Tech & Trust

REST endpoints for Tech & Trust. Base URL https://api.competlab.com; every request needs a CL-API-Key header (see Authentication). Responses wrap in { item } or { items }; errors in { error }.

Get latest tech & trust data

GET/v1/projects/{projectId}/tech-trust

Get the latest tech & trust profile data for all competitors in a project. Returns security headers, trust signals, technology stack, robots.txt analysis, and DNS infrastructure.

Returns · { item }

Path parameters

Name	Type	Description
`projectId`	`string`	Project ID

Request


curl "https://api.competlab.com/v1/projects/507f1f77bcf86cd799439011/tech-trust" \
  -H "CL-API-Key: YOUR_COMPETLAB_API_KEY"

Response 200 OK

Example


{
  "item": {
    "lastUpdatedAt": "2026-03-15T10:00:00.000Z",
    "summary": {
      "competitorsChecked": 6,
      "competitorsSuccessful": 5,
      "customer": {
        "domain": "yoursite.com",
        "securityGrade": "B",
        "securityScore": 72,
        "securitySignalsAvailable": {
          "available": false,
          "reason": "site_uses_behavioral_protection"
        },
        "trustSignalCount": 8,
        "techStackCount": 14,
        "blockedAiBotsCount": 0,
        "allowsAiAccess": true
      },
      "topSecurityCompetitor": {
        "domain": "rival.com",
        "securityGrade": "A",
        "securityScore": 95
      },
      "topTrustCompetitor": {
        "domain": "other.com",
        "trustSignalCount": 15
      },
      "securityScoreGap": -23,
      "trustSignalGap": -7
    },
    "competitors": [
      {
        "domain": "competitor.com",
        "isOwn": false,
        "securityHeaders": {
          "grade": "A",
          "score": 85,
          "hsts": true,
          "csp": true,
          "xFrameOptions": true,
          "xContentTypeOptions": true,
          "signalsAvailable": {
            "available": false,
            "reason": "site_uses_behavioral_protection"
          }
        },
        "trustSignals": {
          "totalCount": 10,
          "categories": {
            "compliance": 3,
            "reviews": 4,
            "socialProof": 2,
            "certifications": 1
          }
        },
        "technologyStack": {
          "tech": [
            "React",
            "Next.js",
            "TypeScript"
          ],
          "growth": [
            "Google Analytics",
            "HubSpot"
          ],
          "engagement": [
            "Intercom",
            "Zendesk"
          ],
          "totalCount": 12
        },
        "robotsTxt": {
          "exists": true,
          "aiBotsBlocked": [
            "GPTBot",
            "ClaudeBot"
          ],
          "totalRules": 5
        },
        "dnsInfrastructure": {
          "emailProvider": "Google Workspace",
          "dnsProvider": "Cloudflare"
        }
      }
    ]
  }
}

Fields

item — object

Field	Type	Description
`lastUpdatedAt`	`string`	When this data was last updated (ISO-8601)
`summary`	`object`	Run summary with competitive gap analysis. See `item.summary`.
`competitors`	`array<object>`	Per-competitor tech & trust data. See `item.competitors[]`.

item.summary — object

Field	Type	Description
`competitorsChecked`	`number`	Number of competitors checked in this run
`competitorsSuccessful`	`number`	Number of competitors successfully checked
`customer`	`object`	Your domain’s key metrics. See `item.summary.customer`.
`topSecurityCompetitor`	`object \| null`	Competitor with the highest security score, or null if no competitors checked. Nullable. See `item.summary.topSecurityCompetitor`.
`topTrustCompetitor`	`object \| null`	Competitor with the most trust signals, or null if no competitors checked. Nullable. See `item.summary.topTrustCompetitor`.
`securityScoreGap`	`number`	Your security score minus top competitor score (negative = you are behind)
`trustSignalGap`	`number`	Your trust signal count minus top competitor count (negative = you are behind)

item.competitors[] — each entry

Field	Type	Description
`domain`	`string`	Competitor domain
`isOwn`	`boolean`	Whether this is the project’s own domain
`securityHeaders`	`object`	Security headers analysis. See `item.competitors[].securityHeaders`.
`trustSignals`	`object`	Trust signals and compliance badges. See `item.competitors[].trustSignals`.
`technologyStack`	`object`	Detected technology stack. See `item.competitors[].technologyStack`.
`robotsTxt`	`object`	Robots.txt analysis and AI bot blocking. See `item.competitors[].robotsTxt`.
`dnsInfrastructure`	`object`	DNS and email infrastructure. See `item.competitors[].dnsInfrastructure`.

item.summary.customer — object

Field	Type	Description
`domain`	`string`	Your domain
`securityGrade`	`string \| null`	Your security grade, or null if check failed. Values: `A`, `B`, `C`, `D`, `F`. Nullable.
`securityScore`	`number \| null`	Your security score (0-100), or null if check failed. Nullable.
`securitySignalsAvailable`	`object`	Honest-degradation discriminator. Present only when your own domain runs behavioral protection that blocks header inspection (~1.1% of sites). When present, `securityGrade` and `securityScore` above are forced to `null` so dashboards never surface F-grade placeholder values. Absent on healthy scans (the normal path). See `item.summary.customer.securitySignalsAvailable`.
`trustSignalCount`	`number`	Number of trust signals detected on your domain
`techStackCount`	`number`	Number of technologies detected on your domain
`blockedAiBotsCount`	`number`	Number of AI bots blocked by your robots.txt
`allowsAiAccess`	`boolean`	Whether your domain allows AI crawler access

item.summary.topSecurityCompetitor — object

Field	Type	Description
`domain`	`string`	Top security competitor domain
`securityGrade`	`string`	Their security grade. Values: `A`, `B`, `C`, `D`, `F`.
`securityScore`	`number`	Their security score (0-100)

item.summary.topTrustCompetitor — object

Field	Type	Description
`domain`	`string`	Top trust signals competitor domain
`trustSignalCount`	`number`	Their trust signal count

item.competitors[].securityHeaders — object

Field	Type	Description
`grade`	`string`	Overall security grade. Values: `A`, `B`, `C`, `D`, `F`.
`score`	`number`	Security score (0-100)
`hsts`	`boolean`	Has HTTP Strict Transport Security header
`csp`	`boolean`	Has Content Security Policy header
`xFrameOptions`	`boolean`	Has X-Frame-Options header
`xContentTypeOptions`	`boolean`	Has X-Content-Type-Options header
`signalsAvailable`	`object`	Honest-degradation discriminator. Present only when the upstream homepage fetch couldn’t recover response headers (~1.1% of sites running behavioral protection that blocks header inspection). When present, all other fields in this object — `grade`, `score`, `hsts`, `csp`, `xFrameOptions`, `xContentTypeOptions` — are placeholder values (the fallback ‘no headers detected’ shape), not a real ‘this site has no security headers’ result. Absent on healthy scans (the normal path). See `item.competitors[].securityHeaders.signalsAvailable`.

item.competitors[].trustSignals — object

Field	Type	Description
`totalCount`	`number`	Total number of trust signals detected
`categories`	`object`	Trust signals broken down by category. See `item.competitors[].trustSignals.categories`.

item.competitors[].technologyStack — object

Field	Type	Description
`tech`	`array<string>`	Core technology stack (frameworks, languages, infrastructure)
`growth`	`array<string>`	Growth and marketing tools (analytics, ads, SEO)
`engagement`	`array<string>`	Customer engagement tools (chat, support, CRM)
`totalCount`	`number`	Total number of technologies detected

item.competitors[].robotsTxt — object

Field	Type	Description
`exists`	`boolean`	Whether a robots.txt file exists
`aiBotsBlocked`	`array<string>`	AI bots explicitly blocked in robots.txt
`totalRules`	`number`	Total number of disallow rules

item.competitors[].dnsInfrastructure — object

Field	Type	Description
`emailProvider`	`string`	Email service provider
`dnsProvider`	`string`	DNS hosting provider

item.summary.customer.securitySignalsAvailable — object

Field	Type	Description
`available`	`boolean`	Always false for this discriminator.
`reason`	`string`	Why signals are unavailable. Known sub-classes are documented; new behavioral-protection categories may be classified over time. Values: `site_uses_behavioral_protection`.

item.competitors[].securityHeaders.signalsAvailable — object

Field	Type	Description
`available`	`boolean`	Always false for this discriminator.
`reason`	`string`	Why signals are unavailable. Known sub-classes are documented; new behavioral-protection categories may be classified over time. Values: `site_uses_behavioral_protection`.

item.competitors[].trustSignals.categories — object

Field	Type	Description
`compliance`	`number`	Number of compliance signals (SOC2, ISO27001, HIPAA, GDPR, CCPA)
`reviews`	`number`	Number of review platform badges (G2, Capterra, Trustpilot, etc.)
`socialProof`	`number`	Number of social proof signals (customer logos, counts, case studies)
`certifications`	`number`	Number of certifications

Errors

Status	Code	Meaning
401	`api_key_missing` · `api_key_invalid` · `api_key_revoked` · `api_key_expired` · `insufficient_scope`	The `CL-API-Key` is missing, malformed, revoked, expired, or lacks the required scope.
404	`project_not_found`	No `project` matches the id in the path.

Every error uses the shared { error: { code, message, status } } envelope; code is one of the values listed above.


{
  "error": {
    "code": "api_key_invalid",
    "message": "Invalid API key",
    "status": 401
  }
}

Get tech & trust run history

GET/v1/projects/{projectId}/tech-trust/history

Get paginated history of tech & trust monitoring runs for a project. Each entry includes run timing and summary statistics.

Returns · { items, pagination }

Path parameters

Name	Type	Description
`projectId`	`string`	Project ID

Query parameters

Name	Type	Required	Description
`page`	`number`		Page number (1-indexed). Default `1`. Min `1`.
`limit`	`number`		Number of items per page. Default `20`. Range `1`–`100`.

Request


curl "https://api.competlab.com/v1/projects/507f1f77bcf86cd799439011/tech-trust/history?page=1&limit=20" \
  -H "CL-API-Key: YOUR_COMPETLAB_API_KEY"

Response 200 OK

Example


{
  "items": [
    {
      "runId": "507f1f77bcf86cd799439011",
      "completedAt": "2026-03-15T10:00:00.000Z",
      "summary": {
        "competitorsChecked": 6,
        "competitorsSuccessful": 5,
        "customer": {
          "domain": "yoursite.com",
          "securityGrade": "B",
          "securityScore": 72,
          "securitySignalsAvailable": {
            "available": false,
            "reason": "site_uses_behavioral_protection"
          },
          "trustSignalCount": 8,
          "techStackCount": 14,
          "blockedAiBotsCount": 0,
          "allowsAiAccess": true
        },
        "topSecurityCompetitor": {
          "domain": "rival.com",
          "securityGrade": "A",
          "securityScore": 95
        },
        "topTrustCompetitor": {
          "domain": "other.com",
          "trustSignalCount": 15
        },
        "securityScoreGap": -23,
        "trustSignalGap": -7
      }
    }
  ],
  "pagination": {
    "page": 1,
    "limit": 20,
    "total": 47,
    "totalPages": 3,
    "hasMore": true
  }
}

Fields

items[] — each entry

Field	Type	Description
`runId`	`string`	Run ID
`completedAt`	`string`	When this run completed (ISO-8601)
`summary`	`object`	Run summary statistics. See `items[].summary`.

pagination — object

Field	Type	Description
`page`	`number`	Current page number (1-indexed)
`limit`	`number`	Number of items per page
`total`	`number`	Total number of items across all pages
`totalPages`	`number`	Total number of pages
`hasMore`	`boolean`	Whether more pages exist after the current page

items[].summary — object

Field	Type	Description
`competitorsChecked`	`number`	Number of competitors checked in this run
`competitorsSuccessful`	`number`	Number of competitors successfully checked
`customer`	`object`	Your domain’s key metrics. See `items[].summary.customer`.
`topSecurityCompetitor`	`object \| null`	Competitor with the highest security score, or null if no competitors checked. Nullable. See `items[].summary.topSecurityCompetitor`.
`topTrustCompetitor`	`object \| null`	Competitor with the most trust signals, or null if no competitors checked. Nullable. See `items[].summary.topTrustCompetitor`.
`securityScoreGap`	`number`	Your security score minus top competitor score (negative = you are behind)
`trustSignalGap`	`number`	Your trust signal count minus top competitor count (negative = you are behind)

items[].summary.customer — object

Field	Type	Description
`domain`	`string`	Your domain
`securityGrade`	`string \| null`	Your security grade, or null if check failed. Values: `A`, `B`, `C`, `D`, `F`. Nullable.
`securityScore`	`number \| null`	Your security score (0-100), or null if check failed. Nullable.
`securitySignalsAvailable`	`object`	Honest-degradation discriminator. Present only when your own domain runs behavioral protection that blocks header inspection (~1.1% of sites). When present, `securityGrade` and `securityScore` above are forced to `null` so dashboards never surface F-grade placeholder values. Absent on healthy scans (the normal path). See `items[].summary.customer.securitySignalsAvailable`.
`trustSignalCount`	`number`	Number of trust signals detected on your domain
`techStackCount`	`number`	Number of technologies detected on your domain
`blockedAiBotsCount`	`number`	Number of AI bots blocked by your robots.txt
`allowsAiAccess`	`boolean`	Whether your domain allows AI crawler access

items[].summary.topSecurityCompetitor — object

Field	Type	Description
`domain`	`string`	Top security competitor domain
`securityGrade`	`string`	Their security grade. Values: `A`, `B`, `C`, `D`, `F`.
`securityScore`	`number`	Their security score (0-100)

items[].summary.topTrustCompetitor — object

Field	Type	Description
`domain`	`string`	Top trust signals competitor domain
`trustSignalCount`	`number`	Their trust signal count

items[].summary.customer.securitySignalsAvailable — object

Field	Type	Description
`available`	`boolean`	Always false for this discriminator.
`reason`	`string`	Why signals are unavailable. Known sub-classes are documented; new behavioral-protection categories may be classified over time. Values: `site_uses_behavioral_protection`.

Paginated — pass page and limit query parameters and follow pagination.hasMore to page through the full set.

Errors

Status	Code	Meaning
401	`api_key_missing` · `api_key_invalid` · `api_key_revoked` · `api_key_expired` · `insufficient_scope`	The `CL-API-Key` is missing, malformed, revoked, expired, or lacks the required scope.

Every error uses the shared { error: { code, message, status } } envelope; code is one of the values listed above.


{
  "error": {
    "code": "api_key_invalid",
    "message": "Invalid API key",
    "status": 401
  }
}

Get tech & trust data for a specific run

GET/v1/projects/{projectId}/tech-trust/history/{runId}

Get full tech & trust data for a specific historical monitoring run, including per-competitor security headers, trust signals, technology stack, robots.txt, and DNS infrastructure.

Returns · { item }

Path parameters

Name	Type	Description
`runId`	`string`	Run ID
`projectId`	`string`	Project ID

Request


curl "https://api.competlab.com/v1/projects/507f1f77bcf86cd799439011/tech-trust/history/507f1f77bcf86cd799439012" \
  -H "CL-API-Key: YOUR_COMPETLAB_API_KEY"

Response 200 OK

Example


{
  "item": {
    "runId": "507f1f77bcf86cd799439011",
    "completedAt": "2026-03-15T10:00:00.000Z",
    "summary": {
      "competitorsChecked": 6,
      "competitorsSuccessful": 5,
      "customer": {
        "domain": "yoursite.com",
        "securityGrade": "B",
        "securityScore": 72,
        "securitySignalsAvailable": {
          "available": false,
          "reason": "site_uses_behavioral_protection"
        },
        "trustSignalCount": 8,
        "techStackCount": 14,
        "blockedAiBotsCount": 0,
        "allowsAiAccess": true
      },
      "topSecurityCompetitor": {
        "domain": "rival.com",
        "securityGrade": "A",
        "securityScore": 95
      },
      "topTrustCompetitor": {
        "domain": "other.com",
        "trustSignalCount": 15
      },
      "securityScoreGap": -23,
      "trustSignalGap": -7
    },
    "competitors": [
      {
        "domain": "competitor.com",
        "isOwn": false,
        "securityHeaders": {
          "grade": "A",
          "score": 85,
          "hsts": true,
          "csp": true,
          "xFrameOptions": true,
          "xContentTypeOptions": true,
          "signalsAvailable": {
            "available": false,
            "reason": "site_uses_behavioral_protection"
          }
        },
        "trustSignals": {
          "totalCount": 10,
          "categories": {
            "compliance": 3,
            "reviews": 4,
            "socialProof": 2,
            "certifications": 1
          }
        },
        "technologyStack": {
          "tech": [
            "React",
            "Next.js",
            "TypeScript"
          ],
          "growth": [
            "Google Analytics",
            "HubSpot"
          ],
          "engagement": [
            "Intercom",
            "Zendesk"
          ],
          "totalCount": 12
        },
        "robotsTxt": {
          "exists": true,
          "aiBotsBlocked": [
            "GPTBot",
            "ClaudeBot"
          ],
          "totalRules": 5
        },
        "dnsInfrastructure": {
          "emailProvider": "Google Workspace",
          "dnsProvider": "Cloudflare"
        }
      }
    ]
  }
}

Fields

item — object

Field	Type	Description
`runId`	`string`	Run ID
`completedAt`	`string`	When this run completed (ISO-8601)
`summary`	`object`	Run summary statistics. See `item.summary`.
`competitors`	`array<object>`	Per-competitor tech & trust data for this run. See `item.competitors[]`.

item.summary — object

Field	Type	Description
`competitorsChecked`	`number`	Number of competitors checked in this run
`competitorsSuccessful`	`number`	Number of competitors successfully checked
`customer`	`object`	Your domain’s key metrics. See `item.summary.customer`.
`topSecurityCompetitor`	`object \| null`	Competitor with the highest security score, or null if no competitors checked. Nullable. See `item.summary.topSecurityCompetitor`.
`topTrustCompetitor`	`object \| null`	Competitor with the most trust signals, or null if no competitors checked. Nullable. See `item.summary.topTrustCompetitor`.
`securityScoreGap`	`number`	Your security score minus top competitor score (negative = you are behind)
`trustSignalGap`	`number`	Your trust signal count minus top competitor count (negative = you are behind)

item.competitors[] — each entry

Field	Type	Description
`domain`	`string`	Competitor domain
`isOwn`	`boolean`	Whether this is the project’s own domain
`securityHeaders`	`object`	Security headers analysis. See `item.competitors[].securityHeaders`.
`trustSignals`	`object`	Trust signals and compliance badges. See `item.competitors[].trustSignals`.
`technologyStack`	`object`	Detected technology stack. See `item.competitors[].technologyStack`.
`robotsTxt`	`object`	Robots.txt analysis and AI bot blocking. See `item.competitors[].robotsTxt`.
`dnsInfrastructure`	`object`	DNS and email infrastructure. See `item.competitors[].dnsInfrastructure`.

item.summary.customer — object

Field	Type	Description
`domain`	`string`	Your domain
`securityGrade`	`string \| null`	Your security grade, or null if check failed. Values: `A`, `B`, `C`, `D`, `F`. Nullable.
`securityScore`	`number \| null`	Your security score (0-100), or null if check failed. Nullable.
`securitySignalsAvailable`	`object`	Honest-degradation discriminator. Present only when your own domain runs behavioral protection that blocks header inspection (~1.1% of sites). When present, `securityGrade` and `securityScore` above are forced to `null` so dashboards never surface F-grade placeholder values. Absent on healthy scans (the normal path). See `item.summary.customer.securitySignalsAvailable`.
`trustSignalCount`	`number`	Number of trust signals detected on your domain
`techStackCount`	`number`	Number of technologies detected on your domain
`blockedAiBotsCount`	`number`	Number of AI bots blocked by your robots.txt
`allowsAiAccess`	`boolean`	Whether your domain allows AI crawler access

item.summary.topSecurityCompetitor — object

Field	Type	Description
`domain`	`string`	Top security competitor domain
`securityGrade`	`string`	Their security grade. Values: `A`, `B`, `C`, `D`, `F`.
`securityScore`	`number`	Their security score (0-100)

item.summary.topTrustCompetitor — object

Field	Type	Description
`domain`	`string`	Top trust signals competitor domain
`trustSignalCount`	`number`	Their trust signal count

item.competitors[].securityHeaders — object

Field	Type	Description
`grade`	`string`	Overall security grade. Values: `A`, `B`, `C`, `D`, `F`.
`score`	`number`	Security score (0-100)
`hsts`	`boolean`	Has HTTP Strict Transport Security header
`csp`	`boolean`	Has Content Security Policy header
`xFrameOptions`	`boolean`	Has X-Frame-Options header
`xContentTypeOptions`	`boolean`	Has X-Content-Type-Options header
`signalsAvailable`	`object`	Honest-degradation discriminator. Present only when the upstream homepage fetch couldn’t recover response headers (~1.1% of sites running behavioral protection that blocks header inspection). When present, all other fields in this object — `grade`, `score`, `hsts`, `csp`, `xFrameOptions`, `xContentTypeOptions` — are placeholder values (the fallback ‘no headers detected’ shape), not a real ‘this site has no security headers’ result. Absent on healthy scans (the normal path). See `item.competitors[].securityHeaders.signalsAvailable`.

item.competitors[].trustSignals — object

Field	Type	Description
`totalCount`	`number`	Total number of trust signals detected
`categories`	`object`	Trust signals broken down by category. See `item.competitors[].trustSignals.categories`.

item.competitors[].technologyStack — object

Field	Type	Description
`tech`	`array<string>`	Core technology stack (frameworks, languages, infrastructure)
`growth`	`array<string>`	Growth and marketing tools (analytics, ads, SEO)
`engagement`	`array<string>`	Customer engagement tools (chat, support, CRM)
`totalCount`	`number`	Total number of technologies detected

item.competitors[].robotsTxt — object

Field	Type	Description
`exists`	`boolean`	Whether a robots.txt file exists
`aiBotsBlocked`	`array<string>`	AI bots explicitly blocked in robots.txt
`totalRules`	`number`	Total number of disallow rules

item.competitors[].dnsInfrastructure — object

Field	Type	Description
`emailProvider`	`string`	Email service provider
`dnsProvider`	`string`	DNS hosting provider

item.summary.customer.securitySignalsAvailable — object

Field	Type	Description
`available`	`boolean`	Always false for this discriminator.
`reason`	`string`	Why signals are unavailable. Known sub-classes are documented; new behavioral-protection categories may be classified over time. Values: `site_uses_behavioral_protection`.

item.competitors[].securityHeaders.signalsAvailable — object

Field	Type	Description
`available`	`boolean`	Always false for this discriminator.
`reason`	`string`	Why signals are unavailable. Known sub-classes are documented; new behavioral-protection categories may be classified over time. Values: `site_uses_behavioral_protection`.

item.competitors[].trustSignals.categories — object

Field	Type	Description
`compliance`	`number`	Number of compliance signals (SOC2, ISO27001, HIPAA, GDPR, CCPA)
`reviews`	`number`	Number of review platform badges (G2, Capterra, Trustpilot, etc.)
`socialProof`	`number`	Number of social proof signals (customer logos, counts, case studies)
`certifications`	`number`	Number of certifications

Errors

Status	Code	Meaning
401	`api_key_missing` · `api_key_invalid` · `api_key_revoked` · `api_key_expired` · `insufficient_scope`	The `CL-API-Key` is missing, malformed, revoked, expired, or lacks the required scope.
404	`run_not_found`	No `run` matches the id in the path.

Every error uses the shared { error: { code, message, status } } envelope; code is one of the values listed above.


{
  "error": {
    "code": "api_key_invalid",
    "message": "Invalid API key",
    "status": 401
  }
}