curl --request GET \
--url https://api.webacy.com/addresses/{address} \
--header 'x-api-key: <api-key>'import requests
url = "https://api.webacy.com/addresses/{address}"
headers = {"x-api-key": "<api-key>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {'x-api-key': '<api-key>'}};
fetch('https://api.webacy.com/addresses/{address}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.webacy.com/addresses/{address}",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"x-api-key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.webacy.com/addresses/{address}"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("x-api-key", "<api-key>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.webacy.com/addresses/{address}")
.header("x-api-key", "<api-key>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.webacy.com/addresses/{address}")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["x-api-key"] = '<api-key>'
response = http.request(request)
puts response.read_body{
"count": 1,
"medium": 0,
"high": 0,
"overallRisk": 0,
"addressType": "CONTRACT",
"tokenStandard": "ERC20",
"issues": [],
"details": {
"multiPlatformAnalysisData": {
"developerAddress": "ESoMiyuJ1ksL5L99LjYCcwjt7XR2B7hdn6mkbBDFbadV",
"analyzedAt": "2025-09-05T18:28:55.907Z",
"platformBreakdown": {
"pump_fun": {
"platform": "pump_fun",
"chains": [
"sol"
],
"totalLaunches": 74,
"successfulLaunches": 70,
"successRate": 94.59,
"totalFundsRaised": 0,
"platformRiskFactors": [
"Tokens consistently fail to gain traction"
],
"tokens": [
{
"tokenAddress": "99MgGxwRvApTLoKfXbY6HcXmNVbXY5quAYy3Mgtopump",
"platform": "pump_fun",
"chain": "sol",
"developerAddress": "ESoMiyuJ1ksL5L99LjYCcwjt7XR2B7hdn6mkbBDFbadV",
"successful": false,
"status": "rugged",
"name": "Dug the Dog",
"symbol": "Dug",
"launchedAt": "2025-06-27T03:36:23.000Z"
},
{
"tokenAddress": "4wTV1YmiEkRvAtNtsSGPtUrqRYQMe5SKy2uB4Jjaxnjf",
"platform": "pump_fun",
"chain": "sol",
"developerAddress": "ESoMiyuJ1ksL5L99LjYCcwjt7XR2B7hdn6mkbBDFbadV",
"successful": true,
"status": "successful",
"name": "",
"symbol": "",
"launchedAt": "2025-06-27T03:37:05.000Z",
"successMetrics": {
"criteriaType": "bonding_curve_completion",
"targetValue": 69000,
"achievedValue": 69000,
"successPercentage": 100,
"liquidityAmount": 12000,
"migrationDestination": "raydium",
"additionalMetrics": {
"detectionMethod": "market_cap"
}
}
}
]
}
}
}
}
}{
"address": "<string>",
"chain": "<string>",
"analysis_status": "pending",
"retry_after_seconds": 123,
"degraded": true,
"message": "<string>"
}{
"message": "Unauthorized"
}{
"x402Version": 1,
"error": "payment required"
}{
"message": "Payment service temporarily unavailable"
}Risk intelligence for an address
Analyze any address for security threats, fraud indicators, and risk factors across supported blockchains.
Supported Address Types:
- Wallet addresses (EOA)
- Token/coin addresses
- Smart contract addresses
The API automatically detects the address type and returns relevant risk analysis. You do not need to use separate endpoints for different address types.
curl --request GET \
--url https://api.webacy.com/addresses/{address} \
--header 'x-api-key: <api-key>'import requests
url = "https://api.webacy.com/addresses/{address}"
headers = {"x-api-key": "<api-key>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {'x-api-key': '<api-key>'}};
fetch('https://api.webacy.com/addresses/{address}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.webacy.com/addresses/{address}",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"x-api-key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.webacy.com/addresses/{address}"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("x-api-key", "<api-key>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.webacy.com/addresses/{address}")
.header("x-api-key", "<api-key>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.webacy.com/addresses/{address}")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["x-api-key"] = '<api-key>'
response = http.request(request)
puts response.read_body{
"count": 1,
"medium": 0,
"high": 0,
"overallRisk": 0,
"addressType": "CONTRACT",
"tokenStandard": "ERC20",
"issues": [],
"details": {
"multiPlatformAnalysisData": {
"developerAddress": "ESoMiyuJ1ksL5L99LjYCcwjt7XR2B7hdn6mkbBDFbadV",
"analyzedAt": "2025-09-05T18:28:55.907Z",
"platformBreakdown": {
"pump_fun": {
"platform": "pump_fun",
"chains": [
"sol"
],
"totalLaunches": 74,
"successfulLaunches": 70,
"successRate": 94.59,
"totalFundsRaised": 0,
"platformRiskFactors": [
"Tokens consistently fail to gain traction"
],
"tokens": [
{
"tokenAddress": "99MgGxwRvApTLoKfXbY6HcXmNVbXY5quAYy3Mgtopump",
"platform": "pump_fun",
"chain": "sol",
"developerAddress": "ESoMiyuJ1ksL5L99LjYCcwjt7XR2B7hdn6mkbBDFbadV",
"successful": false,
"status": "rugged",
"name": "Dug the Dog",
"symbol": "Dug",
"launchedAt": "2025-06-27T03:36:23.000Z"
},
{
"tokenAddress": "4wTV1YmiEkRvAtNtsSGPtUrqRYQMe5SKy2uB4Jjaxnjf",
"platform": "pump_fun",
"chain": "sol",
"developerAddress": "ESoMiyuJ1ksL5L99LjYCcwjt7XR2B7hdn6mkbBDFbadV",
"successful": true,
"status": "successful",
"name": "",
"symbol": "",
"launchedAt": "2025-06-27T03:37:05.000Z",
"successMetrics": {
"criteriaType": "bonding_curve_completion",
"targetValue": 69000,
"achievedValue": 69000,
"successPercentage": 100,
"liquidityAmount": 12000,
"migrationDestination": "raydium",
"additionalMetrics": {
"detectionMethod": "market_cap"
}
}
}
]
}
}
}
}
}{
"address": "<string>",
"chain": "<string>",
"analysis_status": "pending",
"retry_after_seconds": 123,
"degraded": true,
"message": "<string>"
}{
"message": "Unauthorized"
}{
"x402Version": 1,
"error": "payment required"
}{
"message": "Payment service temporarily unavailable"
}Authorizations
Path Parameters
Query Parameters
Selected chain. This includes 'eth', 'base', 'bsc', 'pol', 'opt', 'arb', 'sol', 'ton', 'sei', 'sui', 'btc', 'stellar', 'robinhood', and 'hedera'. For Hedera, both native (0.0.X) and EVM address formats are supported.
eth, base, bsc, pol, opt, sol, arb, ton, sei, sui, btc, stellar, hedera, robinhood Boolean to determine whether to show low risk issues or not
Boolean to determine whether to hide trust-related flags from the response
Opt-in, EVM only (eth, bsc, arb, base, pol). Screens the wallet's incoming funds up to 2 hops for senders flagged in Webacy's risk labels (sanctions, hacks, mixers, scams/phishing, money laundering, DPRK, address poisoning, analyst flags) and returns the result in fund_flow_exposure. A finding raises the score only when it is at least 1% of the inflow of a recognised token the wallet is actually funded in (native coin, verified or community-listed token; the wallet's most-received such token, or one it received at least 5 times): a direct sender of at least 5% → HIGH, otherwise MEDIUM; hop-2 findings also require the flagged address to have sent the intermediary at least 1% of its inflow of a token that is material to that intermediary. Address-poisoning and analyst-flagged senders are reported but never score. Trusted addresses (verified actor or listing) get the findings for information only. The first call for a wallet returns status: pending (with retry_after_seconds) while the exposure is computed in the background; results are cached for 24 hours (2 hours when inflow_truncated is true). With the flag on a supported chain every 200 response — including one whose fund_flow_exposure.status is pending — is billed as its own, higher-priced endpoint (address-risk-score-fund-flow); see the pricing page for current rates. A 202 response (the address risk analysis itself is still being computed) is a different case and is not billed. Applies regardless of modules. A refreshCache=true call keeps serving the last outcome while the new trace runs.
Comma-separated list of risk analysis modules to execute. Available modules control which specific risk analyses are performed. DEFAULT: All modules are analyzed for complete risk assessment. PERFORMANCE: Specify specific modules to filter results and improve response time. EXAMPLE: Use 'developer_migration' to analyze multi-platform token launch patterns for serial token creators.
Risk analysis modules. Each module analyzes specific risk categories: governance_analysis (contract ownership, upgradeability), token_security (freezeable, mintable, blacklist), contract_analysis (vulnerabilities), market_data (price, volatility), holder_analysis (token distribution), liquidity_analysis (pool data), fraud_detection (drainer, rugpull), sanctions_compliance (OFAC), mixer_detection (tornado cash), address_behavior (trading patterns), transaction_analysis (address poisoning), reputation_analysis (reported addresses), solana_specific (bundling, sniping), evm_specific (gas optimization), ton_specific (jetton standards), sui_specific (coin standards, object model), basic_info (address metadata), security_essentials (core security flags only), fund_flow_screening (simplified boolean indicators for fund flow risks including OFAC, hackers, mixers, drainers, FBI IC3, and Tornado Cash), developer_migration (multi-platform token launch analysis for detecting serial token creators and rugpull patterns across platforms like pump.fun and moonshot)
source_code_analysis, governance_analysis, token_security, contract_analysis, market_data, holder_analysis, liquidity_analysis, fraud_detection, sanctions_compliance, mixer_detection, address_behavior, transaction_analysis, reputation_analysis, solana_specific, evm_specific, ton_specific, sui_specific, basic_info, security_essentials, fund_flow_screening, developer_migration Response
Success
Number of transactions
1
Number of medium risk transactions
1
Number of high risk transactions
0
Overall risk score
25.99
List of issues found
Show child attributes
Show child attributes
Detailed analysis information
Show child attributes
Show child attributes
Contextual information tags that are NOT security risks (e.g., paid DexScreener promotional info)
Show child attributes
Show child attributes
Legacy field indicating if the address has bytecode deployed (true) or is an EOA (false). For more detailed classification, use addressType. Note: May be true for EIP-7702 delegated EOAs that have bytecode but are functionally EOAs. Optional for chains without smart contracts (e.g., BTC).
false
Detailed classification of the address type. Indicates whether the address is an EOA, smart contract, token, contract wallet, or other chain-specific type. For EIP-7702 delegated EOAs, this will be 'EOA' even if bytecode exists. May be undefined if classification is unavailable.
CONTRACT, EOA, TOKEN, CONTRACT_WALLET, OBJECT, PACKAGE, DYNAMIC_FIELD, UNKNOWN Token standard classification if the address represents a token contract (e.g., ERC20, ERC721, SPL). Only populated for token addresses. May be undefined for non-token addresses or if standard cannot be determined.
ERC20, ERC1155, ERC721, SPL, NFT, JETTON, JETTON_WALLET, TONNFT, UNKNOWN, SUI_COIN, SUI_NFT, STELLAR_ASSET Present only when fund_flow_exposure=true. Resolved at read time, never part of the stored risk response.
Show child attributes
Show child attributes
