Sub-processor catalog API

• GET /api/v1/providers

  The whole catalog, or only the slugs requested with ids.

• GET /api/v1/providers/{slug}

  One fiche. An unknown slug returns 404 JSON. An alias returns 200 with the canonical id.

lang

Optional. French when the parameter is omitted. en and the site’s other shipped locales are accepted: they translate the purpose, legal name and location. Slugs do not change with language. An unknown value returns 400.

ids

Optional, on the list endpoint only. Comma-separated slugs, 73 at most, in the requested order. An unknown or malformed slug is copied into unknown and the rest of the response stays HTTP 200. Without this parameter the full catalog is returned.

apiVersion

"1". The /api/v1/ path is the contract for this version.

generatedAt

The newest fiche revision date in the catalog, at UTC midnight. Not the time of the request.

lastVerifiedBasis

Always fiche-revision: the date comes from the fiche history, not from a live check.

lang

Language of the returned prose.

count / total

Rows in this response, and the size of the catalog.

license

Short terms, including the attribution link.

attributionUrl

https://stacklegal.eu — cite it when you reuse the facts.

docs

This page.

unknown

Requested slugs that were not found. Empty when ids is omitted.

id

Stable slug. It is the widget id (the v parameter) and the fiche slug. It will not be renamed.

name

Provider name as shown on the fiche.

legalName

Legal entity named on the fiche. The text may name more than one company.

category

Catalog category id (hebergement, paiement, ia…). Not a legal qualification.

purpose

Typical purpose written by StackLégal for an indie use, not a sentence from the vendor. null when the fiche does not state one.

location

Processing place in the fiche’s own words: countries, zones, or a region the customer chooses. Not a normalized ISO list, because many fiches describe a choice rather than one country. null when the fiche says the place is not disclosed.

transfer

Recognized mechanisms, zero or more: eu-only, eu-us-dpf, sccs. An empty array means the fiche does not support one of these three. It is not a claim that no transfer exists.

dpfStatus

Status read from the Data Privacy Framework list: actif, actif-examen, non-inscrit, inactif, or non-communique.

officialUrl

HTTPS link of the DPA, or else a privacy page already cited in the fiche sources. null when neither is available.

officialUrlKind

dpa, privacy, or null. Says what officialUrl points at.

pageUrl

StackLégal fiche for this provider, in the requested language. The page exists for every catalog slug.

lastVerified

YYYY-MM-DD date of the latest recorded revision of this fiche.

verification

verified, partial, or unverified. See below.

missing

Absent keys among purpose, location, transfer, officialUrl, and lastVerified.

aliases

Other keys accepted for this slug. Today: ga for google-analytics, the cookie scanner’s id.

The codes are the widget’s, computed from the French text of the fiche. Nothing is inferred from a country name alone.

eu-only

The hosting text says the data stays in the Union, names no destination outside the EEA, and DPF is not recorded for this provider.

eu-us-dpf

The named entity has an active DPF status, or active with a re-certification review. The detail is dpfStatus (actif or actif-examen).

sccs

The French fiche names standard contractual clauses.

The flag describes the fiche, not an audit run at the vendor on the day of the call.

verified

Purpose, location, at least one mechanism, the official link, and the date are all present.

partial

At least one of those is missing, but location, a mechanism, or the official link is still present.

unverified

Location, mechanism, and official link are all missing. The row is not enough to document a transfer.

Each fiche has a publication date, and sometimes a later correction of the stored facts. lastVerified is the latest of those revisions for that slug. generatedAt is the latest date in the whole catalog, written at UTC midnight. A fiche with no date would be listed in missing with lastVerified null. That does not happen in the current catalog. No date is invented.

The returned id is always the fiche’s canonical slug. It is part of the contract: a published slug is not renamed. An extra spelling is added as an alias, and the response keeps the canonical id. ga resolves to google-analytics.

200 responses send Cache-Control: public, max-age=3600, s-maxage=86400, stale-while-revalidate=604800. A 404 is cached for less time, so a slug added later is not stuck as missing. CORS is open for GET and OPTIONS (Access-Control-Allow-Origin: *), with no cookie and no authentication. An unknown slug on the item URL returns 404 with error: not_found. An unknown lang returns 400 (invalid_lang). More than 73 ids returns 400 (too_many_ids).

Two providers, as the API returns them.

GET https://stacklegal.eu/api/v1/providers?ids=vercel,plausible&lang=en

{
  "apiVersion": "1",
  "generatedAt": "2026-10-12T00:00:00.000Z",
  "lastVerifiedBasis": "fiche-revision",
  "lastVerifiedNote": "lastVerified is the date of the latest recorded edit of that provider's fiche in this catalog (first publication, or a later correction of the stored facts). It is not the time of the HTTP response. generatedAt is the newest of those dates, at UTC midnight.",
  "lang": "en",
  "license": "Provider facts come from the StackLégal fiches, which quote public vendor pages and leave unstated points undisclosed. This is not legal advice. A technical detection is not a legal qualification: confirm the services you actually use before you rely on a row. Attribution required: link to https://stacklegal.eu when you reuse this catalog.",
  "attributionUrl": "https://stacklegal.eu",
  "docs": "https://stacklegal.eu/developpeurs",
  "count": 2,
  "total": 73,
  "providers": [
    {
      "id": "vercel",
      "name": "Vercel",
      "legalName": "Vercel Inc.",
      "category": "hebergement",
      "purpose": "Hosting, CDN, and front-end deployments.",
      "location": "The DPA states that the primary processing facilities are in the United States as of the effective date, and that Customer Data may be processed in the United States and anywhere Vercel or its sub-processors operate. The services rely on AWS, Microsoft Azure, and Google Cloud Platform.",
      "transfer": [
        "eu-us-dpf"
      ],
      "dpfStatus": "actif",
      "officialUrl": "https://vercel.com/legal/dpa",
      "officialUrlKind": "dpa",
      "pageUrl": "https://stacklegal.eu/en/gdpr/vercel",
      "lastVerified": "2026-10-04",
      "verification": "verified",
      "missing": [],
      "aliases": []
    },
    {
      "id": "plausible",
      "name": "Plausible",
      "legalName": "Plausible Insights OÜ",
      "category": "mesure",
      "purpose": "Audience measurement without cookies.",
      "location": "Visitor data is processed and stored in the EU. The site is stored at Hetzner in Falkenstein (Germany), UpCloud (Finland) for the database and exports, Bunny (Slovenia) as CDN. Plausible states that visitor data does not leave the EU.",
      "transfer": [
        "eu-only"
      ],
      "dpfStatus": "non-inscrit",
      "officialUrl": "https://plausible.io/dpa",
      "officialUrlKind": "dpa",
      "pageUrl": "https://stacklegal.eu/en/gdpr/plausible",
      "lastVerified": "2026-10-04",
      "verification": "verified",
      "missing": [],
      "aliases": []
    }
  ],
  "unknown": []
}

A single fiche uses the same envelope, with a provider object instead of the array.

GET https://stacklegal.eu/api/v1/providers/vercel?lang=en

{
  "apiVersion": "1",
  "generatedAt": "2026-10-12T00:00:00.000Z",
  "lastVerifiedBasis": "fiche-revision",
  "lastVerifiedNote": "lastVerified is the date of the latest recorded edit of that provider's fiche in this catalog (first publication, or a later correction of the stored facts). It is not the time of the HTTP response. generatedAt is the newest of those dates, at UTC midnight.",
  "lang": "en",
  "license": "Provider facts come from the StackLégal fiches, which quote public vendor pages and leave unstated points undisclosed. This is not legal advice. A technical detection is not a legal qualification: confirm the services you actually use before you rely on a row. Attribution required: link to https://stacklegal.eu when you reuse this catalog.",
  "attributionUrl": "https://stacklegal.eu",
  "docs": "https://stacklegal.eu/developpeurs",
  "provider": {
    "id": "vercel",
    "name": "Vercel",
    "legalName": "Vercel Inc.",
    "category": "hebergement",
    "purpose": "Hosting, CDN, and front-end deployments.",
    "location": "The DPA states that the primary processing facilities are in the United States as of the effective date, and that Customer Data may be processed in the United States and anywhere Vercel or its sub-processors operate. The services rely on AWS, Microsoft Azure, and Google Cloud Platform.",
    "transfer": [
      "eu-us-dpf"
    ],
    "dpfStatus": "actif",
    "officialUrl": "https://vercel.com/legal/dpa",
    "officialUrlKind": "dpa",
    "pageUrl": "https://stacklegal.eu/en/gdpr/vercel",
    "lastVerified": "2026-10-04",
    "verification": "verified",
    "missing": [],
    "aliases": []
  }
}

GET /api/v1/providers/inconnu

{
  "apiVersion": "1",
  "error": "not_found",
  "message": "No provider for this slug.",
  "slug": "inconnu"
}

The same catalog, and the cookie scanner, are also a public MCP server. No key, no cookie, no session. The transport is Streamable HTTP: one JSON-RPC POST to /api/mcp. Tool descriptions are in English.

Τα δελτία που διαβάζει αυτός ο διακομιστής (OpenAI, Mistral, Anthropic, Gemini API) τροφοδοτούν και τις ρήτρες του πακέτου. Πακέτο ΓΚΠΔ + ΤΝ

POST https://stacklegal.eu/api/mcp

Tools

get_provider

One fiche, by canonical slug, alias (ga), or exact catalog name. The same object as GET /api/v1/providers/{slug}. lang is optional and defaults to French.

list_providers

The catalog, or only the slugs passed in ids (73 at most). The same envelope as GET /api/v1/providers. An unknown slug is copied into unknown.

scan_site

One HTTP request, then the trackers present in the HTML and Set-Cookie headers of the first response, before a consent click. The page’s JavaScript is not executed. A fiche slug is included only when the scanner catalog knows that tracker. The result also links to the scanner page. This is not a legal qualification.

scan_site is capped at 6 reads per 10-minute window. The IP address is used only for that cap, as an in-memory hash. The requested address and the IP are not stored. This cap is separate from the one on the scanner page.

Clients

{
  "mcpServers": {
    "stacklegal": {
      "url": "https://stacklegal.eu/api/mcp"
    }
  }
}

{
  "mcpServers": {
    "stacklegal": {
      "type": "http",
      "url": "https://stacklegal.eu/api/mcp"
    }
  }
}

{
  "servers": {
    "stacklegal": {
      "type": "http",
      "url": "https://stacklegal.eu/api/mcp"
    }
  }
}

Tool list

curl -sS -X POST https://stacklegal.eu/api/mcp \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}'

When you reuse these facts, link to https://stacklegal.eu. The license field of every response says the same. The fiches cite public vendor pages; what those pages do not state stays undisclosed.

Questions about this API: contact@stacklegal.eu

The embeddable widget does not call this API. It still loads /widget.js from the builder page. Both read the same fiches. /el/gkpd/widget-ypergolaon