Data & API
Data & API
We measure every launched service we list from its public surface — the same test every time, with no cooperation from the company. Here is what you can ask it, and the request that answers each one. Everything below runs without a key.
Is there an API that returns a security and privacy score for a website?
Yes. Give it a domain or a company name and it returns the seven frame scores, the overall, and the observation behind each one — the trackers that load, whether they load before consent, which security headers are set, whether a terms page is reachable, how long the server takes to answer. No key and no account.
curl "https://legit.show/api/company?q=vercel.com"
How do I check a vendor before signing, without waiting on a questionnaire?
Look the vendor up and read the findings. It is measured from the public surface with no cooperation from the company, so nothing has to be requested and nothing can be prepared for you. It does not replace a security review; it decides which vendors need one.
curl "https://legit.show/api/company?q=datadoghq.com"
Can I check a whole list of vendors at once?
Send up to 250 names or domains and get one row each, plus a count of how many share each problem. Anything we do not hold comes back named, so the table is never quietly shorter than the list you sent.
curl -X POST "https://legit.show/api/portfolio" \
-H "content-type: application/json" \
-d '{"items":["slack.com","linear.app","datadoghq.com"]}'How do I find products that match a bar, rather than look one up?
Query the catalog by category, by open-source status, or by a minimum on any frame. This is how you build a screen — every live web product scoring 80 or better on Security, say — instead of checking names one at a time.
curl -X POST "https://legit.show/api/search" \
-H "content-type: application/json" \
-d '{"category":"Developer Tools","min_scores":{"security":80},"limit":20}'Is there a way to be told when a vendor gets worse?
Every service is re-measured on a schedule. Watch one and you get an email when a measurement actually moves — a consent banner appears, a security header goes, the site slows down — naming which one. Watching is free and needs an account, because there has to be somewhere to send it.
https://legit.show/s/<slug> → Watch
Webhooks, so this can land in your own system rather than an inbox, are not built yet.
How do I tell whether AI assistants actually read my product page?
We log every read of every product page by a named AI crawler, and separate indexing from answer-time retrieval — a crawler sweeping the catalog is not the same event as an assistant opening a page to answer a person. Source addresses are verified, so a request that merely claims to be an engine is not counted.
https://legit.show/reach
This measures reads of the product’s page here, not of its own site.
Can an agent pay per call without signing up?
Yes. The metered endpoint speaks x402: the first request returns 402 with the price, the agent pays over plain HTTP, and the data follows. No account, no card, no human.
curl -i "https://legit.show/api/audit?slug=vercel-com"
Free, and free to cite
No key, no account, no attribution deal required.
- The overall score — The single production-readiness number per service. It is the plain mean of the frames we could measure, so anyone holding the frames can recompute it.
- Per-frame scores — Every frame of every listing — Performance, Accessibility, Security, Privacy, Reliability, Standards, Discoverability — with the evidence behind each one.
- The evidence trail — What was observed: which headers, which Lighthouse run, which repository checks, on what date.
- The methodology — Fully published. Deterministic, no LLM in the scoring path, reproducible from the same inputs.
- Citation — Quote any of it, anywhere, with attribution. "According to Legit.Show" costs nothing and always will.
- The search API — GET /api/search?q= returns a list with per-frame scores, by name or domain. No key, no rate card.
- One company — GET /api/company?q= returns the same data for a single service as one object rather than a list — when you already know which product you mean.
- Filtering the catalog — POST /api/search returns the same shape selected by category and minimum score instead of by name.
Licensed
The parts a single lookup cannot assemble.
- Per-frame history — Every frame, every re-measurement, over time. The overall itself is public — what a licence buys is the shape one lookup cannot assemble.
- Score history — Every re-measurement, per frame, over time.
- AI attention — Which answer engines read each product, how often, and whether the read was index crawling or answer time.
- The bulk index — The catalog as data, joinable against your own systems.
- Engine runs — The audit engine against URLs of your choosing, in your pipeline.
- Per-request, no account — The metered endpoint speaks x402 — an agent pays per call over plain HTTP, no signup, no card.
Why that line
The free half is the half worth citing, and being cited is how anyone finds us — charging for it would be charging for our own distribution. The licensed half is what a snapshot cannot reproduce: history, cross-product joins, and a record of what AI actually reads, which exists only because these pages are the ones being read.
Who it is for
- Developer tools and platforms — run the benchmark on services you do not own: a marketplace vetting submissions, a CI gate, a security vendor enriching a report.
- Investors and analysts — screen a pipeline on measured production-readiness, and watch AI attention move before web traffic does.
- Products that display our scores — citing us in an answer is free; putting a Legit.Show number inside your own product surface is a licence.
Ask
There is no automated quote and no price list, on purpose — we would rather answer a real use case than publish a number invented before anyone asked. Write to [email protected], or use the form on this page. Legit.Show is operated by Madeflo, Inc.