

Prefer the native integration? The TechSpy for Zapier guide covers all 5 triggers and 9 actions, including domain-change monitoring.