Skip to main content
GET
Get a real-time analysis for a given contract address
This is the full contract risk report. Source-code findings are included inline under source_code_analysis. Need only those findings? See Get only the source-code findings.

Authorizations

x-api-key
string
header
required

Path Parameters

contractAddress
string
required

contract address

Query Parameters

chain
enum<string>

Selected chain. This includes 'eth', 'base', 'bsc', 'pol', 'opt', 'arb', 'hedera' and 'robinhood'. Supported blockchain networks

Available options:
eth,
base,
bsc,
pol,
opt,
arb,
hedera,
robinhood
fromBytecode
boolean

Does full bytecode analysis on unverified contracts. The full scan can take up to several minutes. To retrieve the final results, either refresh this endpoint, or supply a callback URL for which results will be posted every 5 seconds.

refreshCache
boolean

Re-analyze contract address and retrieve fresh data.

callback
string

Returns asynchronous response from bytecode analysis. This callback will be called every 5 seconds with any new data found until the full analysis has been completed. If an analysis is already completed, the callback will not be called.

deployer_risk
boolean

Analyze the deployer address for risks and include a flag if the deployer is risky

hide_trust_flags
boolean

Boolean to determine whether to hide trust-related flags from the response

Response

Success

Audit-trail fields on risk responses: which check this was, when it was served, and how fresh the data is.

check_id
string<uuid>
required

Id of this check. Same value as the X-Request-Id response header. Keep it with the result as an audit reference.

Example:

"3f1c2b9e-7a4d-4e1b-9c55-0d6a2f8e4b71"

checked_at
string<date-time>
required

When this response was served (ISO 8601, UTC). A cached result is served now, so this is the time of your request.

Example:

"2026-11-03T14:02:11.482Z"

data_as_of
string<date-time> | null
required

When the result was computed (ISO 8601, UTC). Earlier than checked_at when the result came from cache. null when the compute time is unknown, for example on a pending (202) answer.

Example:

"2026-11-02T09:30:00.000Z"

score
number

Overall risk score for the contract

Example:

3.5

tags
object[]

List of tags associated with the contract

Example:
categories
object

Categories associated with the contract, keyed by category key

Example:
analysis
object

List of analyses associated with the contract

Example:
metadata
object

CoinGecko data for the token at this contract address. Absent when CoinGecko does not list the token or the CoinGecko lookup failed.

source_code_analysis
object

Source code analysis result if available. May be an analysis payload, an error, or an informational message.

similar_contracts
object[]

List of similar/related contracts discovered during checksum comparison

analysis_status
enum<string>

Static analysis job status. started and in_progress mean the scan is still running: poll again for the result. done and failed are terminal, so stop polling. failed means the scan failed, or static analysis cannot run on a chain this endpoint scores. A failed scan is retried on a request made a few minutes later. Chains the endpoint does not score (sol, sei, sui) get a message-only response without analysis_status. The rest of the response is still a valid risk assessment. A 202 response from this endpoint carries pending instead: the analysis has not been computed yet, retry after the Retry-After delay.

Available options:
started,
in_progress,
done,
failed
Example:

"started"

analysis_type
string

Type of analysis performed

Example:

"STATIC"

deployer
object

Information about the contract deployer and its risk assessment (only returned when deployer_risk=true)

expiresAt
integer<int64>

Cache expiry of this result, in epoch milliseconds. Present when the result was served from cache.

Example:

1762300000000