Read API

Everything public on this site is also readable as JSON, from the same data the pages render. No key, no registration — the endpoints below are open and rate-limited at the edge. Within /api/v1, evolution is additive: clients must ignore unknown fields and tolerate omitted optional fields. Authenticated write endpoints (ingest, catalog session registration) exist but are private to the observatory's own capture infrastructure and are not documented here.

Endpoints

endpoint	returns	parameters
`GET /api/v1/top/{signal}`	Ranked fingerprints for one family — the JSON twin of browse. Rows carry the dimension id, canonical value, deduplicated count, and first/last seen.	`window` = `24h`\|`7d`\|`30d`\|`all` (default 30d) · `new=1` only fingerprints first seen inside the window · `limit` 1–500 (default 100)
`GET /api/v1/fp/{signal}/{id}`	One fingerprint: canonical value, decomposed attributes, first/last seen, top co-observed fingerprints per family, and distinct clients per day for the last 30 days. Every fingerprint page links its own JSON.	—
`GET /api/v1/catalog`	The full controlled-client catalog: every published session with client/version/OS/engine provenance and its captures' fingerprints and wire tuples. Self-generated, exportable research data.	—
`GET /api/v1/catalog.csv`	The catalog flattened to one row per capture, for spreadsheets and quick joins.	—
`GET /api/v1/probe`	The caller's own fingerprints, reflected as JSON — what the home page shows, machine-readable. This is the browser beacon's endpoint; each request is recorded as one deduplicated observation.	—

The JSON catalog does not yet carry an explicit schema-version field, and a formal dataset licence has not yet been published. Export availability should not be interpreted as a broader reuse grant. Both are release-readiness work; until then, consumers should pin their integration to /api/v1, retain the source URL and retrieval date, and treat additive fields as expected.

{signal} is one of: tls, http, h2, tcp, ja4t, qtp, ua, country, asn — the families defined on the about page. GET /api/v1 returns this endpoint list as JSON.

Examples

# your own stack
curl -s https://thumbprint.me/api/v1/probe | jq

# top TLS fingerprints this week
curl -s 'https://thumbprint.me/api/v1/top/tls?window=7d&limit=20' | jq '.rows[] | {key: .Key, count: .Count}'

# one fingerprint in full
curl -s https://thumbprint.me/api/v1/fp/tls/4 | jq

# the whole ground-truth catalog
curl -s https://thumbprint.me/api/v1/catalog | jq '.sessions | length'

Fair use

Read endpoints are rate-limited at the edge and the catalog exports are additionally served from a 300-second cache. Cache on your side too: the exports change only when capture waves run, and the rolled-up counts advance on the order of minutes, so sustained polling buys nothing. A client that stays under roughly one request per second will never notice the limits. Counting methodology, privacy posture, and what the numbers mean are on the about page.