Read API

Everything public on this site is also readable as JSON, from the same data the pages render. No key, no registration — the endpoints below are open, rate-limited at the edge, and stable in shape. Authenticated write endpoints (ingest, catalog session registration) exist but are private to the observatory's own capture infrastructure and are not documented here.

Endpoints

endpoint	returns	parameters
`GET /api/v1/top/{signal}`	Ranked fingerprints for one family — the JSON twin of browse. Rows carry the dimension id, canonical value, deduplicated count, and first/last seen.	`window` = `24h`\|`7d`\|`30d`\|`all` (default 7d) · `new=1` only fingerprints first seen inside the window · `limit` 1–500 (default 100)
`GET /api/v1/fp/{signal}/{id}`	One fingerprint: canonical value, decomposed attributes, first/last seen, top co-observed fingerprints per family, and distinct clients per day for the last 30 days. Every fingerprint page links its own JSON.	—
`GET /api/v1/catalog`	The full controlled-client catalog: every published session with client/version/OS/engine provenance and its captures' fingerprints and wire tuples. Self-generated data, openly shareable.	—
`GET /api/v1/catalog.csv`	The catalog flattened to one row per capture, for spreadsheets and quick joins.	—
`GET /api/v1/probe`	The caller's own fingerprints, reflected as JSON — what the home page shows, machine-readable. This is the browser beacon's endpoint; each request is recorded as one deduplicated observation.	—

{signal} is one of: tls, http, h2, tcp, ja4t, qtp, ua, country, asn — the families defined on the about page. GET /api/v1 returns this endpoint list as JSON.

Examples

# your own stack
curl -s https://thumbprint.me/api/v1/probe | jq

# top TLS fingerprints this week
curl -s 'https://thumbprint.me/api/v1/top/tls?window=7d&limit=20' | jq '.rows[] | {key: .Key, count: .Count}'

# one fingerprint in full
curl -s https://thumbprint.me/api/v1/fp/tls/4 | jq

# the whole ground-truth catalog
curl -s https://thumbprint.me/api/v1/catalog | jq '.sessions | length'

Fair use

Read endpoints are rate-limited at the edge and the catalog exports are additionally served from a 300-second cache. Cache on your side too: the exports change only when capture waves run, and the rolled-up counts advance on the order of minutes, so sustained polling buys nothing. A client that stays under roughly one request per second will never notice the limits. Counting methodology, privacy posture, and what the numbers mean are on the about page.