Skip to main content
GET
Threat Considerations for an Address

Authorizations

x-api-key
string
header
required

Path Parameters

address
string
required

Query Parameters

chain
enum<string>

Selected chain. This includes 'eth', 'base', 'bsc', 'pol', 'opt', 'arb', 'sol', 'sei', 'sui', 'btc', 'stellar', 'robinhood', and 'hedera'. For Hedera, both native (0.0.X) and EVM address formats are supported.

Available options:
eth,
base,
bsc,
pol,
opt,
sol,
arb,
sei,
sui,
btc,
stellar,
hedera,
robinhood
show_low_risk
boolean

Boolean to determine whether to show low risk issues or not

hide_trust_flags
boolean

Boolean to determine whether to hide trust-related flags from the response

fund_flow_exposure
boolean
default:false

Opt-in, EVM only (eth, bsc, arb, base, pol). Screens the wallet's incoming funds up to 2 hops for senders flagged in Webacy's risk labels (sanctions, hacks, mixers, scams/phishing, money laundering, DPRK, address poisoning, analyst flags) and returns the result in fund_flow_exposure. A finding raises the score only when it is at least 1% of the inflow of a recognised token the wallet is actually funded in (native coin, verified or community-listed token; the wallet's most-received such token, or one it received at least 5 times): a direct sender of at least 5% → HIGH, otherwise MEDIUM; hop-2 findings also require the flagged address to have sent the intermediary at least 1% of its inflow of a token that is material to that intermediary. Address-poisoning and analyst-flagged senders are reported but never score. Trusted addresses (verified actor or listing) get the findings for information only. The first call for a wallet returns status: pending (with retry_after_seconds) while the exposure is computed in the background; results are cached for 24 hours (2 hours when inflow_truncated is true). With the flag on a supported chain every 200 response — including one whose fund_flow_exposure.status is pending — is billed as its own, higher-priced endpoint (address-risk-score-fund-flow); see the pricing page for current rates. A 202 response (the address risk analysis itself is still being computed) is a different case and is not billed. Applies regardless of modules. A refreshCache=true call keeps serving the last outcome while the new trace runs.

modules
enum<string>[]

Comma-separated list of risk analysis modules to execute. Available modules control which specific risk analyses are performed. DEFAULT: All modules are analyzed for complete risk assessment. PERFORMANCE: Specify specific modules to filter results and improve response time. EXAMPLE: Use 'developer_migration' to analyze multi-platform token launch patterns for serial token creators.

Risk analysis modules. Each module analyzes specific risk categories: governance_analysis (contract ownership, upgradeability), token_security (freezeable, mintable, blacklist), contract_analysis (vulnerabilities), market_data (price, volatility), holder_analysis (token distribution), liquidity_analysis (pool data), fraud_detection (drainer, rugpull), sanctions_compliance (OFAC), mixer_detection (tornado cash), address_behavior (trading patterns), transaction_analysis (address poisoning), reputation_analysis (reported addresses), solana_specific (bundling, sniping), evm_specific (gas optimization), sui_specific (coin standards, object model), basic_info (address metadata), security_essentials (core security flags only), fund_flow_screening (simplified boolean indicators for fund flow risks including OFAC, hackers, mixers, drainers, FBI IC3, and Tornado Cash), developer_migration (multi-platform token launch analysis for detecting serial token creators and rugpull patterns across platforms like pump.fun and moonshot)

Available options:
source_code_analysis,
governance_analysis,
token_security,
contract_analysis,
market_data,
holder_analysis,
liquidity_analysis,
fraud_detection,
sanctions_compliance,
mixer_detection,
address_behavior,
transaction_analysis,
reputation_analysis,
solana_specific,
evm_specific,
sui_specific,
basic_info,
security_essentials,
fund_flow_screening,
developer_migration

Response

Success

Audit-trail fields on risk responses: which check this was, when it was served, and how fresh the data is.

check_id
string<uuid>
required

Id of this check. Same value as the X-Request-Id response header. Keep it with the result as an audit reference.

Example:

"3f1c2b9e-7a4d-4e1b-9c55-0d6a2f8e4b71"

checked_at
string<date-time>
required

When this response was served (ISO 8601, UTC). A cached result is served now, so this is the time of your request.

Example:

"2026-11-03T14:02:11.482Z"

data_as_of
string<date-time> | null
required

When the result was computed (ISO 8601, UTC). Earlier than checked_at when the result came from cache. null when the compute time is unknown, for example on a pending (202) answer.

Example:

"2026-11-02T09:30:00.000Z"

count
integer

Number of transactions

Example:

1

medium
integer

Number of medium risk transactions

Example:

1

high
integer

Number of high risk transactions

Example:

0

overallRisk
number

Overall risk score. A value of 0 can mean either a clean result or that nothing is known about the address; check analyzed to tell them apart.

Example:

25.99

analyzed
boolean

Whether any data source or risk rule produced data for this address. false means nothing is known about it: it has no transactions, no balance and no deployed code, nothing flagged it, and it carries no labels or classification. Its overallRisk of 0 is then not a clean score, and the only issues it can carry are the insufficient balance and transaction tags. true whenever the address has on-chain activity, is a contract, or any rule raised a finding, including when the score is 0. Additive field: overallRisk is still returned as a number.

Example:

true

issues
object[]

List of issues found

details
object

Detailed analysis information

context
object[]

Contextual information tags that are NOT security risks (e.g., paid DexScreener promotional info)

isContract
boolean

Legacy field indicating if the address has bytecode deployed (true) or is an EOA (false). For more detailed classification, use addressType. Note: May be true for EIP-7702 delegated EOAs that have bytecode but are functionally EOAs. Optional for chains without smart contracts (e.g., BTC).

Example:

false

addressType
enum<string>

Detailed classification of the address type. Indicates whether the address is an EOA, smart contract, token, contract wallet, or other chain-specific type. For EIP-7702 delegated EOAs, this will be 'EOA' even if bytecode exists. May be undefined if classification is unavailable.

Available options:
CONTRACT,
EOA,
TOKEN,
CONTRACT_WALLET,
OBJECT,
PACKAGE,
DYNAMIC_FIELD,
UNKNOWN
tokenStandard
enum<string>

Token standard classification if the address represents a token contract (e.g., ERC20, ERC721, SPL). Only populated for token addresses. May be undefined for non-token addresses or if standard cannot be determined.

Available options:
ERC20,
ERC1155,
ERC721,
SPL,
NFT,
JETTON,
JETTON_WALLET,
TONNFT,
UNKNOWN,
SUI_COIN,
SUI_NFT,
STELLAR_ASSET
fund_flow_exposure
object

Present only when fund_flow_exposure=true. Resolved at read time, never part of the stored risk response.

analyzed_at
string<date-time>
deprecated

Deprecated: use data_as_of. When the result was computed (ISO 8601, UTC).

Example:

"2026-11-02T09:30:00.000Z"

expiresAt
integer<int64>

Cache expiry of this result, in epoch milliseconds. Present when the result was served from cache.

Example:

1762300000000