cl0q Developer Documentation

cl0q crawls the open web, builds its own inverted index, and serves it from a small read-only HTTP API. It is not a front-end for anybody else's search results. This page documents the public API, the query language, how the index is built, and how cl0q's crawler behaves if it visits your site.

Privacy

cl0q is built so that there is no search history to leak, subpoena, sell, or breach. The guarantees below are architectural — they follow from how the system is built, not from a promise to behave.

What we do keep

cl0q keeps no per-request access log. For a normal request — including every search — no IP address, requested URL, query string, or user agent is written to disk. There is no per-request record to analyse, profile, share, or sell, because none is kept.

The only things logged are application errors and operational events (a failed or slow database query, the server starting or stopping), for a short retention window used strictly for uptime monitoring and debugging. These entries contain no IP address and no search terms — a rejected query, for instance, records only its length, never its content.

Things you explicitly opt into

Two features necessarily store data, because they cannot work otherwise. Both are opt-in and neither is required to use cl0q:

• Saved-search alerts (/api/watch) store the query you asked to be alerted about, plus the browser push endpoint to notify. That is the entire point of the feature. Deleting the subscription removes it.
• API key signup (/api/signup) optionally accepts an email address so we can contact you about the key. It is optional — leave it blank and no contact information is stored at all. The key itself is always stored hashed.

See also the privacy policy.

Quick start

Search is public and needs no key:

curl 'https://cl0q.com/search?q=open+source+search&limit=5'

For the API-key-gated endpoints, mint a free key and send it as a header:

curl -X POST https://cl0q.com/api/signup
# -> {"api_key":"cl0q_...","tier":"free","per_min":30,"per_day":1000, ...}

curl -H 'X-API-Key: cl0q_...' 'https://cl0q.com/api/favicon?domain=github.com'

Search API

GET /search no key required

Parameters

Example

curl 'https://cl0q.com/search?q=intitle:handbook+rust&limit=10&apex_only=1&lang=en'

Response

JSON with a result array and a real total (not an estimate), so you can paginate honestly. Each result carries the indexed page metadata: domain, page title, h1, description, a match-highlighted snippet, HTTP status, and the crawl timestamp. include_org=1 adds network/ASN and DNS fields; include_favicon=1 adds icon bytes.

Query operators

Operators are parsed out of q; whatever remains is full-text matched. Prefix any operator with - to negate it. Operators can be combined.

Notes and limits

• org: requires at least 3 characters. Shorter values are rejected with a 400 rather than silently running an unindexed scan — a deliberate choice to keep one query from degrading the service for everyone.
• The infrastructure operators (ip:, cname:, asn:, org:, favicon:) are feature-detected at startup. If one isn't available on this instance it returns a clear 400 saying so, instead of pretending to work.
• A query consisting only of operators is valid; free text is optional.

Suggest API

GET /suggest no key required

Built for typeahead: it's tuned for latency and rate-limited separately from /search. cl0q also ships an OpenSearch descriptor, so browsers can add cl0q as a search engine and use this endpoint for suggestions.

Favicon-hash API

GET /api/favicon API key required

Favicons are content-addressed by SHA-256, which makes them a pivot: sites sharing an icon are usually related — same operator, same framework default, same phishing kit, same rebrand. This is the same class of pivot Shodan/FOFA-style tooling uses, over cl0q's open-web index.

# forward: domain -> hash + who else uses it
curl -H 'X-API-Key: cl0q_...' 'https://cl0q.com/api/favicon?domain=github.com'

# reverse: hash -> domains
curl -H 'X-API-Key: cl0q_...' 'https://cl0q.com/api/favicon?hash=<hex-sha256>&limit=50'

Pass exactly one of domain or hash. A malformed hash returns 400.

Subdomains API

GET /api/subdomains API key required

Returns subdomains cl0q discovered by crawling the open web. This is passive — it reflects what was found by following public links and DNS, and is not a live brute-force of your zone.

Domain profile API

GET /api/domain/<host> API key required

Everything cl0q knows about one host — the machine-readable twin of the /site/<host> page. Returns page metadata (title, description, language, word count), response characteristics (status, content type, latency, outbound links), DNS (IPv4/IPv6, CNAME, MX) and network attribution (ASN, org, region, country).

curl -H 'X-API-Key: cl0q_...' 'https://cl0q.com/api/domain/tautulli.com'

{
  "domain": "tautulli.com",
  "title": "Tautulli",
  "status_code": 200,
  "language": "en",
  "server": "cloudflare",
  "word_count": 380,
  "latency_ms": 116,
  "outbound_links": 11,
  "ipv4": "104.21.80.1",
  "ipv6": "2606:4700:3030::6815:6001",
  "mx_records": "route1.mx.cloudflare.net.,...",
  "asn": "13335",
  "asn_org": "AS13335 Cloudflare, Inc.",
  "region": "California",
  "country": "US",
  "favicon_sha256": "8d422d2b465d7199dd334ffa6c7e79b70a74c68ca48a8bcc217baf8fd6f8bb7e",
  "first_seen": "2025-08-24T19:32:27Z",
  "last_crawled": "2026-07-03T23:39:28Z"
}

The favicon_sha256 is the pivot point: feed it straight back into favicon:<hash> or the favicon API to find every other site serving the same icon. Returns 404 with {"error":…} if the host isn't in the index.

Data API no key needed

Aggregate and facet data — the same numbers behind the explore dashboard. These read precomputed snapshots rather than querying the index live, so they're free, need no API key, and are only IP rate-limited. Refreshed hourly (stats) and daily (facets).

# what can I drill into?
curl 'https://cl0q.com/api/facets'

# how big is the index right now?
curl 'https://cl0q.com/api/stats'

# which web servers dominate the German-language web?
curl 'https://cl0q.com/api/lang/de'

The facet endpoints cross-reference each other: /api/tech/nginx includes a cross breakdown of the languages it serves, and /api/lang/de the servers serving it. Counts are exact; the sites lists are a representative sample of the index, not a ranking. Unknown or too-small keys return 404 — call /api/facets for the valid set.

Browse API first 150 rows free

Every live domain behind a drill-down — all the sites on a network, a TLD, a country, a language, a server family, or sharing a favicon — as a filterable, paginated list. This is what powers the site lists on the explore pages.

GET /api/browse/<kind>/<key>?tld=&country=&lang=&tech=&asn=&apex=1&q=&limit=&cursor=

curl 'https://cl0q.com/api/browse/asn/13335?country=de&lang=de'

{"kind":"asn","key":"13335","mode":"index","items":[
  {"d":"example.de","t":"Example GmbH","cc":"de","lang":"de","tech":"cloudflare",
   "asn":"13335","org":"Cloudflare, Inc.","at":"2026-09-18"}, …],
 "next":"12345678.50.9f2c…","served":50,"free_rows":150,"scanned":2500}

Lists are newest-first (favicon lists are A→Z). Filters are applied to a bounded window of candidates per request, so a rare combination can return a short — even empty — page with a next cursor: keep following next until it is null. Without an API key, each list is open for its first 150 rows; past that the API answers 401 with {"error":"signin_required"}. Send an API key (X-API-Key) to page through everything. On the website, a free cl0q account does the same.

API keys & rate limits

Getting a key

curl -X POST https://cl0q.com/api/signup
curl -X POST https://cl0q.com/api/signup -d 'email=you@example.com'   # optional

Returns the key once, in the response body. It is shown only once — cl0q stores only a hash and cannot show it to you again. The email is optional and used solely to contact you about the key; omit it and nothing identifying is stored.

Sending a key

Header X-API-Key: cl0q_... (preferred) or query param ?key=cl0q_....

Limits

Paid tiers raise per_min/per_day on the same key. During beta, everyone gets a free key immediately.

Other endpoints

How the index is built

Four stages, each feeding the next. Every stage is incremental and restartable — nothing depends on a full rebuild. The important thing to notice is what crosses each boundary: a layer only ever hands the next one a small, well-defined artefact.

1. Discovery

A breadth-first crawler walks outward from a curated seed list of link-rich, bot-friendly pages, recording every new registrable domain it sees. Because a fixed seed list plateaus quickly — it re-walks the same neighbourhood and stops finding anything — discovery also continuously re-samples domains already known to the index and mines their homepages for outbound links. The known web becomes a rotating frontier rather than a finished list.

2. Page crawl

Discovered domains are fetched and parsed into the index: title, h1, meta description, keywords, canonical, Open Graph and Twitter card metadata, charset, detected language, robots directives, outbound link count, image count, word count, HTTP status, response latency, redirect count, and server header.

Two details matter for quality. Content-type gating means only text/html is parsed, so binary responses never become garbage "pages". And anti-bot interstitial detection means when a challenge page is served instead of real content, cl0q recognises it, refuses to index the challenge text, and records why — rather than indexing thousands of identical "Checking your browser…" pages.

Most fetches do not end up in the index. Every gate below exists to keep something out:

3. Enrichment

Separate passes resolve DNS (A/AAAA/MX/CNAME) for domains discovered link-only, and map IPs to their network/ASN and country. These feed the ip:, cname:, asn: and org: operators and the region facets. Favicons are fetched and stored content-addressed by SHA-256, so an icon shared by 100,000 sites is stored once — which is also what makes the favicon pivot cheap.

4. Serving

A read-only API serves the index. Nothing in the read path writes to the crawl tables, so search load and crawl load stay independent.

Federation

cl0q can accept crawl results from trusted independent nodes, so contributors can crawl on their own hardware and contribute back without ever receiving database credentials. Submissions are authenticated, re-validated server-side against central policy, and tagged with their source so any node's contribution can be audited or removed wholesale. Interested in running one? Use /api/feedback.

Ranking & matching

Matching is PostgreSQL full-text search over a weighted vector, not a bag of words. Fields are weighted by trustworthiness:

Ranking then layers on an apex boost (an apex domain outranks a subdomain, all else equal) and a network popularity signal derived from how much of the index sits on a given network. Substring operators (inurl:, intitle:, org:) are trigram-indexed, which is why they need 3 characters — a shorter pattern has no trigram to look up. A query that is just a hostname (example.com) lists that site first.

Search runs in two stages: a candidate-and-rank pass, then a single batched detail fetch for the page you asked for. Hot queries are briefly cached. Result total is a true count, not an estimate.

For site owners: the cl0q crawler

If cl0q's crawler visits you, here's exactly what it does and how to control it.

Identifying it

The crawler sends a user agent containing cl0q-crawler and a link to cl0q.com/bot. It is browser-shaped so that naive filters don't reject it, but it always self-identifies and is always contactable — it will never pretend to be an ordinary browser to evade you.

Controlling it

• robots.txt is respected. Disallow the crawler and it stops.
• Rate limits are per-host and per-IP. Concurrency against any single site or address is capped, and one busy network can't monopolise a crawl batch.
• 429 and 503 are honoured, including Retry-After. Throttling is treated as "come back later", not as a dead page.
• Repeated failures back off automatically via a per-group circuit breaker, so a struggling host isn't hammered.
• Removal: use /api/report to request removal of a domain.

Being crawled efficiently

The crawler sends If-None-Match / If-Modified-Since when it has previously stored an ETag or Last-Modified for you. Serve validators and a re-crawl costs you a 304 and a few bytes instead of a full page render. cl0q fetches your homepage — it does not spider your whole site.

Errors