Every API, one clean contract.

Full privacy report for a URL: third-party trackers + cookies + consent/CMP + tracking pixels + fingerprinting + 0-100 privacy score + GDPR risk + ranked fixes. One call.

{
  "url": "https://www.cnn.com"
}

Third-party + first-party tracker list: per-host entity/owner, category (advertising/analytics/social/session_replay/…), first-vs-third-party, load surface.

{
  "url": "https://www.cnn.com"
}

Server-set cookie analysis: first/third-party, Secure/HttpOnly/SameSite/expiry flags, and tracking-purpose classification (_ga/_fbp/_gcl_au/… → owner+purpose).

{
  "url": "https://www.cnn.com"
}

Consent-management platform (CMP) detection: OneTrust/Cookiebot/Usercentrics/Quantcast/TrustArc/Didomi/Sourcepoint/Iubenda/… + IAB-TCF v2 + Google Consent Mode.

{
  "url": "https://www.cnn.com"
}

Browser-fingerprinting detection: canvas, WebGL, audio, font and device code patterns plus known fingerprinting libraries (FingerprintJS, ThreatMetrix, and similar SDKs).

{
  "url": "https://www.cnn.com"
}

Composite privacy score (0-100, higher=more private) + grade + GDPR risk verdict (minimal/low/medium/high/critical) + ranked recommendations + transparent penalties.

{
  "url": "https://www.nytimes.com"
}

Scan up to 20 URLs concurrently in one call (each independently SSRF-guarded). Compact per-URL privacy_score + grade + gdpr_risk + tracker/cookie counts. NOTE: batch is the fast bulk path — it runs static (no per-URL render, to stay within latency for 20 URLs); per-URL likely_js_app flags JS shells. For the full runtime graph, call `scan` per URL (render defaults on).

{
  "urls": [
    "https://www.cnn.com",
    "https://www.theguardian.com"
  ]
}