Documentation

One API key works on all 6 endpoints. Free tier is 100 calls/day, no signup. Get a key for 1,000/day at /signup.

Authentication

Two ways to authenticate:

# 1. Authorization header (recommended)
curl https://api.sitetrace.it.com/api/shot?url=https://example.com \
  -H "Authorization: Bearer stk_your_key_here"

# 2. Query string (handy for curl)
curl "https://api.sitetrace.it.com/api/shot?url=https://example.com&key=stk_your_key_here"

If you omit the key, the request falls through to the free no-signup tier (100 calls/day per IP). All endpoints support this.

Response codes

Code	Meaning
200	Success.
400	Invalid input (bad URL, bad domain, etc.). Body is JSON with `error` and `message`.
401	Invalid or missing API key (only when one is provided).
403	Subscription is cancelled or expired. Update billing.
404	Unknown API key.
429	Quota exceeded (per IP for free, per key for paid). Body explains the limit + how to upgrade.
502	Upstream failure (crt.sh timeout, target URL fetch failed, etc.).
5xx	Our fault. Check the status page if persistent.

Endpoints

`/api/shot` — Screenshot → full page

GET /api/shot?url=https://example.com&device=desktop&width=1280&height=720&full=false&wait=0&dark=false&format=png

Returns image/png (or image/jpeg with format=jpeg). All params optional except url. Full reference.

`/api/ip` — IP Reputation → full page

GET /api/ip?ip=1.2.3.4

Returns JSON. Queries 7 DNSBLs in parallel (Spamhaus ZEN, Spamcop, Barracuda, CBL, SORBS, UCEPROTECT L1, PSBL) + ip-api.com geolocation. Composite 0–100 score, low/medium/high risk. Full reference.

`/api/email` — Email Deliverability → full page

GET /api/email?domain=example.com

Returns JSON. SPF + DKIM (probed across 20 common selectors) + DMARC + MX + BIMI. 0–100 score. Full reference.

`/api/headers` — HTTP Header Score → full page

GET /api/headers?url=https://example.com

Returns JSON. 8 security headers checked: HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, X-XSS-Protection, Server. 0–100 score, A–F grade.

`/api/preview` — URL Preview / Open Graph → full page

GET /api/preview?url=https://example.com

Returns JSON. Title, description, image, favicon, theme color, full og:* and twitter:* objects. Fetches with the Facebook crawler UA to get the most-tag-rich HTML variant.

`/api/certs` — SSL / Certificate Transparency → full page

GET /api/certs?domain=example.com&exclude=expired.example.com&limit=200

Returns JSON. Wraps crt.sh with 24h cache. List of every cert ever issued for the domain (and any subdomains). Excludes and limits optional.

Operational notes

Rate limit headers

Every authenticated response includes:

X-RateLimit-Limit: 1000
X-RateLimit-Remaining: 873
X-RateLimit-Reset: 1735689600   (unix ts of next UTC midnight)

Caching

Screenshots and SSL/CT lookups are cached at the edge (5 min and 24 h respectively). IP, email, and header lookups are no-store because the answer depends on who is asking or is too volatile to cache. The URL preview caches for 5 min.

CORS

All endpoints return Access-Control-Allow-Origin: *. OPTIONS preflights are answered with 204. Use the API directly from a browser if you want.

Status & changelog

/status — live service health, refreshed every 30s.

/changelog — what changed in each release.