Preparing and testing REST API
Detection tests
The catalogue of third-party sites that will tell you whether a profile holds up, and opening a profile on one of them.
List the detection test catalogue
GET/api/v1/detection-tests
Every fingerprint, bot-detection, leak and WAF test site Mosaic knows about, each with what it measures and what a pass actually looks like. The same list drives the in-app picker and scripts/run-detection-tests.mjs, so a test that exists here is one you can both open by hand and run in a batch. Categories are consistency, automation, uniqueness, leak and waf; the common mistake is treating them as interchangeable, when a profile can pass every automation test and still fail every consistency one.
Query parameters
| Field | Type | What it is |
|---|---|---|
category | string | Return only one category. Default all. |
Returns
{ tests: DetectionTest[], categories: [{ id, label, blurb }] }
curl -H "Authorization: Bearer $KEY" \
"$BASE/detection-tests?category=consistency"Open a profile on a detection test
POST/api/v1/profiles/:id/detection-test
Opens the test site in a new tab of the profile, starting the profile first if it is not already running. Deliberately returns no verdict: reading a third-party results panel is a heuristic over someone else’s markup, and a heuristic that silently reports a pass after a redesign is worse than no answer. Use this to look, and the runner script when you want a recorded result. Opening in a new tab rather than navigating the current one is intentional — a profile is a working session.
Path parameters
| Field | Type | What it is |
|---|---|---|
idrequired | string | The record’s id. |
Body
| Field | Type | What it is |
|---|---|---|
testIdrequired | string | An id from GET /detection-tests, e.g. creepjs. |
Returns
{ profileId, testId, url, started } — started is true when the profile had to be launched.
Errors
- 400 —
testIdis missing. - 400 — no test has that id.
- 404 — no profile has that id.
curl -X POST -H "Authorization: Bearer $KEY" \
-H 'Content-Type: application/json' \
-d '{"testId":"pixelscan"}' \
"$BASE/profiles/$ID/detection-test"Run the API on your own profiles
The REST API and the MCP server are part of Pro: $49 a month, with the first 14 days free. Free has every browser feature and no API key.
Mosaic is a desktop app
Email yourself the link and open it on your computer.