GET /v1/openapi.json
This OpenAPI document.
No key needed.
What any website is built with: technologies with categories, versions, confidence and the evidence that gave them away; bulk lookups; lists of sites using a technology; change history and webhooks. Every request carries an API key as Authorization: Bearer tsk_…
The OpenAPI 3.1 file is at /openapi.json: import it into Postman, Insomnia or a client generator.
Sign in at https://tellstack.onibaku.co.uk/app and copy your key. Then:
curl "https://tellstack.onibaku.co.uk/v1/lookup?domain=example.com" -H "Authorization: Bearer $TELLSTACK_KEY"
curl https://tellstack.onibaku.co.uk/v1/jobs -H "Authorization: Bearer $TELLSTACK_KEY" -H "Content-Type: text/csv" --data-binary @domains.csv
curl "https://tellstack.onibaku.co.uk/v1/technologies/shopify/sites?tld=uk&format=csv" -H "Authorization: Bearer $TELLSTACK_KEY"
A lookup costs one credit. It answers from the index when the last scan is newer than maxAge days (30 by default) and scans the site live otherwise, which takes a few seconds. maxAge=0 always scans live. Every technology comes with a version where the site shows one, a confidence from 0 to 100, and the evidence: the header, cookie, script, meta tag or DNS record that gave it away.
Bulk jobs take up to 10,000 domains as JSON or a one-per-line CSV, a credit each. Poll the job or add a webhook for job.completed, then read /v1/jobs/{id}/results as JSON or CSV.
“Sites using” lists come from our own index, most popular sites first, at a credit per 10 rows. since filters to sites first seen using it on or after a date.
Webhooks are signed with Tellstack-Signature: t=<unix time>,v1=<hex HMAC-SHA256 of "t.body">. Failed deliveries retry 8 times over about two days.
Errors are RFC 9457 problem details. Each key gets 120 requests a minute; the RateLimit-* headers say how many are left.
/v1/openapi.jsonThis OpenAPI document.
No key needed.
/v1/meThe key’s workspace, scopes and usage.
Scope: read
/v1/usageCredits and watches used this month.
Scope: read
/v1/lookupTechnologies on a domain. One credit. Served from the index when the last scan is newer than maxAge days, otherwise scanned live (a few seconds). Sites that block or challenge our crawler come back with status "blocked" and whatever DNS shows.
Scope: lookup
/v1/domains/{domain}/historyTechnologies added, removed or upgraded on a domain over time.
Scope: read
/v1/jobsYour bulk jobs, newest first.
Scope: read
/v1/jobsStart a bulk lookup. A credit per distinct valid domain, charged up front. Send JSON, or text/csv with one domain per line.
Scope: lookup
/v1/jobs/{id}A job’s progress.
Scope: read
/v1/jobs/{id}/resultsA job’s results, as JSON or CSV.
Scope: read
/v1/categoriesTechnology categories.
Scope: read
/v1/technologiesThe technologies we detect, most used first.
Scope: read
/v1/technologies/{slug}One technology, with how many indexed sites use it.
Scope: read
/v1/technologies/{slug}/sitesSites using a technology, most popular first. A credit per 10 rows returned. The free plan sees the first 25 rows; total is always the full count.
Scope: lookup
/v1/watchesYour watches.
Scope: read
/v1/watchesWatch a domain or a technology. A watched domain is rescanned weekly and fires domain.changed. A watched technology fires technology.added when a site we already knew starts using it.
Scope: watches:write
/v1/watches/{id}Stop watching.
Scope: watches:write
/v1/webhooksYour webhooks.
Scope: read
/v1/webhooksAdd a webhook. The signing secret is shown once.
Scope: webhooks:write
/v1/webhooks/{id}Remove a webhook.
Scope: webhooks:write
/v1/webhooks/{id}/deliveriesThe last 50 deliveries.
Scope: read
/v1/keysYour API keys (never the secret).
Scope: read
/v1/keysCreate a key. The key is shown once.
Scope: keys:write
/v1/keys/{id}/rotateRotate a key: a new one now, the old one expires after graceHours (default 24).
Scope: keys:write
/v1/keys/{id}Revoke a key now.
Scope: keys:write