Data and API

Endpoints

All of them are GET. Anything else answers 405: corrections go through the form so a human reads them. Access-Control-Allow-Origin: * is set, so you can call them from a browser.

Fields every response carries

The three states, and the fourth thing that is not a state

A quoted detail carries a fourth thing, and it is not a state but a subject: whose sentence it is. anbieter (the vendor itself), infrastruktur (their data centres or infrastructure), dienstleister (a named provider of theirs), erwaehnt (named without a certification claim), unklar (unclear from the sentence). Only anbieter is aggregated into a value page – a sentence about a vendor's data centre does not belong in a list called “vendors that name ISO 27001 for themselves”.

The score

The score is Transparency Score v1: the share of the summed weights of 12 criteria that we found. It is frozen. Adding a criterion would change every figure ever published, including the one in a procurement file from last week, without the vendor doing anything; new criteria are therefore measured and returned as facts and do not enter the figure. Below 9 measured criteria there is no score at all – score is null, never 0.

The 12 criteria

The 10 detail types

A response, in full

{
  "snapshot": "r6.60658",
  "snapshot_run": 6,
  "score_version": "v1",
  "license": "CC BY 4.0",
  "domain": "example.com",
  "score": 68,
  "measured": 12,
  "of": 12,
  "criteria": {
    "dpa": {
      "result": "found",
      "source": "https://example.com/legal/dpa",
      "checked": [
        {
          "url": "https://example.com/dpa",
          "outcome": "404"
        },
        {
          "url": "https://example.com/legal/dpa",
          "outcome": "200"
        }
      ],
      "note": null,
      "measured_on": "2026-09-04T02:41:18.000Z"
    },
    "security_txt": {
      "result": "not_found",
      "source": null,
      "checked": [
        {
          "url": "https://example.com/.well-known/security.txt",
          "outcome": "404"
        }
      ],
      "note": null,
      "measured_on": "2026-09-04T02:41:24.000Z"
    }
  },
  "details": [
    {
      "key": "zertifikat",
      "name": "Certification named",
      "value": "iso-27001",
      "subject": "anbieter",
      "quote": "We are ISO/IEC 27001 certified, audited annually.",
      "source": "https://example.com/trust",
      "measured_on": "2026-09-04T02:41:20.000Z",
      "path": "/data/certifications/iso-27001"
    }
  ]
}

Bulk: the evidence pack

Every vendor profile carries a downloadable pack for a procurement file, in two formats:

• /<category>/<vendor>/evidence.csv – two tables in one file: 13 columns per criterion (vendor, domain, category, criterion, criterion_key, weight, result, source_url, addresses_checked, note, measured_on, snapshot, score_version), then the quoted details (vendor, domain, detail, detail_key, value, subject, quote, source_url, measured_on).
• /<category>/<vendor>/evidence.json – the same, nested, with the full list of addresses we checked.

Both carry the snapshot id and the disclaimer. There is no PDF: the container that serves this page has no browser to render one, and the page itself prints.

Rate limits, and what we ask instead

There is no key and no counted quota. What we ask is the thing a rate limit would enforce badly: take the snapshot once and work from it, rather than fetching ten thousand vendor documents one at a time. A full copy of the ranking is /api/v1/categories plus one call per category.

If your use needs something we do not offer – a full dump, a webhook, an older snapshot – tell us. We would rather build the endpoint than watch someone scrape the pages.

Versioning

The path carries the version: /api/v1/. Inside a version we add fields and never repurpose one. A field that would have to mean something else gets a new name, and the old one keeps its meaning until the next version. The score has its own version, printed in every response, for the same reason.

• How we measure and weight
• What a snapshot is
• How our crawler behaves
• llms.txt