Skip to main content
GET
Threat Considerations for an Address

Authorizations

x-api-key
string
header
required

Path Parameters

address
string
required

Query Parameters

chain
enum<string>

Selected chain. This includes 'eth', 'base', 'bsc', 'pol', 'opt', 'arb', 'sol', 'ton', 'sei', 'sui', 'btc', 'stellar', 'robinhood', and 'hedera'. For Hedera, both native (0.0.X) and EVM address formats are supported.

Available options:
eth,
base,
bsc,
pol,
opt,
sol,
arb,
ton,
sei,
sui,
btc,
stellar,
hedera,
robinhood
show_low_risk
boolean

Boolean to determine whether to show low risk issues or not

hide_trust_flags
boolean

Boolean to determine whether to hide trust-related flags from the response

fund_flow_exposure
boolean
default:false

Opt-in, EVM only (eth, bsc, arb, base, pol). Screens the wallet's incoming funds up to 2 hops for senders flagged in Webacy's risk labels (sanctions, hacks, mixers, scams/phishing, money laundering, DPRK, address poisoning, analyst flags) and returns the result in fund_flow_exposure. A finding raises the score only when it is at least 1% of the inflow of a recognised token the wallet is actually funded in (native coin, verified or community-listed token; the wallet's most-received such token, or one it received at least 5 times): a direct sender of at least 5% → HIGH, otherwise MEDIUM; hop-2 findings also require the flagged address to have sent the intermediary at least 1% of its inflow of a token that is material to that intermediary. Address-poisoning and analyst-flagged senders are reported but never score. Trusted addresses (verified actor or listing) get the findings for information only. The first call for a wallet returns status: pending (with retry_after_seconds) while the exposure is computed in the background; results are cached for 24 hours (2 hours when inflow_truncated is true). With the flag on a supported chain every 200 response — including one whose fund_flow_exposure.status is pending — is billed as its own, higher-priced endpoint (address-risk-score-fund-flow); see the pricing page for current rates. A 202 response (the address risk analysis itself is still being computed) is a different case and is not billed. Applies regardless of modules. A refreshCache=true call keeps serving the last outcome while the new trace runs.

modules
enum<string>[]

Comma-separated list of risk analysis modules to execute. Available modules control which specific risk analyses are performed. DEFAULT: All modules are analyzed for complete risk assessment. PERFORMANCE: Specify specific modules to filter results and improve response time. EXAMPLE: Use 'developer_migration' to analyze multi-platform token launch patterns for serial token creators.

Risk analysis modules. Each module analyzes specific risk categories: governance_analysis (contract ownership, upgradeability), token_security (freezeable, mintable, blacklist), contract_analysis (vulnerabilities), market_data (price, volatility), holder_analysis (token distribution), liquidity_analysis (pool data), fraud_detection (drainer, rugpull), sanctions_compliance (OFAC), mixer_detection (tornado cash), address_behavior (trading patterns), transaction_analysis (address poisoning), reputation_analysis (reported addresses), solana_specific (bundling, sniping), evm_specific (gas optimization), ton_specific (jetton standards), sui_specific (coin standards, object model), basic_info (address metadata), security_essentials (core security flags only), fund_flow_screening (simplified boolean indicators for fund flow risks including OFAC, hackers, mixers, drainers, FBI IC3, and Tornado Cash), developer_migration (multi-platform token launch analysis for detecting serial token creators and rugpull patterns across platforms like pump.fun and moonshot)

Available options:
source_code_analysis,
governance_analysis,
token_security,
contract_analysis,
market_data,
holder_analysis,
liquidity_analysis,
fraud_detection,
sanctions_compliance,
mixer_detection,
address_behavior,
transaction_analysis,
reputation_analysis,
solana_specific,
evm_specific,
ton_specific,
sui_specific,
basic_info,
security_essentials,
fund_flow_screening,
developer_migration

Response

Success

count
integer

Number of transactions

Example:

1

medium
integer

Number of medium risk transactions

Example:

1

high
integer

Number of high risk transactions

Example:

0

overallRisk
number

Overall risk score

Example:

25.99

issues
object[]

List of issues found

details
object

Detailed analysis information

context
object[]

Contextual information tags that are NOT security risks (e.g., paid DexScreener promotional info)

isContract
boolean

Legacy field indicating if the address has bytecode deployed (true) or is an EOA (false). For more detailed classification, use addressType. Note: May be true for EIP-7702 delegated EOAs that have bytecode but are functionally EOAs. Optional for chains without smart contracts (e.g., BTC).

Example:

false

addressType
enum<string>

Detailed classification of the address type. Indicates whether the address is an EOA, smart contract, token, contract wallet, or other chain-specific type. For EIP-7702 delegated EOAs, this will be 'EOA' even if bytecode exists. May be undefined if classification is unavailable.

Available options:
CONTRACT,
EOA,
TOKEN,
CONTRACT_WALLET,
OBJECT,
PACKAGE,
DYNAMIC_FIELD,
UNKNOWN
tokenStandard
enum<string>

Token standard classification if the address represents a token contract (e.g., ERC20, ERC721, SPL). Only populated for token addresses. May be undefined for non-token addresses or if standard cannot be determined.

Available options:
ERC20,
ERC1155,
ERC721,
SPL,
NFT,
JETTON,
JETTON_WALLET,
TONNFT,
UNKNOWN,
SUI_COIN,
SUI_NFT,
STELLAR_ASSET
fund_flow_exposure
object

Present only when fund_flow_exposure=true. Resolved at read time, never part of the stored risk response.