WhatRuns API Documentation — There Isn't One

Searched for WhatRuns API docs? You won't find any. WhatRuns is a browser extension only. Here's the closest documented equivalent — a REST API with the same detection capabilities and a free tier.

The short answer

WhatRuns has no public API, no SDK, no documentation. It's a Chrome/Firefox extension that runs in-browser and shows results to the user. You cannot call it from code, you cannot integrate it into a pipeline, and you cannot batch-process URLs. If you need any of that, you need a different provider.

Why people search for "WhatRuns API documentation"

The browser extension is good at one thing: showing a developer the tech stack of the site they're looking at, right now, in their browser. That works for spot checks. It breaks down the moment you need to:

All of these need an API. WhatRuns doesn't expose one — so the "WhatRuns API documentation" search lands on either dead pages or competitor tools.

DetectZeStack: the API WhatRuns doesn't have

DetectZeStack is a REST API with the same kind of detection coverage as WhatRuns (frameworks, CMS, analytics, CDN, ads, libraries, security headers) plus things WhatRuns can't see (DNS CNAME analysis, TLS certificate metadata, CPE identifiers for vulnerability lookups). Full OpenAPI spec at /openapi.yaml.

30-second quick start

# Free tier — 100 requests/month, no credit card
# Sign up at https://rapidapi.com/mlugoapx/api/detectzestack

curl "https://detectzestack.p.rapidapi.com/analyze?url=stripe.com" \
  -H "X-RapidAPI-Key: YOUR_RAPIDAPI_KEY" \
  -H "X-RapidAPI-Host: detectzestack.p.rapidapi.com"

Sample response (truncated)

{
  "url": "https://stripe.com",
  "domain": "stripe.com",
  "technologies": [
    {
      "name": "Nginx",
      "categories": ["Web servers", "Reverse proxies"],
      "confidence": 100,
      "cpe": "cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*",
      "source": "http"
    },
    {
      "name": "Amazon S3",
      "categories": ["CDN"],
      "confidence": 100,
      "source": "http"
    }
  ],
  "categories": {
    "CDN": ["Amazon S3"],
    "Web servers": ["Nginx"]
  }
}

WhatRuns vs DetectZeStack at a glance

Capability WhatRuns DetectZeStack
REST APINoYes
OpenAPI / Swagger docsNone/openapi.yaml
API keyN/AFree tier, no credit card
Batch (multiple URLs)NoUp to 10 URLs / request
DNS CNAME analysisNoYes (CDN/hosting detection)
TLS certificate metadataNoYes (issuer, expiry, chain)
CPE identifiersNoYes (when available)
Webhook on stack changeNoYes
Works server-side (no browser)NoYes
PricingFree (extension only)Free tier; paid from $9/mo

Endpoint catalog

14 endpoints in total. Full schemas in the OpenAPI spec. The most-used ones:

GET/analyze?url=…
Full tech stack detection. Returns 15–40 technologies on most sites with confidence scores, CPE identifiers, and source (http / dns / tls).
GET/check?url=…&tech=…
Yes/no lookup for one specific technology. Useful for lead qualification ("does this site use Shopify?").
GET/dns?url=…
DNS-based CDN / hosting detection. Works even when HTTP headers are stripped.
GET/certificate/check?url=…
TLS certificate issuer, expiry, chain validity, cipher suite.
GET/security?url=…
Security headers audit (HSTS, CSP, X-Frame-Options, etc.) with a graded score.
POST/webhook
Register a webhook to receive analysis results asynchronously and on a schedule.

Frequently asked questions

Where is the WhatRuns API documentation?

There is none — WhatRuns has no public API. The product is exclusively a browser extension for Chrome and Firefox. No REST endpoint, no key, no SDK, no docs.

Does WhatRuns publish a REST API or SDK?

No. There's no programmatic access at all. If you need a tech-detection API, look at DetectZeStack, BuiltWith (expensive), or Wappalyzer (also expensive).

What's the closest equivalent to a WhatRuns API?

DetectZeStack — same coverage, REST API, free tier (100 req/mo), paid from $9/mo. It also covers DNS and TLS detection, which browser extensions cannot do.

Is there any way to call WhatRuns programmatically?

No supported way. Some developers have tried scraping the extension's internal endpoints — those are undocumented and break without warning. Don't ship anything that depends on them.

Where can I find example requests and response schemas?

DetectZeStack's full OpenAPI spec covers every endpoint with request/response shapes, error codes, and auth. Import it into Postman, Insomnia, or any OpenAPI tool. We also publish a Postman collection.

Get a working API in 30 seconds

100 free requests/month. No credit card. Real docs.

Get Free API Key

Related Reading