# Technology Lookup API URL: https://www.deepinfo.com/data-api/apis/technology-lookup/ ## Detect a Site’s Technologies With CPE Names Attached. The Technology Lookup API takes a URL, loads the site in real time and detects what it runs on, from CMS and JavaScript libraries to CDN and analytics. Each technology comes back with its categories, its version when the site reveals it, and a CPE name. [Talk to us about access](https://www.deepinfo.com/contact/?topic=data-api) [Technology reference](https://docs.deepinfo.com/reference/lookup/technology/) ### Fingerprint a URL Down to Its Technologies. Each URL the page loaded comes back under `urls` with its HTTP status, so you can see exactly what was fingerprinted. GET `https://api.deepinfo.com/v1/lookup/technology` [Reference](https://docs.deepinfo.com/reference/lookup/technology/) | Parameter | Type | | Description | | --- | --- | --- | --- | | `url` | string | Required | The website to analyze, as a full URL with its scheme. | Request curl: ```bash curl "https://api.deepinfo.com/v1/lookup/technology?url=https://www.deepinfo.com" \ -H "apikey: YOUR_API_KEY" ``` Python: ```python import requests r = requests.get( "https://api.deepinfo.com/v1/lookup/technology", params={"url": "https://www.deepinfo.com"}, headers={"apikey": "YOUR_API_KEY"}, ) for t in r.json()["technologies"]: print(t["name"], t["categories"], t["version"], t["cpe"]) ``` JavaScript: ```javascript const url = encodeURIComponent('https://www.deepinfo.com') const r = await fetch( `https://api.deepinfo.com/v1/lookup/technology?url=${url}`, { headers: { apikey: 'YOUR_API_KEY' } } ) const { technologies } = await r.json() for (const t of technologies) console.log(t.name, t.cpe) ``` Response 200 OK · application/json ```json { "urls": { "https://www.deepinfo.com/": { "status": 200 } }, "technologies": [ { "slug": "cloudflare", "name": "Cloudflare", "categories": ["CDN"], "confidence": 100, "version": "", "clean_version": null, "cpe": "cpe:/a:deepvendor:cloudflare", "…": "description, alternative_cpe_names, website, icon" }, { "slug": "google-font-api", "name": "Google Font API", "categories": ["Font scripts"], "confidence": 100, "…": "…" } ], "connection_status": "success", "version": 1, "check_date": "2026-09-23T14:45:13.348Z" } ``` ### From a Fingerprint to a CVE. A technology name is useful to a person. A CPE name is useful to a vulnerability database, because CVE records list the products they affect as CPE ranges. Each detected technology carries one, which is how Deepinfo matches what a site runs to the CVEs that affect it. [Vulnerability Finder](https://www.deepinfo.com/data-api/apis/vulnerability-finder/) runs that whole chain from a URL in one call. The chain ``` # 1. What does the site run? GET /v1/lookup/technology?url=… → technologies[].cpe # 2. Which CVEs affect it? GET /v1/discovery/vulnerability-finder?url=… # 3. How urgent is each one? GET /v1/discovery/vulnerability-detail?cve=… → CVSS, EPSS, CISA KEV, CWE ``` 1. What the site runs, as CPE names 2. Which CVEs affect it 3. How urgent each one is ### What Each Field Tells You. | Field | Meaning | | --- | --- | | `technologies[].categories` | What the technology is, for example `CDN` or `Font scripts`. | | `technologies[].confidence` | How sure the detection is, from 0 to 100. | | `version`, `clean_version` | The version string the site reveals, empty when it reveals none, and its numeric form or `null`. | | `cpe`, `alternative_cpe_names` | The CPE name used for vulnerability matching, and any alternates. | | `urls` | Every URL that was loaded, with the HTTP status it returned. `null` when nothing could be loaded. | | `connection_status` | `success` when the site was reached. | ### Where a Stack Fingerprint Gets Used. #### [Vulnerability Management](https://www.deepinfo.com/solutions/use-cases/vulnerability-management/) Turn a site’s stack into CPE names your CVE matching can use, instead of keeping a hand-written inventory of versions. #### [Attack Surface Management](https://www.deepinfo.com/solutions/use-cases/attack-surface-management/) Record what each public web property runs, and notice when a framework or library changes. #### [Third-Party Risk](https://www.deepinfo.com/solutions/use-cases/third-party-risk-management/) See what a vendor’s public site is built on before you ask about it in a review. ### Live Loads, Retries and Limits. - **Loaded live**: The site is loaded live at request time, so a call takes longer than a record lookup. `503` means the analyzer is busy and `504` that it timed out: retry after a short wait. - **End of life**: In [External Attack Surface Management](https://www.deepinfo.com/platform/easm/comprehensive-risk-detection/), detected technologies are also checked for end-of-life status. - **Rate limits**: Plan-dependent. The default is one request per second per key and endpoint. See [rate limits](https://docs.deepinfo.com/getting-started/rate-limits/). ### The Next Call After This One. - [Vulnerability Finder](https://www.deepinfo.com/data-api/apis/vulnerability-finder/): The CVEs that affect the technologies detected on a URL. - [Web Data](https://www.deepinfo.com/data-api/apis/webdata-lookup/) (Lookup): These technologies, plus everything else the page reveals. - [Screenshot](https://www.deepinfo.com/data-api/apis/screenshot-lookup/) (Lookup): What the page looks like, captured in a real browser. ### Questions About Technology Lookup API **What is a CPE name?** CPE, the Common Platform Enumeration, is a structured name for a product: its vendor, product and version. `alternative_cpe_names` lists other names the same technology is known by. **Do we need Technology if we already call Web Data?** No. [Web Data](https://www.deepinfo.com/data-api/apis/webdata-lookup/) returns the same technologies, with the same fields, next to the page’s metadata, links, headers and cookies. Technology is the lighter call when the stack is all you need. **Can we fingerprint a suspicious site without visiting it?** Yes. The API loads the site, so the visit never comes from an analyst’s browser. **How is the Technology API priced?** As part of an API services plan, by volume and frequency, separately from the platform. Each lookup counts against your plan’s quota at one unit per request. See [Data & API pricing](https://www.deepinfo.com/pricing/#data-pricing). **Can analysts see a site’s technologies without writing code?** Yes. [Instant Lookups](https://www.deepinfo.com/platform/dsi/instant-lookups/) runs the Technology lookup in the Deepinfo Platform. ### Fingerprint Your Sites First. Run the API against a few of your own properties and compare the result with what you think they run. We set up access and answer schema questions on a short call. [Talk to us about access](https://www.deepinfo.com/contact/?topic=data-api) [All API services](https://www.deepinfo.com/data-api/apis/)