# Detection tests: Mosaic API reference

> Detection tests in Mosaic’s local REST API: 2 routes, each with its method, path, fields, what it returns and the errors it names.

Source: https://mosaicbrowser.com/docs/api/detection

**Preparing and testing** REST API

## Detection tests

The catalogue of third-party sites that will tell you whether a profile holds up, and opening a profile on one of them.

- [GETList the detection test catalogue](#detection-tests)
- [POSTOpen a profile on a detection test](#detection-open)

## [List the detection test catalogue](#detection-tests)

GET`/api/v1/detection-tests`

Every fingerprint, bot-detection, leak and WAF test site Mosaic knows about, each with what it measures and what a pass actually looks like. The same list drives the in-app picker and `scripts/run-detection-tests.mjs`, so a test that exists here is one you can both open by hand and run in a batch. Categories are `consistency`, `automation`, `uniqueness`, `leak` and `waf`; the common mistake is treating them as interchangeable, when a profile can pass every automation test and still fail every consistency one.

#### Query parameters

| Field | Type | What it is |
| --- | --- | --- |
| `category` | `string` | Return only one category. Default all. |

#### Returns

`{ tests: DetectionTest[], categories: [{ id, label, blurb }] }`

```
curl -H "Authorization: Bearer $KEY" \
  "$BASE/detection-tests?category=consistency"
```

## [Open a profile on a detection test](#detection-open)

POST`/api/v1/profiles/:id/detection-test`

Opens the test site in a new tab of the profile, starting the profile first if it is not already running. Deliberately returns no verdict: reading a third-party results panel is a heuristic over someone else’s markup, and a heuristic that silently reports a pass after a redesign is worse than no answer. Use this to look, and the runner script when you want a recorded result. Opening in a new tab rather than navigating the current one is intentional — a profile is a working session.

#### Path parameters

| Field | Type | What it is |
| --- | --- | --- |
| `id`required | `string` | The record’s id. |

#### Body

| Field | Type | What it is |
| --- | --- | --- |
| `testId`required | `string` | An id from `GET /detection-tests`, e.g. `creepjs`. |

#### Returns

`{ profileId, testId, url, started }` — `started` is true when the profile had to be launched.

#### Errors

- 400 — `testId` is missing.
- 400 — no test has that id.
- 404 — no profile has that id.

```
curl -X POST -H "Authorization: Bearer $KEY" \
  -H 'Content-Type: application/json' \
  -d '{"testId":"pixelscan"}' \
  "$BASE/profiles/$ID/detection-test"
```

## Run the API on your own profiles

The REST API and the MCP server are part of Pro: $49 a month, with the first 14 days free. Free has every browser feature and no API key.

Mosaic is a desktop app

Email yourself the link and open it on your computer.