Documentation

Quickstart

Hit any endpoint without a key for the free no-signup tier (100/day per IP). With a key, daily quota jumps to 1,000+ depending on plan. Same response shape either way.

# Screenshot a URL — returns PNG
curl "https://api.sitetrace.it.com/api/shot?url=https://example.com" \
  -H "Authorization: Bearer stk_your_key" \
  --output shot.png

# IP reputation — returns JSON
curl "https://api.sitetrace.it.com/api/ip?ip=1.2.3.4" \
  -H "Authorization: Bearer stk_your_key"

# Email deliverability — returns JSON
curl "https://api.sitetrace.it.com/api/email?domain=example.com" \
  -H "Authorization: Bearer stk_your_key"

// Standard fetch() — regular REST API.
const r = await fetch('https://api.sitetrace.it.com/api/ip?ip=1.2.3.4', {
  headers: { Authorization: 'Bearer stk_your_key' }
});
const data = await r.json();
console.log(data);

// For screenshots (returns PNG blob):
const png = await fetch('https://api.sitetrace.it.com/api/shot?url=https://example.com', {
  headers: { Authorization: 'Bearer stk_your_key' }
}).then(r => r.blob());

import requests

# JSON endpoint
r = requests.get(
    'https://api.sitetrace.it.com/api/ip',
    params={'ip': '1.2.3.4'},
    headers={'Authorization': 'Bearer stk_your_key'},
)
print(r.json())

# PNG screenshot
r = requests.get(
    'https://api.sitetrace.it.com/api/shot',
    params={'url': 'https://example.com'},
    headers={'Authorization': 'Bearer stk_your_key'},
)
with open('shot.png', 'wb') as f:
    f.write(r.content)

package main

import (
    "io"
    "net/http"
)

func main() {
    req, _ := http.NewRequest("GET",
        "https://api.sitetrace.it.com/api/ip?ip=1.2.3.4", nil)
    req.Header.Set("Authorization", "Bearer stk_your_key")
    resp, _ := http.DefaultClient.Do(req)
    defer resp.Body.Close()
    data, _ := io.ReadAll(resp.Body)
    println(string(data))
}

require 'net/http'
require 'uri'

uri = URI('https://api.sitetrace.it.com/api/ip?ip=1.2.3.4')
req = Net::HTTP::Get.new(uri)
req['Authorization'] = 'Bearer stk_your_key'
res = Net::HTTP.start(uri.hostname, uri.port, use_ssl: true) { |h| h.request(req) }
puts res.body

Authentication

Two ways to authenticate:

# 1. Authorization header (recommended)
curl https://api.sitetrace.it.com/api/shot?url=https://example.com \
  -H "Authorization: Bearer stk_your_key_here"

# 2. Query string (handy for curl)
curl "https://api.sitetrace.it.com/api/shot?url=https://example.com&key=stk_your_key_here"

If you omit the key, the request falls through to the free no-signup tier (100 calls/day per IP). All endpoints support this.

Response codes

Endpoints

/api/shot — Screenshot → full page

GET /api/shot?url=https://example.com&device=desktop&width=1280&height=720&full=false&wait=0&dark=false&format=png

Returns image/png (or image/jpeg with format=jpeg). All params optional except url. Full reference.

/api/ip — IP Reputation → full page

GET /api/ip?ip=1.2.3.4

Returns JSON. Queries 7 DNSBLs in parallel (Spamhaus ZEN, Spamcop, Barracuda, CBL, SORBS, UCEPROTECT L1, PSBL) + ip-api.com geolocation. Composite 0–100 score, low/medium/high risk. Full reference.

/api/email — Email Deliverability → full page

GET /api/email?domain=example.com

Returns JSON. SPF + DKIM (probed across 20 common selectors) + DMARC + MX + BIMI. 0–100 score. Full reference.

/api/headers — HTTP Header Score → full page

GET /api/headers?url=https://example.com

Returns JSON. 8 security headers checked: HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, X-XSS-Protection, Server. 0–100 score, A–F grade.

/api/preview — URL Preview / Open Graph → full page

GET /api/preview?url=https://example.com

Returns JSON. Title, description, image, favicon, theme color, full og:* and twitter:* objects. Fetches with the Facebook crawler UA to get the most-tag-rich HTML variant.

/api/certs — SSL / Certificate Transparency → full page

GET /api/certs?domain=example.com&exclude=expired.example.com&limit=200

Returns JSON. Wraps crt.sh with 24h cache. List of every cert ever issued for the domain (and any subdomains). Excludes and limits optional.

Operational notes

Rate limit headers

Every authenticated response includes:

X-RateLimit-Limit: 1000
X-RateLimit-Remaining: 873
X-RateLimit-Reset: 1735689600   (unix ts of next UTC midnight)

Caching

Screenshots and SSL/CT lookups are cached at the edge (5 min and 24 h respectively). IP, email, and header lookups are no-store because the answer depends on who is asking or is too volatile to cache. The URL preview caches for 5 min.

CORS

All endpoints return Access-Control-Allow-Origin: *. OPTIONS preflights are answered with 204. Use the API directly from a browser if you want.

Status & changelog

/status — live service health, refreshed every 30s.

/changelog — what changed in each release.