API Introduction - Webacy Docs

The Webacy Risk Score API provides comprehensive security analysis for blockchain addresses, transactions, smart contracts, tokens, and URLs. Protect your users from threats, fraud, and malicious activity across multiple blockchain networks.

Base URL

All API requests are made to:

https://api.webacy.com

A development environment is also available at https://api-development.webacy.com.

Versioning in the path

v2 (default) endpoints have no version prefix — for example /vaults, /addresses/{address}, /rwa.
v3 endpoints use a /v3/ prefix — for example /v3/vaults/{address}, /v3/rwa/grades, /v3/framework.
Never use /api/. A request to https://api.webacy.com/api/v3/... returns 403 Missing Authentication Token. The prod gateway strips /api, so it must not appear in any request.

Supported Chains

The API supports 13 blockchain networks including Ethereum, Solana, TON, Hedera, and more.

View All Supported Blockchains

Complete list of supported chains with their identifiers and endpoint availability

API Categories

Threat Risks

Analyze addresses for security threats and malicious activity

Sanction Checks

Check addresses against OFAC and other sanction lists

Contract Risk

Real-time smart contract security analysis

Token Analysis

Comprehensive token security and market analysis

Transaction Scanning (KYT)

Know Your Transaction — scan and simulate transactions for risks

Holder Analysis

Token holder distribution and sniper detection

Response Format

Successful responses return JSON with relevant risk data:

{
  "count": 1,
  "medium": 0,
  "high": 0,
  "overallRisk": 25.99,
  "issues": [],
  "isContract": false
}

Error Responses

{
  "message": "Unauthorized"
}

Hard-gating and fail behavior

REST is the primary integration path for hard-gate and pre-execution decisioning. The MCP server is a convenience wrapper over a subset of the REST surface.Treat missing, stale, or errored data as unknown — never as safe. Before using a result in a decisioning path, check the relevant freshness field for that endpoint:

stale — vault v2 list/detail and the RWA grades list. Hard-gate on this when present.
generated_at — RWA grades list and the vault v2 list aggregates block.
metadata.last_scored_at — vault detail (v2 and v3). The v3 vault detail endpoint does not return stale or generated_at — use metadata.last_scored_at, or read the v2 list / grades endpoints, which carry stale.
analyzed_at — address risk (/addresses/{address}).

A missing endpoint, a 4xx/5xx, or a stale: true flag means you do not have a current risk assessment. Fail closed.

Rate Limits

API requests are rate-limited based on your plan. See Rate Limits for details on limits and quotas. Use the API Usage endpoint to monitor your consumption.

Support

Need help? Contact us at info@webacy.com or get your API key at developers.webacy.co.

Authentication

⌘I

​Base URL

​Versioning in the path

​Supported Chains