Tech & Trust

REST endpoints for Tech & Trust. Base URL https://api.competlab.com; every request needs a CL-API-Key header (see Authentication). Responses wrap in { item } or { items }; errors in { error }.

Get latest tech & trust data

GET/v1/projects/{projectId}/tech-trust

Get the latest tech & trust profile data for all competitors in a project. Returns security headers, trust signals, technology stack, robots.txt analysis, AI access, and DNS infrastructure. Trust signals are a fixed set of 26 things we look for on a HOMEPAGE, in 5 categories — each category description names its exact membership and its denominator, so a count of 0 means none of THOSE signals was found and nothing more. Do not infer a signal a category does not list. Fields we could not measure are null, with a sibling availability object giving the reason; never read a null as zero, false or absent, and note that a measured 0 / false / empty list is reported as itself and is a real finding. Two degradations are partial and worth distinguishing: shielded response headers null the security grade and score while the HTML-derived trust and tech counts stay real, and an unreadable robots.txt withholds the AI-access verdicts — under aiAccess the assistantAccess and modelTrainingAccess keys are OMITTED rather than nulled or emptied, because an empty array would claim we evaluated every assistant and none can reach the site. aiAccess itself is ABSENT on a check that carries no AI-access information — that is neither could_not_measure nor openness, so check the key exists before branching on it. Where it is present, check aiAccess.measurement.status before reading the verdicts: measured_no_policy_found is a real result — the site publishes no robots.txt, which under the standard allows every crawler — and could_not_measure is the only status that withholds verdicts. A project with no completed run for this dimension yet answers 404 no_data_available — not a missing project and not a failed measurement, just nothing measured here so far; the project itself is fine and get_project still describes it. Distinguish it from project_not_found, which means the id is wrong.

Returns · { item }

Path parameters

Name	Type	Description
`projectId`	`string`	Project ID

Request


curl "https://api.competlab.com/v1/projects/507f1f77bcf86cd799439011/tech-trust" \
  -H "CL-API-Key: YOUR_COMPETLAB_API_KEY"

Response 200 OK

Example


{
  "item": {
    "lastUpdatedAt": "2026-03-15T10:00:00.000Z",
    "summary": {
      "competitorsChecked": 6,
      "competitorsSuccessful": 5,
      "customer": {
        "domain": "yoursite.com",
        "securityGrade": "B",
        "securityScore": 72,
        "securitySignalsAvailable": {
          "available": false,
          "reason": "site_uses_behavioral_protection"
        },
        "trustSignalCount": 8,
        "techStackCount": 14,
        "techTrustAnalysisAvailable": {
          "available": false,
          "reason": "tech_trust_fetch_failed"
        }
      },
      "topSecurityCompetitor": {
        "domain": "rival.com",
        "securityGrade": "A",
        "securityScore": 95
      },
      "topTrustCompetitor": {
        "domain": "other.com",
        "trustSignalCount": 15
      },
      "securityScoreGap": -23,
      "trustSignalGap": -7,
      "trustComparisonState": "compared",
      "comparableCompetitors": 4
    },
    "competitors": [
      {
        "domain": "competitor.com",
        "isOwn": false,
        "securityHeaders": {
          "grade": "A",
          "score": 85,
          "hsts": true,
          "csp": true,
          "xFrameOptions": true,
          "xContentTypeOptions": true,
          "signalsAvailable": {
            "available": false,
            "reason": "site_uses_behavioral_protection"
          }
        },
        "trustSignals": {
          "totalCount": 10,
          "categories": {
            "compliance": 3,
            "reviews": 4,
            "socialProof": 2,
            "certifications": 1,
            "disclosures": 1
          }
        },
        "technologyStack": {
          "tech": [
            "React",
            "Next.js",
            "TypeScript"
          ],
          "growth": [
            "Google Analytics",
            "HubSpot"
          ],
          "engagement": [
            "Intercom",
            "Zendesk"
          ],
          "totalCount": 12,
          "partialDetection": {
            "headersAvailable": false,
            "reason": "site_uses_behavioral_protection"
          }
        },
        "robotsTxt": {
          "exists": true,
          "totalRules": 5,
          "robotsTxtAvailable": {
            "available": false,
            "reason": "access_http_error_status"
          }
        },
        "aiAccess": {
          "measurement": {
            "status": "measured",
            "measuredAt": "2026-08-13T04:12:00.000Z",
            "couldNotMeasureReason": "access_http_error_status",
            "sourcesRead": {
              "robotsTxt": {},
              "pageMetaRobotsTag": {},
              "httpResponseHeaders": {}
            },
            "explanations": [
              {}
            ]
          },
          "assistantAccess": [
            {
              "assistantName": "ChatGPT",
              "crawlerAccessStatus": "can_reach_site",
              "appliesTo": "whole_site",
              "decidedByCrawlers": [],
              "explanations": []
            }
          ],
          "modelTrainingAccess": [
            {
              "modelOperatorName": "OpenAI",
              "trainingAccessStatus": "may_use_content_for_training",
              "decidedByCrawlers": [],
              "explanations": []
            }
          ],
          "rulesThatMayNotWork": [
            {
              "userAgentInFile": "ChatGPT-User",
              "directiveInFile": "Disallow: /",
              "whyItMayNotWork": "operator_exempts_user_initiated_requests",
              "explanation": {}
            }
          ],
          "rulesWithUnintendedScope": [
            {
              "userAgentInFile": "GPTBot",
              "kind": "escapes_restrictions_others_get",
              "affectedRules": [
                "Disallow: /use-cases/fintech",
                "Disallow: /events/*"
              ],
              "explanation": {}
            }
          ],
          "additionalObservations": [
            {
              "code": "training_blocked",
              "text": "Blocking a training crawler asks these operators not to use your content for model training. It does not affect whether AI assistants can cite you."
            }
          ],
          "crawlerCatalogVersion": "2026-08-13"
        },
        "dnsInfrastructure": {
          "emailProvider": "Google Workspace",
          "dnsProvider": "Cloudflare",
          "emailProviderAvailable": {
            "available": false,
            "reason": "dns_lookup_failed"
          },
          "dnsProviderAvailable": {
            "available": false,
            "reason": "dns_lookup_failed"
          }
        }
      }
    ]
  }
}

Fields

item — object

Field	Type	Description
`lastUpdatedAt`	`string`	When this data was last updated (ISO-8601)
`summary`	`object`	Run summary with competitive gap analysis. See `item.summary`.
`competitors`	`array<object>`	Per-competitor tech & trust data. See `item.competitors[]`.

item.summary — object

Field	Type	Description
`competitorsChecked`	`number`	Number of competitors checked in this run
`competitorsSuccessful`	`number`	Number of competitors successfully checked
`customer`	`object`	Your domain’s key metrics. See `item.summary.customer`.
`topSecurityCompetitor`	`object \| null`	Competitor with the highest security score, or null if no competitors checked. Nullable. See `item.summary.topSecurityCompetitor`.
`topTrustCompetitor`	`object \| null`	Competitor with the highest trust-signal count, or null if no competitors were checked. Ties are broken alphabetically by domain, so a `trustSignalCount` of `0` here means every competitor was measured and none publishes a single trust signal — a real finding, not a missing one. Don’t describe this domain as leading unless its count is actually higher than the others’. Nullable. See `item.summary.topTrustCompetitor`.
`securityScoreGap`	`number \| null`	Your security score minus the top competitor’s (negative = you are behind), or null when there is no comparison to make: your own score is unmeasured (whole domain unanalyzed, or headers shielded — the score is header-derived), or no competitor was scored at all. A `0` means genuinely tied. Was a forced `0` before, which read as ‘tied’ either way. Nullable.
`trustSignalGap`	`number \| null`	Your trust signal count minus the top competitor’s (negative = you are behind), or null when there is no comparison to make: your own domain was unanalyzed, or no competitor was checked at all. A field of competitors all measured at zero is a real comparison and yields a real number — your own count, positive — not a null. A `0` means genuinely tied. Unlike `securityScoreGap`, this survives a shielded check — trust signals come from the HTML. Nullable.
`trustComparisonState`	`string`	How to read `trustSignalGap`, so you do not have to infer it. `compared` — an ordinary comparison against a measured field. `sole_among_tracked` — every one of the tracked competitors has a usable check in this run’s data, all of them displaying zero homepage trust signals, and you do not: you are the only one, a measured finding and not missing data. `some_competitors_unmeasured` — at least one tracked competitor produced no usable check, so the comparison is INCOMPLETE, and that is all this state says: a measured competitor may still be leading, so read `trustSignalGap` and `topTrustCompetitor` before describing what the measured ones showed. `no_competitor_measured` — competitors are tracked and every one of their checks failed. `no_competitors_tracked` — no competitors are tracked, so nothing was attempted; this is not a failure. `customer_unmeasured` — your own domain could not be read this run, so there is no comparison to describe. Absent on runs recorded before this field shipped, which means the state was not computed — never read an absent value as `compared`. Two limits bound every reading. The set is YOUR TRACKED COMPETITORS — a list you chose, not a sample of a market — so it licenses nothing about your category or any vendor not on it: not ‘no competitor offers this’, not ‘the only vendor’, not ‘unique in the market’, not ‘market leader’. And this dimension measures what a vendor DISPLAYS on its homepage, so the honest claim is always ‘none of them displays it’; a vendor can hold SOC 2 and never badge it, and a zero here says nothing about what they hold. Values: `sole_among_tracked`, `some_competitors_unmeasured`, `no_competitor_measured`, `no_competitors_tracked`, `customer_unmeasured`, `compared`.
`comparableCompetitors`	`number`	Tracked competitors that produced a usable check this run, excluding your own domain. The sample `trustSignalGap` was drawn from, and the denominator behind `trustComparisonState` — quote it whenever you quote the state, so a reader knows how large ‘all of them’ was. Absent on runs recorded before this field shipped, which means the figure was never computed; a real `0` is different and means every tracked competitor’s check failed, and that run says so with `trustComparisonState: no_competitor_measured`.

item.competitors[] — each entry

Field	Type	Description
`domain`	`string`	Competitor domain
`isOwn`	`boolean`	Whether this is the project’s own domain
`securityHeaders`	`object`	Security headers analysis. See `item.competitors[].securityHeaders`.
`trustSignals`	`object`	Trust signals and compliance badges. See `item.competitors[].trustSignals`.
`technologyStack`	`object`	Detected technology stack. See `item.competitors[].technologyStack`.
`robotsTxt`	`object`	Robots.txt analysis. See `item.competitors[].robotsTxt`.
`aiAccess`	`object`	Which AI assistants can reach this site, and which model operators may train on it. ABSENT when the check carries no AI-access information — read that as not evaluated, never as ‘open’. A check that attempted the measurement and failed is NOT absent: it carries this section with `measurement.status` of `could_not_measure`, which is a different fact and is reportable as one. See `item.competitors[].aiAccess`.
`dnsInfrastructure`	`object`	DNS and email infrastructure. See `item.competitors[].dnsInfrastructure`.

item.summary.customer — object

Field	Type	Description
`domain`	`string`	Your domain
`securityGrade`	`string \| null`	Your security grade, or null if check failed. Values: `A`, `B`, `C`, `D`, `F`. Nullable.
`securityScore`	`number \| null`	Your security score (0-100), or null if check failed. Nullable.
`securitySignalsAvailable`	`object`	Honest-degradation discriminator. Present only when your own domain runs behavioral protection that blocks header inspection (~1.1% of sites). When present, `securityGrade` and `securityScore` above are forced to `null` so dashboards never surface F-grade placeholder values. Absent on healthy scans (the normal path). See `item.summary.customer.securitySignalsAvailable`.
`trustSignalCount`	`number \| null`	Number of trust signals detected on your homepage, or null when your own domain couldn’t be analyzed this run. A `0` is a MEASURED finding — we read your homepage and found none of the signals we look for — so never read a null as 0. Still measured (not null) on a shielded check: trust signals come from the HTML, so they survive a `securitySignalsAvailable` degradation. Nullable.
`techStackCount`	`number \| null`	Number of technologies detected on your domain, or null when your own domain couldn’t be analyzed this run. A `0` is a measured finding; never read a null as 0. Survives a shielded check like `trustSignalCount`, but not on the same terms: when `securitySignalsAvailable` is present this count is a FLOOR rather than a total, because your hosting and CDN could not be detected either (both are read from the same blocked response headers). Trust signals come wholly from the HTML and are unaffected. See `competitors[].technologyStack.partialDetection` for the full membership of what went unlooked-for. Nullable.
`techTrustAnalysisAvailable`	`object`	Honest-degradation discriminator. Present only when your own domain couldn’t be analyzed this run — see `reason`. When present, EVERY metric in this object is null — `securityGrade`, `securityScore`, `trustSignalCount`, `techStackCount` — and so are `securityScoreGap` and `trustSignalGap`. Nothing here is a measured fact; the nulls say that on their own, and this field records why. Only `domain` remains populated, and only when a domain was on file. Distinct from `securitySignalsAvailable`, which is a PARTIAL degradation: there the check ran and only the header-derived numbers are unknown, so the trust and tech counts stay measured. Absent on healthy scans (the normal path). See `item.summary.customer.techTrustAnalysisAvailable`.

item.summary.topSecurityCompetitor — object

Field	Type	Description
`domain`	`string`	Top security competitor domain
`securityGrade`	`string`	Their security grade. Values: `A`, `B`, `C`, `D`, `F`.
`securityScore`	`number`	Their security score (0-100)

item.summary.topTrustCompetitor — object

Field	Type	Description
`domain`	`string`	Top trust signals competitor domain
`trustSignalCount`	`number`	Their trust signal count

item.competitors[].securityHeaders — object

Field	Type	Description
`grade`	`string \| null`	Overall security grade, or null when this site runs behavioral protection that blocked header inspection (see signalsAvailable). A null is not an F. Values: `A`, `B`, `C`, `D`, `F`. Nullable.
`score`	`number \| null`	Security score (0-100), or null when headers could not be inspected. Never read a null as 0 — the stored fallback really was a 0, which is why this is nulled at the boundary rather than passed through. Nullable.
`hsts`	`boolean \| null`	Has the HTTP Strict Transport Security header, or null when headers could not be inspected. A measured false means the header is genuinely absent. Nullable.
`csp`	`boolean \| null`	Has the Content Security Policy header, or null when headers could not be inspected. A measured false means the header is genuinely absent. Nullable.
`xFrameOptions`	`boolean \| null`	Has the X-Frame-Options header, or null when headers could not be inspected. A measured false means the header is genuinely absent. Nullable.
`xContentTypeOptions`	`boolean \| null`	Has the X-Content-Type-Options header, or null when headers could not be inspected. A measured false means the header is genuinely absent. Nullable.
`signalsAvailable`	`object`	Honest-degradation discriminator. Present only when the upstream homepage fetch couldn’t recover response headers (~1.1% of sites running behavioral protection that blocks header inspection). When present, every other field in this object — `grade`, `score`, `hsts`, `csp`, `xFrameOptions`, `xContentTypeOptions` — is null. This is not a ‘no security headers’ result and not an F grade; the headers were unreadable, which is a property of their bot protection, not of their security. Absent on healthy scans (the normal path). See `item.competitors[].securityHeaders.signalsAvailable`.

item.competitors[].trustSignals — object

Field	Type	Description
`totalCount`	`number`	Total trust signals detected on this domain, out of 26 we look for across the five categories below. These are signals published on the HOMEPAGE — a vendor may hold a certification without displaying it, so this measures visible trust-building, not the underlying facts. Most of the NAMED programmes in this list are US or EU ones: the six review platforms are the anglophone B2B SaaS review ecosystem, and the privacy regimes are GDPR, CCPA and LGPD, with PIPEDA, PDPA and others not detected. The list is not uniformly so — ISO 27001, ISO 9001, ISO 14001 and PCI DSS are held worldwide, and the social-proof and disclosure signals describe a practice rather than a programme, so they are market-neutral. That is what bounds a count: a vendor selling outside the US and EU commonly scores on the market-neutral signals and near-zero on the named programmes. Compare counts within a market rather than across markets, and when a total is low, say WHICH part is low rather than reporting the total as a level of trust. Distinct from the standalone trust-signals scan tool, which uses its own wider taxonomy and its own categories.
`categories`	`object`	Trust signals broken down by category. See `item.competitors[].trustSignals.categories`.

item.competitors[].technologyStack — object

Field	Type	Description
`tech`	`array<string>`	Core technology stack (frameworks, languages, infrastructure). When `partialDetection` is present this list is real but incomplete — hosting and CDN could not be detected on this domain, so read it as ‘at least these’, never as the full picture.
`growth`	`array<string>`	Growth and marketing tools (analytics, ads, SEO). Detected from the page HTML, so this list is complete even when `partialDetection` is present.
`engagement`	`array<string>`	Customer engagement tools (chat, support, CRM). Detected from the page HTML, so this list is complete even when `partialDetection` is present.
`totalCount`	`number`	Total number of technologies detected. When `partialDetection` is present this is a FLOOR, not a total — the real figure is this number plus however many hosting and CDN technologies we could not look for. Never compare it against another domain’s count, or quote it as ‘N technologies against your M’, while that marker is set.
`partialDetection`	`object`	Honest-degradation discriminator. Present only when this site’s behavioral protection blocked inspection of its response headers (~1.1% of sites). Every technology listed above is a real detection and stays trustworthy — this is a partial measurement, not a failed one, which is why nothing in this object is null. What is missing is the hosting and CDN categories: thirteen technologies (Vercel, Netlify, AWS, Heroku, GitHub Pages, DigitalOcean, Render, Cloudflare, Fastly, Akamai, CloudFront, Bunny CDN, KeyCDN) are only detectable from response headers, and none of them could be looked for. A technology’s absence from this block is therefore NOT evidence the site does not use it, and “no CDN” or “no managed hosting” must never be inferred or reported. Absent on healthy scans, which is the normal path. See `item.competitors[].technologyStack.partialDetection`.

item.competitors[].robotsTxt — object

Field	Type	Description
`exists`	`boolean \| null`	Whether a robots.txt file exists, or null when the file could not be retrieved this run (see robotsTxtAvailable). A measured `false` — no discriminator alongside — is a real ‘no robots.txt, so it allows all crawlers’ finding and carries no marker. Nullable.
`totalRules`	`number \| null`	Total number of disallow rules, or null when the file could not be retrieved. A measured 0 means we read the file and it disallows nothing. Nullable.
`robotsTxtAvailable`	`object`	Honest-degradation discriminator. Present only when the robots.txt file could not be retrieved this run (network timeout or error). When present, every other field in this object — `exists`, `totalRules` — is null, and the sibling `aiAccess` block carries no verdicts at all, so no AI-access posture can be derived from either. Absent on healthy scans AND on domains that genuinely have no robots.txt: that is a measured ‘allows all crawlers’ result, and it arrives as `exists: false` with no marker. See `item.competitors[].robotsTxt.robotsTxtAvailable`.

item.competitors[].aiAccess — object

Field	Type	Description
`measurement`	`object`	Whether we measured it, and why not when we didn’t. See `item.competitors[].aiAccess.measurement`.
`assistantAccess`	`array<object>`	One verdict per AI assistant we track. ABSENT when the policy could not be measured — an empty array would claim we evaluated every assistant and none can reach the site, which is a different fact entirely. See `item.competitors[].aiAccess.assistantAccess[]`.
`modelTrainingAccess`	`array<object>`	One verdict per model operator. Absent for the same reason as `assistantAccess`. See `item.competitors[].aiAccess.modelTrainingAccess[]`.
`rulesThatMayNotWork`	`array<object>`	Rules in this site’s robots.txt that may not have the effect they appear to have — each attributable to the CRAWLER’S OPERATOR, never to the site. Two causes: the operator publishes a carve-out (commonly for fetches a person asked for directly), or a published study measured the crawler ignoring disallow directives. An empty array means we looked and found none; absent means we did not look. It NEVER suggests replacing a user-agent token: distinguishing a retired token from one we never catalogued needs a registry of live user agents that nobody publishes, and guessing would have told sites their `Omgili` rule was dead in favour of its own predecessor. See `item.competitors[].aiAccess.rulesThatMayNotWork[]`.
`rulesWithUnintendedScope`	`array<object>`	Rules that worked exactly as written and did NOT reach the crawler beside them — the counterpart to `rulesThatMayNotWork`. Under the robots exclusion standard a group naming a crawler REPLACES the wildcard group for it, so writing `User-agent: GPTBot` / `Allow: /` beneath a `*` group that closes three sections leaves GPTBot the only agent permitted into those sections. Same absent-versus-empty rule as the array above: `[]` means we looked and the file has none. See `item.competitors[].aiAccess.rulesWithUnintendedScope[]`.
`additionalObservations`	`array<object>`	Facts about the file worth stating even where they change no verdict. Currently one: how much of THIS file our catalog can speak to, e.g. ‘names 34 user agents besides the wildcard group, and our catalog covers 24 of them’. That is our coverage gap disclosed with the universe it is drawn from — it is never a claim that the tokens we do not carry are wrong or obsolete. See `item.competitors[].aiAccess.additionalObservations[]`.
`crawlerCatalogVersion`	`string`	Which edition of our crawler and assistant tables produced these verdicts, so a stored result stays explainable after the tables change.

item.competitors[].dnsInfrastructure — object

Field	Type	Description
`emailProvider`	`string \| null`	Email service provider read from the domain’s MX records, or null when the MX lookup didn’t resolve this run (see `emailProviderAvailable`). ‘Unknown’ with no marker beside it is a MEASURED result and means one of two real things: the domain publishes no MX records, or it publishes records we don’t attribute to any provider we track. Either way it is a fact about them — so ‘Unknown’ may be reported as ‘no recognised email provider’, while a null may not. Nullable.
`dnsProvider`	`string \| null`	DNS hosting provider read from the domain’s NS records, or null when the NS lookup didn’t resolve this run (see `dnsProviderAvailable`). Same reading rule as `emailProvider`: an unmarked ‘Unknown’ is measured, a null is not. Note this is the authoritative DNS host, not a CDN — a domain fronted by a CDN can still resolve through a different nameserver provider. Nullable.
`emailProviderAvailable`	`object`	Honest-degradation discriminator for the MX lookup. Present only when that query never resolved this run (timeout, refused, or the resolver was unreachable). When present, `emailProvider` is null and no email-infrastructure claim may be made about this domain — not ‘they use no business email’, not ‘their provider changed’. Absent on healthy scans, absent when the domain simply publishes no MX records (a measured result), and absent on data recorded before this marker existed, where absence means measured. See `item.competitors[].dnsInfrastructure.emailProviderAvailable`.
`dnsProviderAvailable`	`object`	Honest-degradation discriminator for the NS lookup. Same semantics as `emailProviderAvailable`, applied to `dnsProvider`, and independent of it — one lookup can fail while the other succeeds, so check the marker belonging to the field you are about to quote. See `item.competitors[].dnsInfrastructure.dnsProviderAvailable`.

item.summary.customer.securitySignalsAvailable — object

Field	Type	Description
`available`	`boolean`	Always false for this discriminator.
`reason`	`string`	Why signals are unavailable. Known sub-classes are documented; new behavioral-protection categories may be classified over time. Values: `site_uses_behavioral_protection`.

item.summary.customer.techTrustAnalysisAvailable — object

Field	Type	Description
`available`	`boolean`	Always false — present only when your own domain could not be analyzed
`reason`	`string`	Why your own tech & trust profile is unmeasured this run. ‘tech_trust_fetch_failed’ = we couldn’t reach your domain to read its security, tech, and trust signals (DNS failure, timeout, or an error response). ‘tech_trust_domain_not_configured’ = no valid domain is on file for your own site, so no check ran. Values: `tech_trust_fetch_failed`, `tech_trust_domain_not_configured`.

item.competitors[].securityHeaders.signalsAvailable — object

Field	Type	Description
`available`	`boolean`	Always false for this discriminator.
`reason`	`string`	Why signals are unavailable. Known sub-classes are documented; new behavioral-protection categories may be classified over time. Values: `site_uses_behavioral_protection`.

item.competitors[].trustSignals.categories — object

Field	Type	Description
`compliance`	`number`	Compliance signals detected, out of 6 looked for: SOC 2, ISO 27001, HIPAA, GDPR, CCPA, LGPD. A 0 means none of those specific signals was found — it is not a general statement about the site’s privacy or compliance posture, and no other signal may be inferred from it. Evidence strength differs within the category, so a positive count needs care too: SOC 2, ISO 27001 and HIPAA match a rendered trust badge, but GDPR, CCPA and LGPD are text matches, so a consent banner or a footer link registers one. Report those three as “the page mentions it”, never as a compliance posture. PIPEDA, PDPA and other regimes are not detected at all.
`reviews`	`number`	Review-platform badges detected, out of 6 looked for: G2, Capterra, Trustpilot, Gartner, TrustRadius, GetApp. Regional review platforms outside this list are not detected, so a 0 is not evidence that a vendor has no reviews.
`socialProof`	`number`	Social-proof signals detected, out of 5 looked for: Customer Logos, Customer Count, Case Studies, Money Back Guarantee, Free Trial. A 0 means none of those five was found on the homepage; it is not a statement about whether the vendor has customers.
`certifications`	`number`	Certifications detected, out of 8 looked for: PCI DSS, FedRAMP, ISO 9001, ISO 14001, SOC 1, SOC 3, NIST, HITRUST. A 0 means none of those badges was DISPLAYED on the homepage — a vendor may hold any of them without publishing it, so this is never evidence that they lack a certification. Each name must match as a whole word against page text or a badge image, so a page containing “administration” or “Afghanistan” no longer registers NIST.
`disclosures`	`number`	Disclosure links detected, out of 1 looked for: Privacy Policy. Matches a homepage link whose target or text names a privacy policy in English, Spanish, Portuguese, French, German, Italian, Dutch, Polish, Russian or Ukrainian. It is evidence the page LINKS one — never an assessment of what the policy says. A 0 means the homepage carries no such link; the vendor may still publish a policy elsewhere on the site.

item.competitors[].technologyStack.partialDetection — object

Field	Type	Description
`headersAvailable`	`boolean`	Always false for this discriminator.
`reason`	`string`	Why the technology detection was partial: this site runs behavioral protection that blocked inspection of its response headers. Sixteen of our eighteen detectors read the page HTML and ran normally — the two that need headers are hosting and CDN, and these thirteen technologies became undetectable: Vercel, Netlify, AWS, Heroku, GitHub Pages, DigitalOcean, Render, Cloudflare, Fastly, Akamai, CloudFront, Bunny CDN, KeyCDN. Railway and Fly.io stay detectable because they also leave HTML traces. Values: `site_uses_behavioral_protection`.

item.competitors[].robotsTxt.robotsTxtAvailable — object

Field	Type	Description
`available`	`boolean`	Always false for this discriminator.
`reason`	`string`	Why the robots.txt analysis is unavailable — what WE observed, never a claim about the site. ‘access_transport_error’ — no answer came back at all. ‘access_http_error_status’ — the server answered with a status that settles nothing, such as 5xx, 403 or 429. ‘access_body_not_robots’ — a success status carrying markup rather than a robots.txt, usually a bot-protection page. ‘access_body_too_large’ — the file exceeded our transfer ceiling. ‘access_fallback_unavailable’ — our second attempt was unavailable too. Distinct from a domain that genuinely has no robots.txt — that is a measured ‘allows all crawlers’ result and carries no discriminator. Values: `access_transport_error`, `access_http_error_status`, `access_body_not_robots`, `access_body_too_large`, `access_fallback_unavailable`.

item.competitors[].aiAccess.measurement — object

Field	Type	Description
`status`	`string`	`measured`, `measured_no_policy_found` (a real 404 — the site publishes no robots.txt, which under the standard allows every crawler), or `could_not_measure`. Check this before reading anything else: on `could_not_measure` there are no verdicts at all, and their absence is not openness.
`measuredAt`	`string`	When this was ATTEMPTED — which is when it was measured on any status other than `could_not_measure`, and on that one is the time we tried and failed rather than the time of a measurement. A single response carries one reading per domain and no history, so it supports ‘where do we stand’ and not ‘what changed’; a change question needs two responses taken apart.
`couldNotMeasureReason`	`string`	Why the read failed. Present only when `status` is `could_not_measure`.
`sourcesRead`	`object`	Which of the three control surfaces were actually read, each with its own outcome. Read this before quoting any verdict as complete: a `not_attempted` here is a limit of the check, not a property of the site. Nested — see the Example tab.
`explanations`	`array<object>`	Sentences this product is willing to say about the measurement, each with a stable `code` and the `text` to render verbatim. ABSENT when there is nothing that needs saying. It is never an empty array: emptiness would assert that we weighed what needed saying and concluded nothing did. Nested — see the Example tab.

item.competitors[].aiAccess.assistantAccess[] — each entry

Field	Type	Description
`assistantName`	`string`	The assistant, as its users know it.
`crawlerAccessStatus`	`string`	Whether this assistant can obtain this site’s content: `can_reach_site`, `cannot_reach_site`, `can_reach_part_of_site`, or `blocked_but_may_not_be_honoured` — the last meaning a rule is written against crawlers whose operators publish an exemption, so protection is not guaranteed. Count the assistants in this array to get totals; no count is stored. IT IS NOT A CITATION MEASUREMENT: it says an assistant is permitted to obtain the content, never that it mentions or cites this site. Note also that a `cannot_reach_site` may be decided by a crawler whose `crawlerPurpose` is `policy_token_does_not_crawl` — that is consistent, not contradictory: see that field.
`appliesTo`	`string`	`whole_site` or `homepage_only`. robots.txt is site-wide; `nosnippet` and NOARCHIVE are per page and we read the homepage, so a verdict leaning on them describes that page alone.
`decidedByCrawlers`	`array<object>`	The crawlers that decided this verdict — the names behind the status. Never publish the verdict without them: ‘blocked’ is a claim, ‘blocked because these two tokens are disallowed’ is a finding. Nested — see the Example tab.
`explanations`	`array<object>`	Sentences to render verbatim about THIS assistant. ABSENT when there is nothing to say — never an empty array, which would claim we considered what needed saying and found nothing. Nested — see the Example tab.

item.competitors[].aiAccess.modelTrainingAccess[] — each entry

Field	Type	Description
`modelOperatorName`	`string`	The operator whose training use is governed. Usually the company whose models are affected; `Common Crawl` is the exception — it trains nothing, but publishes the open corpus much training is built from, so a site owner blocking it is making this same decision.
`trainingAccessStatus`	`string`	`may_use_content_for_training`, `may_not_use_content_for_training`, `may_use_part_of_content_for_training`, or `blocked_but_may_not_be_honoured` — the last meaning a rule is written but the deciding crawler is not reliably bound by robots.txt, either because its operator publishes an exemption or because it is measured not to obey the file at all. Read `decidedByCrawlers[].honoursRobotsTxt` and `honoursRobotsTxtEvidence` to tell those two apart; they are different facts and only the second means the content should be treated as taken. AS A RULE, blocking training crawlers costs no AI visibility and is a legitimate content decision — do not report it as a problem, a gap, or something to undo. THE RULE HAS ONE EXCEPTION AND YOU MUST CHECK FOR IT: a few tokens govern training AND an assistant at once, `Google-Extended` being the documented case. Where the same crawler in `decidedByCrawlers` also appears under an entry in `assistantAccess`, that block DOES carry a visibility consequence and the exception applies — report it. The check is mechanical: match on `userAgentToken`. Never suppress a finding on the strength of the general rule without running it.
`decidedByCrawlers`	`array<object>`	The crawlers that decided this verdict. Match their `userAgentToken` against the tokens under `assistantAccess[].decidedByCrawlers` to find the dual-purpose case the status description warns about. Nested — see the Example tab.
`explanations`	`array<object>`	Sentences to render verbatim about THIS operator. ABSENT when there is nothing to say — never an empty array, which would claim we considered what needed saying and found nothing. Nested — see the Example tab.

item.competitors[].aiAccess.rulesThatMayNotWork[] — each entry

Field	Type	Description
`userAgentInFile`	`string`	The user agent exactly as the site wrote it, so they can find the line.
`directiveInFile`	`string`	The directive as written.
`whyItMayNotWork`	`string`	Why the rule may not have effect. `operator_exempts_user_initiated_requests`: the operator publishes that robots.txt may not apply when a person asks for the page directly, so the rule is a request rather than protection. `crawler_does_not_honour_robots_txt`: a published study observed it fetching pages after being disallowed. Both point at the crawler’s operator. A third cause — a token we do not recognise — is deliberately NOT reported per rule; see `additionalObservations` for our coverage, stated once. Values: `operator_exempts_user_initiated_requests`, `crawler_does_not_honour_robots_txt`.
`explanation`	`object`	The sentence to render verbatim, naming the operator and citing evidence. Nested — see the Example tab.

item.competitors[].aiAccess.rulesWithUnintendedScope[] — each entry

Field	Type	Description
`userAgentInFile`	`string`	The user agent exactly as the site wrote it, so they can find the group.
`kind`	`string`	`escapes_restrictions_others_get` — the only kind emitted. The site’s `User-agent: *` group disallows these paths, and naming this crawler in a group of its own REPLACES that group for it rather than adding to it, so the crawler is permitted where the rest of the web is not. Values: `escapes_restrictions_others_get`.
`affectedRules`	`array<string>`	The wildcard-group directives this crawler is exempt from, verbatim as written in the file. A FLOOR, not the complete list: only directives closing a content area are reported, so ordinary hygiene paths a crawler also escapes — `/wp-admin/`, `/cgi-bin/`, `/feed/` — are deliberately omitted as findings that cost the reader nothing. Belongs to THIS crawler alone; two crawlers in one file can escape different subsets, so never quote one finding’s list against another’s name.
`explanation`	`object`	The sentence to render verbatim. It states the mechanism and stops: whether the exemption was intended is not something we can measure, and privileging AI crawlers over other traffic is a legitimate strategy. Do not report this as an error. Nested — see the Example tab.

item.competitors[].aiAccess.additionalObservations[] — each entry

Field	Type	Description
`code`	`string`	Stable identifier, so a consumer can branch without parsing prose.
`text`	`string`	The sentence. Render it verbatim; do not paraphrase or substitute your own.

item.competitors[].dnsInfrastructure.emailProviderAvailable — object

Field	Type	Description
`available`	`boolean`	Always false for this discriminator.
`reason`	`string`	Why this provider is unknown: the DNS query for it never resolved this run (timeout, refused, or the resolver was unreachable), so nothing was measured. Distinct from a domain that publishes no such records, or publishes records we don’t attribute to a provider we track — both of those are measured results and carry no discriminator. Values: `dns_lookup_failed`.

item.competitors[].dnsInfrastructure.dnsProviderAvailable — object

Field	Type	Description
`available`	`boolean`	Always false for this discriminator.
`reason`	`string`	Why this provider is unknown: the DNS query for it never resolved this run (timeout, refused, or the resolver was unreachable), so nothing was measured. Distinct from a domain that publishes no such records, or publishes records we don’t attribute to a provider we track — both of those are measured results and carry no discriminator. Values: `dns_lookup_failed`.

Errors

Status	Code	Meaning
401	`api_key_missing` · `api_key_invalid` · `api_key_revoked` · `api_key_expired` · `insufficient_scope`	The `CL-API-Key` is missing, malformed, revoked, expired, or lacks the required scope.
404	`project_not_found` · `no_data_available`	No `project` matches the id in the path.

Every error uses the shared { error: { code, message, status } } envelope; code is one of the values listed above.


{
  "error": {
    "code": "api_key_invalid",
    "message": "Invalid API key",
    "status": 401
  }
}

Get tech & trust run history

GET/v1/projects/{projectId}/tech-trust/history

Get paginated history of tech & trust monitoring runs for a project. Each entry includes run timing and summary statistics. Fields we could not measure are null, with a sibling availability object giving the reason; never read a null as zero, false or absent, and note that a measured 0 / false / empty list is reported as itself and is a real finding. The two gap figures are null when there was no comparison to make — either side unmeasured, or no competitor to compare against — so a null gap is not a tie.

Returns · { items, pagination }

Path parameters

Name	Type	Description
`projectId`	`string`	Project ID

Query parameters

Name	Type	Required	Description
`page`	`number`		Page number (1-indexed). Default `1`. Min `1`.
`limit`	`number`		Number of items per page. Default `20`. Range `1`–`100`.

Request


curl "https://api.competlab.com/v1/projects/507f1f77bcf86cd799439011/tech-trust/history?page=1&limit=20" \
  -H "CL-API-Key: YOUR_COMPETLAB_API_KEY"

Response 200 OK

Example


{
  "items": [
    {
      "runId": "507f1f77bcf86cd799439011",
      "completedAt": "2026-03-15T10:00:00.000Z",
      "summary": {
        "competitorsChecked": 6,
        "competitorsSuccessful": 5,
        "customer": {
          "domain": "yoursite.com",
          "securityGrade": "B",
          "securityScore": 72,
          "securitySignalsAvailable": {
            "available": false,
            "reason": "site_uses_behavioral_protection"
          },
          "trustSignalCount": 8,
          "techStackCount": 14,
          "techTrustAnalysisAvailable": {
            "available": false,
            "reason": "tech_trust_fetch_failed"
          }
        },
        "topSecurityCompetitor": {
          "domain": "rival.com",
          "securityGrade": "A",
          "securityScore": 95
        },
        "topTrustCompetitor": {
          "domain": "other.com",
          "trustSignalCount": 15
        },
        "securityScoreGap": -23,
        "trustSignalGap": -7,
        "trustComparisonState": "compared",
        "comparableCompetitors": 4
      }
    }
  ],
  "pagination": {
    "page": 1,
    "limit": 20,
    "total": 47,
    "totalPages": 3,
    "hasMore": true
  }
}

Fields

items[] — each entry

Field	Type	Description
`runId`	`string`	Run ID
`completedAt`	`string`	When this run completed (ISO-8601)
`summary`	`object`	Run summary statistics. See `items[].summary`.

pagination — object

Field	Type	Description
`page`	`number`	Current page number (1-indexed)
`limit`	`number`	Number of items per page
`total`	`number`	Total number of items across all pages
`totalPages`	`number`	Total number of pages
`hasMore`	`boolean`	Whether more pages exist after the current page

items[].summary — object

Field	Type	Description
`competitorsChecked`	`number`	Number of competitors checked in this run
`competitorsSuccessful`	`number`	Number of competitors successfully checked
`customer`	`object`	Your domain’s key metrics. See `items[].summary.customer`.
`topSecurityCompetitor`	`object \| null`	Competitor with the highest security score, or null if no competitors checked. Nullable. See `items[].summary.topSecurityCompetitor`.
`topTrustCompetitor`	`object \| null`	Competitor with the highest trust-signal count, or null if no competitors were checked. Ties are broken alphabetically by domain, so a `trustSignalCount` of `0` here means every competitor was measured and none publishes a single trust signal — a real finding, not a missing one. Don’t describe this domain as leading unless its count is actually higher than the others’. Nullable. See `items[].summary.topTrustCompetitor`.
`securityScoreGap`	`number \| null`	Your security score minus the top competitor’s (negative = you are behind), or null when there is no comparison to make: your own score is unmeasured (whole domain unanalyzed, or headers shielded — the score is header-derived), or no competitor was scored at all. A `0` means genuinely tied. Was a forced `0` before, which read as ‘tied’ either way. Nullable.
`trustSignalGap`	`number \| null`	Your trust signal count minus the top competitor’s (negative = you are behind), or null when there is no comparison to make: your own domain was unanalyzed, or no competitor was checked at all. A field of competitors all measured at zero is a real comparison and yields a real number — your own count, positive — not a null. A `0` means genuinely tied. Unlike `securityScoreGap`, this survives a shielded check — trust signals come from the HTML. Nullable.
`trustComparisonState`	`string`	How to read `trustSignalGap`, so you do not have to infer it. `compared` — an ordinary comparison against a measured field. `sole_among_tracked` — every one of the tracked competitors has a usable check in this run’s data, all of them displaying zero homepage trust signals, and you do not: you are the only one, a measured finding and not missing data. `some_competitors_unmeasured` — at least one tracked competitor produced no usable check, so the comparison is INCOMPLETE, and that is all this state says: a measured competitor may still be leading, so read `trustSignalGap` and `topTrustCompetitor` before describing what the measured ones showed. `no_competitor_measured` — competitors are tracked and every one of their checks failed. `no_competitors_tracked` — no competitors are tracked, so nothing was attempted; this is not a failure. `customer_unmeasured` — your own domain could not be read this run, so there is no comparison to describe. Absent on runs recorded before this field shipped, which means the state was not computed — never read an absent value as `compared`. Two limits bound every reading. The set is YOUR TRACKED COMPETITORS — a list you chose, not a sample of a market — so it licenses nothing about your category or any vendor not on it: not ‘no competitor offers this’, not ‘the only vendor’, not ‘unique in the market’, not ‘market leader’. And this dimension measures what a vendor DISPLAYS on its homepage, so the honest claim is always ‘none of them displays it’; a vendor can hold SOC 2 and never badge it, and a zero here says nothing about what they hold. Values: `sole_among_tracked`, `some_competitors_unmeasured`, `no_competitor_measured`, `no_competitors_tracked`, `customer_unmeasured`, `compared`.
`comparableCompetitors`	`number`	Tracked competitors that produced a usable check this run, excluding your own domain. The sample `trustSignalGap` was drawn from, and the denominator behind `trustComparisonState` — quote it whenever you quote the state, so a reader knows how large ‘all of them’ was. Absent on runs recorded before this field shipped, which means the figure was never computed; a real `0` is different and means every tracked competitor’s check failed, and that run says so with `trustComparisonState: no_competitor_measured`.

items[].summary.customer — object

Field	Type	Description
`domain`	`string`	Your domain
`securityGrade`	`string \| null`	Your security grade, or null if check failed. Values: `A`, `B`, `C`, `D`, `F`. Nullable.
`securityScore`	`number \| null`	Your security score (0-100), or null if check failed. Nullable.
`securitySignalsAvailable`	`object`	Honest-degradation discriminator. Present only when your own domain runs behavioral protection that blocks header inspection (~1.1% of sites). When present, `securityGrade` and `securityScore` above are forced to `null` so dashboards never surface F-grade placeholder values. Absent on healthy scans (the normal path). See `items[].summary.customer.securitySignalsAvailable`.
`trustSignalCount`	`number \| null`	Number of trust signals detected on your homepage, or null when your own domain couldn’t be analyzed this run. A `0` is a MEASURED finding — we read your homepage and found none of the signals we look for — so never read a null as 0. Still measured (not null) on a shielded check: trust signals come from the HTML, so they survive a `securitySignalsAvailable` degradation. Nullable.
`techStackCount`	`number \| null`	Number of technologies detected on your domain, or null when your own domain couldn’t be analyzed this run. A `0` is a measured finding; never read a null as 0. Survives a shielded check like `trustSignalCount`, but not on the same terms: when `securitySignalsAvailable` is present this count is a FLOOR rather than a total, because your hosting and CDN could not be detected either (both are read from the same blocked response headers). Trust signals come wholly from the HTML and are unaffected. See `competitors[].technologyStack.partialDetection` for the full membership of what went unlooked-for. Nullable.
`techTrustAnalysisAvailable`	`object`	Honest-degradation discriminator. Present only when your own domain couldn’t be analyzed this run — see `reason`. When present, EVERY metric in this object is null — `securityGrade`, `securityScore`, `trustSignalCount`, `techStackCount` — and so are `securityScoreGap` and `trustSignalGap`. Nothing here is a measured fact; the nulls say that on their own, and this field records why. Only `domain` remains populated, and only when a domain was on file. Distinct from `securitySignalsAvailable`, which is a PARTIAL degradation: there the check ran and only the header-derived numbers are unknown, so the trust and tech counts stay measured. Absent on healthy scans (the normal path). See `items[].summary.customer.techTrustAnalysisAvailable`.

items[].summary.topSecurityCompetitor — object

Field	Type	Description
`domain`	`string`	Top security competitor domain
`securityGrade`	`string`	Their security grade. Values: `A`, `B`, `C`, `D`, `F`.
`securityScore`	`number`	Their security score (0-100)

items[].summary.topTrustCompetitor — object

Field	Type	Description
`domain`	`string`	Top trust signals competitor domain
`trustSignalCount`	`number`	Their trust signal count

items[].summary.customer.securitySignalsAvailable — object

Field	Type	Description
`available`	`boolean`	Always false for this discriminator.
`reason`	`string`	Why signals are unavailable. Known sub-classes are documented; new behavioral-protection categories may be classified over time. Values: `site_uses_behavioral_protection`.

items[].summary.customer.techTrustAnalysisAvailable — object

Field	Type	Description
`available`	`boolean`	Always false — present only when your own domain could not be analyzed
`reason`	`string`	Why your own tech & trust profile is unmeasured this run. ‘tech_trust_fetch_failed’ = we couldn’t reach your domain to read its security, tech, and trust signals (DNS failure, timeout, or an error response). ‘tech_trust_domain_not_configured’ = no valid domain is on file for your own site, so no check ran. Values: `tech_trust_fetch_failed`, `tech_trust_domain_not_configured`.

Paginated — pass page and limit query parameters and follow pagination.hasMore to page through the full set.

Errors

Status	Code	Meaning
401	`api_key_missing` · `api_key_invalid` · `api_key_revoked` · `api_key_expired` · `insufficient_scope`	The `CL-API-Key` is missing, malformed, revoked, expired, or lacks the required scope.

Every error uses the shared { error: { code, message, status } } envelope; code is one of the values listed above.


{
  "error": {
    "code": "api_key_invalid",
    "message": "Invalid API key",
    "status": 401
  }
}

Get tech & trust data for a specific run

GET/v1/projects/{projectId}/tech-trust/history/{runId}

Get full tech & trust data for a specific historical monitoring run, including per-competitor security headers, trust signals, technology stack, robots.txt, and DNS infrastructure. Fields we could not measure are null, with a sibling availability object giving the reason; never read a null as zero, false or absent, and note that a measured 0 / false / empty list is reported as itself and is a real finding. A competitor whose robots.txt reads exists: false with NO availability marker genuinely publishes none, which allows all crawlers — a real finding, distinct from a null. A run that finished but produced no summary answers 404 run_not_summarized, which is a different fact from run_not_found: the run exists, it just has nothing to report. It used to answer 200 with an all-zero summary invented from the missing one.

Returns · { item }

Path parameters

Name	Type	Description
`runId`	`string`	Run ID
`projectId`	`string`	Project ID

Request


curl "https://api.competlab.com/v1/projects/507f1f77bcf86cd799439011/tech-trust/history/507f1f77bcf86cd799439012" \
  -H "CL-API-Key: YOUR_COMPETLAB_API_KEY"

Response 200 OK

Example


{
  "item": {
    "runId": "507f1f77bcf86cd799439011",
    "completedAt": "2026-03-15T10:00:00.000Z",
    "summary": {
      "competitorsChecked": 6,
      "competitorsSuccessful": 5,
      "customer": {
        "domain": "yoursite.com",
        "securityGrade": "B",
        "securityScore": 72,
        "securitySignalsAvailable": {
          "available": false,
          "reason": "site_uses_behavioral_protection"
        },
        "trustSignalCount": 8,
        "techStackCount": 14,
        "techTrustAnalysisAvailable": {
          "available": false,
          "reason": "tech_trust_fetch_failed"
        }
      },
      "topSecurityCompetitor": {
        "domain": "rival.com",
        "securityGrade": "A",
        "securityScore": 95
      },
      "topTrustCompetitor": {
        "domain": "other.com",
        "trustSignalCount": 15
      },
      "securityScoreGap": -23,
      "trustSignalGap": -7,
      "trustComparisonState": "compared",
      "comparableCompetitors": 4
    },
    "competitors": [
      {
        "domain": "competitor.com",
        "isOwn": false,
        "securityHeaders": {
          "grade": "A",
          "score": 85,
          "hsts": true,
          "csp": true,
          "xFrameOptions": true,
          "xContentTypeOptions": true,
          "signalsAvailable": {
            "available": false,
            "reason": "site_uses_behavioral_protection"
          }
        },
        "trustSignals": {
          "totalCount": 10,
          "categories": {
            "compliance": 3,
            "reviews": 4,
            "socialProof": 2,
            "certifications": 1,
            "disclosures": 1
          }
        },
        "technologyStack": {
          "tech": [
            "React",
            "Next.js",
            "TypeScript"
          ],
          "growth": [
            "Google Analytics",
            "HubSpot"
          ],
          "engagement": [
            "Intercom",
            "Zendesk"
          ],
          "totalCount": 12,
          "partialDetection": {
            "headersAvailable": false,
            "reason": "site_uses_behavioral_protection"
          }
        },
        "robotsTxt": {
          "exists": true,
          "totalRules": 5,
          "robotsTxtAvailable": {
            "available": false,
            "reason": "access_http_error_status"
          }
        },
        "aiAccess": {
          "measurement": {
            "status": "measured",
            "measuredAt": "2026-08-13T04:12:00.000Z",
            "couldNotMeasureReason": "access_http_error_status",
            "sourcesRead": {
              "robotsTxt": {},
              "pageMetaRobotsTag": {},
              "httpResponseHeaders": {}
            },
            "explanations": [
              {}
            ]
          },
          "assistantAccess": [
            {
              "assistantName": "ChatGPT",
              "crawlerAccessStatus": "can_reach_site",
              "appliesTo": "whole_site",
              "decidedByCrawlers": [],
              "explanations": []
            }
          ],
          "modelTrainingAccess": [
            {
              "modelOperatorName": "OpenAI",
              "trainingAccessStatus": "may_use_content_for_training",
              "decidedByCrawlers": [],
              "explanations": []
            }
          ],
          "rulesThatMayNotWork": [
            {
              "userAgentInFile": "ChatGPT-User",
              "directiveInFile": "Disallow: /",
              "whyItMayNotWork": "operator_exempts_user_initiated_requests",
              "explanation": {}
            }
          ],
          "rulesWithUnintendedScope": [
            {
              "userAgentInFile": "GPTBot",
              "kind": "escapes_restrictions_others_get",
              "affectedRules": [
                "Disallow: /use-cases/fintech",
                "Disallow: /events/*"
              ],
              "explanation": {}
            }
          ],
          "additionalObservations": [
            {
              "code": "training_blocked",
              "text": "Blocking a training crawler asks these operators not to use your content for model training. It does not affect whether AI assistants can cite you."
            }
          ],
          "crawlerCatalogVersion": "2026-08-13"
        },
        "dnsInfrastructure": {
          "emailProvider": "Google Workspace",
          "dnsProvider": "Cloudflare",
          "emailProviderAvailable": {
            "available": false,
            "reason": "dns_lookup_failed"
          },
          "dnsProviderAvailable": {
            "available": false,
            "reason": "dns_lookup_failed"
          }
        }
      }
    ]
  }
}

Fields

item — object

Field	Type	Description
`runId`	`string`	Run ID
`completedAt`	`string`	When this run completed (ISO-8601)
`summary`	`object`	Run summary statistics. See `item.summary`.
`competitors`	`array<object>`	Per-competitor tech & trust data for this run. See `item.competitors[]`.

item.summary — object

Field	Type	Description
`competitorsChecked`	`number`	Number of competitors checked in this run
`competitorsSuccessful`	`number`	Number of competitors successfully checked
`customer`	`object`	Your domain’s key metrics. See `item.summary.customer`.
`topSecurityCompetitor`	`object \| null`	Competitor with the highest security score, or null if no competitors checked. Nullable. See `item.summary.topSecurityCompetitor`.
`topTrustCompetitor`	`object \| null`	Competitor with the highest trust-signal count, or null if no competitors were checked. Ties are broken alphabetically by domain, so a `trustSignalCount` of `0` here means every competitor was measured and none publishes a single trust signal — a real finding, not a missing one. Don’t describe this domain as leading unless its count is actually higher than the others’. Nullable. See `item.summary.topTrustCompetitor`.
`securityScoreGap`	`number \| null`	Your security score minus the top competitor’s (negative = you are behind), or null when there is no comparison to make: your own score is unmeasured (whole domain unanalyzed, or headers shielded — the score is header-derived), or no competitor was scored at all. A `0` means genuinely tied. Was a forced `0` before, which read as ‘tied’ either way. Nullable.
`trustSignalGap`	`number \| null`	Your trust signal count minus the top competitor’s (negative = you are behind), or null when there is no comparison to make: your own domain was unanalyzed, or no competitor was checked at all. A field of competitors all measured at zero is a real comparison and yields a real number — your own count, positive — not a null. A `0` means genuinely tied. Unlike `securityScoreGap`, this survives a shielded check — trust signals come from the HTML. Nullable.
`trustComparisonState`	`string`	How to read `trustSignalGap`, so you do not have to infer it. `compared` — an ordinary comparison against a measured field. `sole_among_tracked` — every one of the tracked competitors has a usable check in this run’s data, all of them displaying zero homepage trust signals, and you do not: you are the only one, a measured finding and not missing data. `some_competitors_unmeasured` — at least one tracked competitor produced no usable check, so the comparison is INCOMPLETE, and that is all this state says: a measured competitor may still be leading, so read `trustSignalGap` and `topTrustCompetitor` before describing what the measured ones showed. `no_competitor_measured` — competitors are tracked and every one of their checks failed. `no_competitors_tracked` — no competitors are tracked, so nothing was attempted; this is not a failure. `customer_unmeasured` — your own domain could not be read this run, so there is no comparison to describe. Absent on runs recorded before this field shipped, which means the state was not computed — never read an absent value as `compared`. Two limits bound every reading. The set is YOUR TRACKED COMPETITORS — a list you chose, not a sample of a market — so it licenses nothing about your category or any vendor not on it: not ‘no competitor offers this’, not ‘the only vendor’, not ‘unique in the market’, not ‘market leader’. And this dimension measures what a vendor DISPLAYS on its homepage, so the honest claim is always ‘none of them displays it’; a vendor can hold SOC 2 and never badge it, and a zero here says nothing about what they hold. Values: `sole_among_tracked`, `some_competitors_unmeasured`, `no_competitor_measured`, `no_competitors_tracked`, `customer_unmeasured`, `compared`.
`comparableCompetitors`	`number`	Tracked competitors that produced a usable check this run, excluding your own domain. The sample `trustSignalGap` was drawn from, and the denominator behind `trustComparisonState` — quote it whenever you quote the state, so a reader knows how large ‘all of them’ was. Absent on runs recorded before this field shipped, which means the figure was never computed; a real `0` is different and means every tracked competitor’s check failed, and that run says so with `trustComparisonState: no_competitor_measured`.

item.competitors[] — each entry

Field	Type	Description
`domain`	`string`	Competitor domain
`isOwn`	`boolean`	Whether this is the project’s own domain
`securityHeaders`	`object`	Security headers analysis. See `item.competitors[].securityHeaders`.
`trustSignals`	`object`	Trust signals and compliance badges. See `item.competitors[].trustSignals`.
`technologyStack`	`object`	Detected technology stack. See `item.competitors[].technologyStack`.
`robotsTxt`	`object`	Robots.txt analysis. See `item.competitors[].robotsTxt`.
`aiAccess`	`object`	Which AI assistants can reach this site, and which model operators may train on it. ABSENT when the check carries no AI-access information — read that as not evaluated, never as ‘open’. A check that attempted the measurement and failed is NOT absent: it carries this section with `measurement.status` of `could_not_measure`, which is a different fact and is reportable as one. See `item.competitors[].aiAccess`.
`dnsInfrastructure`	`object`	DNS and email infrastructure. See `item.competitors[].dnsInfrastructure`.

item.summary.customer — object

Field	Type	Description
`domain`	`string`	Your domain
`securityGrade`	`string \| null`	Your security grade, or null if check failed. Values: `A`, `B`, `C`, `D`, `F`. Nullable.
`securityScore`	`number \| null`	Your security score (0-100), or null if check failed. Nullable.
`securitySignalsAvailable`	`object`	Honest-degradation discriminator. Present only when your own domain runs behavioral protection that blocks header inspection (~1.1% of sites). When present, `securityGrade` and `securityScore` above are forced to `null` so dashboards never surface F-grade placeholder values. Absent on healthy scans (the normal path). See `item.summary.customer.securitySignalsAvailable`.
`trustSignalCount`	`number \| null`	Number of trust signals detected on your homepage, or null when your own domain couldn’t be analyzed this run. A `0` is a MEASURED finding — we read your homepage and found none of the signals we look for — so never read a null as 0. Still measured (not null) on a shielded check: trust signals come from the HTML, so they survive a `securitySignalsAvailable` degradation. Nullable.
`techStackCount`	`number \| null`	Number of technologies detected on your domain, or null when your own domain couldn’t be analyzed this run. A `0` is a measured finding; never read a null as 0. Survives a shielded check like `trustSignalCount`, but not on the same terms: when `securitySignalsAvailable` is present this count is a FLOOR rather than a total, because your hosting and CDN could not be detected either (both are read from the same blocked response headers). Trust signals come wholly from the HTML and are unaffected. See `competitors[].technologyStack.partialDetection` for the full membership of what went unlooked-for. Nullable.
`techTrustAnalysisAvailable`	`object`	Honest-degradation discriminator. Present only when your own domain couldn’t be analyzed this run — see `reason`. When present, EVERY metric in this object is null — `securityGrade`, `securityScore`, `trustSignalCount`, `techStackCount` — and so are `securityScoreGap` and `trustSignalGap`. Nothing here is a measured fact; the nulls say that on their own, and this field records why. Only `domain` remains populated, and only when a domain was on file. Distinct from `securitySignalsAvailable`, which is a PARTIAL degradation: there the check ran and only the header-derived numbers are unknown, so the trust and tech counts stay measured. Absent on healthy scans (the normal path). See `item.summary.customer.techTrustAnalysisAvailable`.

item.summary.topSecurityCompetitor — object

Field	Type	Description
`domain`	`string`	Top security competitor domain
`securityGrade`	`string`	Their security grade. Values: `A`, `B`, `C`, `D`, `F`.
`securityScore`	`number`	Their security score (0-100)

item.summary.topTrustCompetitor — object

Field	Type	Description
`domain`	`string`	Top trust signals competitor domain
`trustSignalCount`	`number`	Their trust signal count

item.competitors[].securityHeaders — object

Field	Type	Description
`grade`	`string \| null`	Overall security grade, or null when this site runs behavioral protection that blocked header inspection (see signalsAvailable). A null is not an F. Values: `A`, `B`, `C`, `D`, `F`. Nullable.
`score`	`number \| null`	Security score (0-100), or null when headers could not be inspected. Never read a null as 0 — the stored fallback really was a 0, which is why this is nulled at the boundary rather than passed through. Nullable.
`hsts`	`boolean \| null`	Has the HTTP Strict Transport Security header, or null when headers could not be inspected. A measured false means the header is genuinely absent. Nullable.
`csp`	`boolean \| null`	Has the Content Security Policy header, or null when headers could not be inspected. A measured false means the header is genuinely absent. Nullable.
`xFrameOptions`	`boolean \| null`	Has the X-Frame-Options header, or null when headers could not be inspected. A measured false means the header is genuinely absent. Nullable.
`xContentTypeOptions`	`boolean \| null`	Has the X-Content-Type-Options header, or null when headers could not be inspected. A measured false means the header is genuinely absent. Nullable.
`signalsAvailable`	`object`	Honest-degradation discriminator. Present only when the upstream homepage fetch couldn’t recover response headers (~1.1% of sites running behavioral protection that blocks header inspection). When present, every other field in this object — `grade`, `score`, `hsts`, `csp`, `xFrameOptions`, `xContentTypeOptions` — is null. This is not a ‘no security headers’ result and not an F grade; the headers were unreadable, which is a property of their bot protection, not of their security. Absent on healthy scans (the normal path). See `item.competitors[].securityHeaders.signalsAvailable`.

item.competitors[].trustSignals — object

Field	Type	Description
`totalCount`	`number`	Total trust signals detected on this domain, out of 26 we look for across the five categories below. These are signals published on the HOMEPAGE — a vendor may hold a certification without displaying it, so this measures visible trust-building, not the underlying facts. Most of the NAMED programmes in this list are US or EU ones: the six review platforms are the anglophone B2B SaaS review ecosystem, and the privacy regimes are GDPR, CCPA and LGPD, with PIPEDA, PDPA and others not detected. The list is not uniformly so — ISO 27001, ISO 9001, ISO 14001 and PCI DSS are held worldwide, and the social-proof and disclosure signals describe a practice rather than a programme, so they are market-neutral. That is what bounds a count: a vendor selling outside the US and EU commonly scores on the market-neutral signals and near-zero on the named programmes. Compare counts within a market rather than across markets, and when a total is low, say WHICH part is low rather than reporting the total as a level of trust. Distinct from the standalone trust-signals scan tool, which uses its own wider taxonomy and its own categories.
`categories`	`object`	Trust signals broken down by category. See `item.competitors[].trustSignals.categories`.

item.competitors[].technologyStack — object

Field	Type	Description
`tech`	`array<string>`	Core technology stack (frameworks, languages, infrastructure). When `partialDetection` is present this list is real but incomplete — hosting and CDN could not be detected on this domain, so read it as ‘at least these’, never as the full picture.
`growth`	`array<string>`	Growth and marketing tools (analytics, ads, SEO). Detected from the page HTML, so this list is complete even when `partialDetection` is present.
`engagement`	`array<string>`	Customer engagement tools (chat, support, CRM). Detected from the page HTML, so this list is complete even when `partialDetection` is present.
`totalCount`	`number`	Total number of technologies detected. When `partialDetection` is present this is a FLOOR, not a total — the real figure is this number plus however many hosting and CDN technologies we could not look for. Never compare it against another domain’s count, or quote it as ‘N technologies against your M’, while that marker is set.
`partialDetection`	`object`	Honest-degradation discriminator. Present only when this site’s behavioral protection blocked inspection of its response headers (~1.1% of sites). Every technology listed above is a real detection and stays trustworthy — this is a partial measurement, not a failed one, which is why nothing in this object is null. What is missing is the hosting and CDN categories: thirteen technologies (Vercel, Netlify, AWS, Heroku, GitHub Pages, DigitalOcean, Render, Cloudflare, Fastly, Akamai, CloudFront, Bunny CDN, KeyCDN) are only detectable from response headers, and none of them could be looked for. A technology’s absence from this block is therefore NOT evidence the site does not use it, and “no CDN” or “no managed hosting” must never be inferred or reported. Absent on healthy scans, which is the normal path. See `item.competitors[].technologyStack.partialDetection`.

item.competitors[].robotsTxt — object

Field	Type	Description
`exists`	`boolean \| null`	Whether a robots.txt file exists, or null when the file could not be retrieved this run (see robotsTxtAvailable). A measured `false` — no discriminator alongside — is a real ‘no robots.txt, so it allows all crawlers’ finding and carries no marker. Nullable.
`totalRules`	`number \| null`	Total number of disallow rules, or null when the file could not be retrieved. A measured 0 means we read the file and it disallows nothing. Nullable.
`robotsTxtAvailable`	`object`	Honest-degradation discriminator. Present only when the robots.txt file could not be retrieved this run (network timeout or error). When present, every other field in this object — `exists`, `totalRules` — is null, and the sibling `aiAccess` block carries no verdicts at all, so no AI-access posture can be derived from either. Absent on healthy scans AND on domains that genuinely have no robots.txt: that is a measured ‘allows all crawlers’ result, and it arrives as `exists: false` with no marker. See `item.competitors[].robotsTxt.robotsTxtAvailable`.

item.competitors[].aiAccess — object

Field	Type	Description
`measurement`	`object`	Whether we measured it, and why not when we didn’t. See `item.competitors[].aiAccess.measurement`.
`assistantAccess`	`array<object>`	One verdict per AI assistant we track. ABSENT when the policy could not be measured — an empty array would claim we evaluated every assistant and none can reach the site, which is a different fact entirely. See `item.competitors[].aiAccess.assistantAccess[]`.
`modelTrainingAccess`	`array<object>`	One verdict per model operator. Absent for the same reason as `assistantAccess`. See `item.competitors[].aiAccess.modelTrainingAccess[]`.
`rulesThatMayNotWork`	`array<object>`	Rules in this site’s robots.txt that may not have the effect they appear to have — each attributable to the CRAWLER’S OPERATOR, never to the site. Two causes: the operator publishes a carve-out (commonly for fetches a person asked for directly), or a published study measured the crawler ignoring disallow directives. An empty array means we looked and found none; absent means we did not look. It NEVER suggests replacing a user-agent token: distinguishing a retired token from one we never catalogued needs a registry of live user agents that nobody publishes, and guessing would have told sites their `Omgili` rule was dead in favour of its own predecessor. See `item.competitors[].aiAccess.rulesThatMayNotWork[]`.
`rulesWithUnintendedScope`	`array<object>`	Rules that worked exactly as written and did NOT reach the crawler beside them — the counterpart to `rulesThatMayNotWork`. Under the robots exclusion standard a group naming a crawler REPLACES the wildcard group for it, so writing `User-agent: GPTBot` / `Allow: /` beneath a `*` group that closes three sections leaves GPTBot the only agent permitted into those sections. Same absent-versus-empty rule as the array above: `[]` means we looked and the file has none. See `item.competitors[].aiAccess.rulesWithUnintendedScope[]`.
`additionalObservations`	`array<object>`	Facts about the file worth stating even where they change no verdict. Currently one: how much of THIS file our catalog can speak to, e.g. ‘names 34 user agents besides the wildcard group, and our catalog covers 24 of them’. That is our coverage gap disclosed with the universe it is drawn from — it is never a claim that the tokens we do not carry are wrong or obsolete. See `item.competitors[].aiAccess.additionalObservations[]`.
`crawlerCatalogVersion`	`string`	Which edition of our crawler and assistant tables produced these verdicts, so a stored result stays explainable after the tables change.

item.competitors[].dnsInfrastructure — object

Field	Type	Description
`emailProvider`	`string \| null`	Email service provider read from the domain’s MX records, or null when the MX lookup didn’t resolve this run (see `emailProviderAvailable`). ‘Unknown’ with no marker beside it is a MEASURED result and means one of two real things: the domain publishes no MX records, or it publishes records we don’t attribute to any provider we track. Either way it is a fact about them — so ‘Unknown’ may be reported as ‘no recognised email provider’, while a null may not. Nullable.
`dnsProvider`	`string \| null`	DNS hosting provider read from the domain’s NS records, or null when the NS lookup didn’t resolve this run (see `dnsProviderAvailable`). Same reading rule as `emailProvider`: an unmarked ‘Unknown’ is measured, a null is not. Note this is the authoritative DNS host, not a CDN — a domain fronted by a CDN can still resolve through a different nameserver provider. Nullable.
`emailProviderAvailable`	`object`	Honest-degradation discriminator for the MX lookup. Present only when that query never resolved this run (timeout, refused, or the resolver was unreachable). When present, `emailProvider` is null and no email-infrastructure claim may be made about this domain — not ‘they use no business email’, not ‘their provider changed’. Absent on healthy scans, absent when the domain simply publishes no MX records (a measured result), and absent on data recorded before this marker existed, where absence means measured. See `item.competitors[].dnsInfrastructure.emailProviderAvailable`.
`dnsProviderAvailable`	`object`	Honest-degradation discriminator for the NS lookup. Same semantics as `emailProviderAvailable`, applied to `dnsProvider`, and independent of it — one lookup can fail while the other succeeds, so check the marker belonging to the field you are about to quote. See `item.competitors[].dnsInfrastructure.dnsProviderAvailable`.

item.summary.customer.securitySignalsAvailable — object

Field	Type	Description
`available`	`boolean`	Always false for this discriminator.
`reason`	`string`	Why signals are unavailable. Known sub-classes are documented; new behavioral-protection categories may be classified over time. Values: `site_uses_behavioral_protection`.

item.summary.customer.techTrustAnalysisAvailable — object

Field	Type	Description
`available`	`boolean`	Always false — present only when your own domain could not be analyzed
`reason`	`string`	Why your own tech & trust profile is unmeasured this run. ‘tech_trust_fetch_failed’ = we couldn’t reach your domain to read its security, tech, and trust signals (DNS failure, timeout, or an error response). ‘tech_trust_domain_not_configured’ = no valid domain is on file for your own site, so no check ran. Values: `tech_trust_fetch_failed`, `tech_trust_domain_not_configured`.

item.competitors[].securityHeaders.signalsAvailable — object

Field	Type	Description
`available`	`boolean`	Always false for this discriminator.
`reason`	`string`	Why signals are unavailable. Known sub-classes are documented; new behavioral-protection categories may be classified over time. Values: `site_uses_behavioral_protection`.

item.competitors[].trustSignals.categories — object

Field	Type	Description
`compliance`	`number`	Compliance signals detected, out of 6 looked for: SOC 2, ISO 27001, HIPAA, GDPR, CCPA, LGPD. A 0 means none of those specific signals was found — it is not a general statement about the site’s privacy or compliance posture, and no other signal may be inferred from it. Evidence strength differs within the category, so a positive count needs care too: SOC 2, ISO 27001 and HIPAA match a rendered trust badge, but GDPR, CCPA and LGPD are text matches, so a consent banner or a footer link registers one. Report those three as “the page mentions it”, never as a compliance posture. PIPEDA, PDPA and other regimes are not detected at all.
`reviews`	`number`	Review-platform badges detected, out of 6 looked for: G2, Capterra, Trustpilot, Gartner, TrustRadius, GetApp. Regional review platforms outside this list are not detected, so a 0 is not evidence that a vendor has no reviews.
`socialProof`	`number`	Social-proof signals detected, out of 5 looked for: Customer Logos, Customer Count, Case Studies, Money Back Guarantee, Free Trial. A 0 means none of those five was found on the homepage; it is not a statement about whether the vendor has customers.
`certifications`	`number`	Certifications detected, out of 8 looked for: PCI DSS, FedRAMP, ISO 9001, ISO 14001, SOC 1, SOC 3, NIST, HITRUST. A 0 means none of those badges was DISPLAYED on the homepage — a vendor may hold any of them without publishing it, so this is never evidence that they lack a certification. Each name must match as a whole word against page text or a badge image, so a page containing “administration” or “Afghanistan” no longer registers NIST.
`disclosures`	`number`	Disclosure links detected, out of 1 looked for: Privacy Policy. Matches a homepage link whose target or text names a privacy policy in English, Spanish, Portuguese, French, German, Italian, Dutch, Polish, Russian or Ukrainian. It is evidence the page LINKS one — never an assessment of what the policy says. A 0 means the homepage carries no such link; the vendor may still publish a policy elsewhere on the site.

item.competitors[].technologyStack.partialDetection — object

Field	Type	Description
`headersAvailable`	`boolean`	Always false for this discriminator.
`reason`	`string`	Why the technology detection was partial: this site runs behavioral protection that blocked inspection of its response headers. Sixteen of our eighteen detectors read the page HTML and ran normally — the two that need headers are hosting and CDN, and these thirteen technologies became undetectable: Vercel, Netlify, AWS, Heroku, GitHub Pages, DigitalOcean, Render, Cloudflare, Fastly, Akamai, CloudFront, Bunny CDN, KeyCDN. Railway and Fly.io stay detectable because they also leave HTML traces. Values: `site_uses_behavioral_protection`.

item.competitors[].robotsTxt.robotsTxtAvailable — object

Field	Type	Description
`available`	`boolean`	Always false for this discriminator.
`reason`	`string`	Why the robots.txt analysis is unavailable — what WE observed, never a claim about the site. ‘access_transport_error’ — no answer came back at all. ‘access_http_error_status’ — the server answered with a status that settles nothing, such as 5xx, 403 or 429. ‘access_body_not_robots’ — a success status carrying markup rather than a robots.txt, usually a bot-protection page. ‘access_body_too_large’ — the file exceeded our transfer ceiling. ‘access_fallback_unavailable’ — our second attempt was unavailable too. Distinct from a domain that genuinely has no robots.txt — that is a measured ‘allows all crawlers’ result and carries no discriminator. Values: `access_transport_error`, `access_http_error_status`, `access_body_not_robots`, `access_body_too_large`, `access_fallback_unavailable`.

item.competitors[].aiAccess.measurement — object

Field	Type	Description
`status`	`string`	`measured`, `measured_no_policy_found` (a real 404 — the site publishes no robots.txt, which under the standard allows every crawler), or `could_not_measure`. Check this before reading anything else: on `could_not_measure` there are no verdicts at all, and their absence is not openness.
`measuredAt`	`string`	When this was ATTEMPTED — which is when it was measured on any status other than `could_not_measure`, and on that one is the time we tried and failed rather than the time of a measurement. A single response carries one reading per domain and no history, so it supports ‘where do we stand’ and not ‘what changed’; a change question needs two responses taken apart.
`couldNotMeasureReason`	`string`	Why the read failed. Present only when `status` is `could_not_measure`.
`sourcesRead`	`object`	Which of the three control surfaces were actually read, each with its own outcome. Read this before quoting any verdict as complete: a `not_attempted` here is a limit of the check, not a property of the site. Nested — see the Example tab.
`explanations`	`array<object>`	Sentences this product is willing to say about the measurement, each with a stable `code` and the `text` to render verbatim. ABSENT when there is nothing that needs saying. It is never an empty array: emptiness would assert that we weighed what needed saying and concluded nothing did. Nested — see the Example tab.

item.competitors[].aiAccess.assistantAccess[] — each entry

Field	Type	Description
`assistantName`	`string`	The assistant, as its users know it.
`crawlerAccessStatus`	`string`	Whether this assistant can obtain this site’s content: `can_reach_site`, `cannot_reach_site`, `can_reach_part_of_site`, or `blocked_but_may_not_be_honoured` — the last meaning a rule is written against crawlers whose operators publish an exemption, so protection is not guaranteed. Count the assistants in this array to get totals; no count is stored. IT IS NOT A CITATION MEASUREMENT: it says an assistant is permitted to obtain the content, never that it mentions or cites this site. Note also that a `cannot_reach_site` may be decided by a crawler whose `crawlerPurpose` is `policy_token_does_not_crawl` — that is consistent, not contradictory: see that field.
`appliesTo`	`string`	`whole_site` or `homepage_only`. robots.txt is site-wide; `nosnippet` and NOARCHIVE are per page and we read the homepage, so a verdict leaning on them describes that page alone.
`decidedByCrawlers`	`array<object>`	The crawlers that decided this verdict — the names behind the status. Never publish the verdict without them: ‘blocked’ is a claim, ‘blocked because these two tokens are disallowed’ is a finding. Nested — see the Example tab.
`explanations`	`array<object>`	Sentences to render verbatim about THIS assistant. ABSENT when there is nothing to say — never an empty array, which would claim we considered what needed saying and found nothing. Nested — see the Example tab.

item.competitors[].aiAccess.modelTrainingAccess[] — each entry

Field	Type	Description
`modelOperatorName`	`string`	The operator whose training use is governed. Usually the company whose models are affected; `Common Crawl` is the exception — it trains nothing, but publishes the open corpus much training is built from, so a site owner blocking it is making this same decision.
`trainingAccessStatus`	`string`	`may_use_content_for_training`, `may_not_use_content_for_training`, `may_use_part_of_content_for_training`, or `blocked_but_may_not_be_honoured` — the last meaning a rule is written but the deciding crawler is not reliably bound by robots.txt, either because its operator publishes an exemption or because it is measured not to obey the file at all. Read `decidedByCrawlers[].honoursRobotsTxt` and `honoursRobotsTxtEvidence` to tell those two apart; they are different facts and only the second means the content should be treated as taken. AS A RULE, blocking training crawlers costs no AI visibility and is a legitimate content decision — do not report it as a problem, a gap, or something to undo. THE RULE HAS ONE EXCEPTION AND YOU MUST CHECK FOR IT: a few tokens govern training AND an assistant at once, `Google-Extended` being the documented case. Where the same crawler in `decidedByCrawlers` also appears under an entry in `assistantAccess`, that block DOES carry a visibility consequence and the exception applies — report it. The check is mechanical: match on `userAgentToken`. Never suppress a finding on the strength of the general rule without running it.
`decidedByCrawlers`	`array<object>`	The crawlers that decided this verdict. Match their `userAgentToken` against the tokens under `assistantAccess[].decidedByCrawlers` to find the dual-purpose case the status description warns about. Nested — see the Example tab.
`explanations`	`array<object>`	Sentences to render verbatim about THIS operator. ABSENT when there is nothing to say — never an empty array, which would claim we considered what needed saying and found nothing. Nested — see the Example tab.

item.competitors[].aiAccess.rulesThatMayNotWork[] — each entry

Field	Type	Description
`userAgentInFile`	`string`	The user agent exactly as the site wrote it, so they can find the line.
`directiveInFile`	`string`	The directive as written.
`whyItMayNotWork`	`string`	Why the rule may not have effect. `operator_exempts_user_initiated_requests`: the operator publishes that robots.txt may not apply when a person asks for the page directly, so the rule is a request rather than protection. `crawler_does_not_honour_robots_txt`: a published study observed it fetching pages after being disallowed. Both point at the crawler’s operator. A third cause — a token we do not recognise — is deliberately NOT reported per rule; see `additionalObservations` for our coverage, stated once. Values: `operator_exempts_user_initiated_requests`, `crawler_does_not_honour_robots_txt`.
`explanation`	`object`	The sentence to render verbatim, naming the operator and citing evidence. Nested — see the Example tab.

item.competitors[].aiAccess.rulesWithUnintendedScope[] — each entry

Field	Type	Description
`userAgentInFile`	`string`	The user agent exactly as the site wrote it, so they can find the group.
`kind`	`string`	`escapes_restrictions_others_get` — the only kind emitted. The site’s `User-agent: *` group disallows these paths, and naming this crawler in a group of its own REPLACES that group for it rather than adding to it, so the crawler is permitted where the rest of the web is not. Values: `escapes_restrictions_others_get`.
`affectedRules`	`array<string>`	The wildcard-group directives this crawler is exempt from, verbatim as written in the file. A FLOOR, not the complete list: only directives closing a content area are reported, so ordinary hygiene paths a crawler also escapes — `/wp-admin/`, `/cgi-bin/`, `/feed/` — are deliberately omitted as findings that cost the reader nothing. Belongs to THIS crawler alone; two crawlers in one file can escape different subsets, so never quote one finding’s list against another’s name.
`explanation`	`object`	The sentence to render verbatim. It states the mechanism and stops: whether the exemption was intended is not something we can measure, and privileging AI crawlers over other traffic is a legitimate strategy. Do not report this as an error. Nested — see the Example tab.

item.competitors[].aiAccess.additionalObservations[] — each entry

Field	Type	Description
`code`	`string`	Stable identifier, so a consumer can branch without parsing prose.
`text`	`string`	The sentence. Render it verbatim; do not paraphrase or substitute your own.

item.competitors[].dnsInfrastructure.emailProviderAvailable — object

Field	Type	Description
`available`	`boolean`	Always false for this discriminator.
`reason`	`string`	Why this provider is unknown: the DNS query for it never resolved this run (timeout, refused, or the resolver was unreachable), so nothing was measured. Distinct from a domain that publishes no such records, or publishes records we don’t attribute to a provider we track — both of those are measured results and carry no discriminator. Values: `dns_lookup_failed`.

item.competitors[].dnsInfrastructure.dnsProviderAvailable — object

Field	Type	Description
`available`	`boolean`	Always false for this discriminator.
`reason`	`string`	Why this provider is unknown: the DNS query for it never resolved this run (timeout, refused, or the resolver was unreachable), so nothing was measured. Distinct from a domain that publishes no such records, or publishes records we don’t attribute to a provider we track — both of those are measured results and carry no discriminator. Values: `dns_lookup_failed`.

Errors

Status	Code	Meaning
401	`api_key_missing` · `api_key_invalid` · `api_key_revoked` · `api_key_expired` · `insufficient_scope`	The `CL-API-Key` is missing, malformed, revoked, expired, or lacks the required scope.
404	`run_not_found` · `run_not_summarized`	No `run` matches the id in the path.

Every error uses the shared { error: { code, message, status } } envelope; code is one of the values listed above.


{
  "error": {
    "code": "api_key_invalid",
    "message": "Invalid API key",
    "status": 401
  }
}