curl --request GET \
--url https://api.webacy.com/addresses/{address} \
--header 'x-api-key: <api-key>'import requests
url = "https://api.webacy.com/addresses/{address}"
headers = {"x-api-key": "<api-key>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {'x-api-key': '<api-key>'}};
fetch('https://api.webacy.com/addresses/{address}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.webacy.com/addresses/{address}",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"x-api-key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.webacy.com/addresses/{address}"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("x-api-key", "<api-key>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.webacy.com/addresses/{address}")
.header("x-api-key", "<api-key>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.webacy.com/addresses/{address}")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["x-api-key"] = '<api-key>'
response = http.request(request)
puts response.read_body{
"count": 1,
"medium": 0,
"high": 0,
"overallRisk": 0,
"addressType": "CONTRACT",
"tokenStandard": "ERC20",
"issues": [],
"details": {
"multiPlatformAnalysisData": {
"developerAddress": "ESoMiyuJ1ksL5L99LjYCcwjt7XR2B7hdn6mkbBDFbadV",
"analyzedAt": "2025-09-05T18:28:55.907Z",
"platformBreakdown": {
"pump_fun": {
"platform": "pump_fun",
"chains": [
"sol"
],
"totalLaunches": 74,
"successfulLaunches": 70,
"successRate": 94.59,
"totalFundsRaised": 0,
"platformRiskFactors": [
"Tokens consistently fail to gain traction"
],
"tokens": [
{
"tokenAddress": "99MgGxwRvApTLoKfXbY6HcXmNVbXY5quAYy3Mgtopump",
"platform": "pump_fun",
"chain": "sol",
"developerAddress": "ESoMiyuJ1ksL5L99LjYCcwjt7XR2B7hdn6mkbBDFbadV",
"successful": false,
"status": "rugged",
"name": "Dug the Dog",
"symbol": "Dug",
"launchedAt": "2025-06-27T03:36:23.000Z"
},
{
"tokenAddress": "4wTV1YmiEkRvAtNtsSGPtUrqRYQMe5SKy2uB4Jjaxnjf",
"platform": "pump_fun",
"chain": "sol",
"developerAddress": "ESoMiyuJ1ksL5L99LjYCcwjt7XR2B7hdn6mkbBDFbadV",
"successful": true,
"status": "successful",
"name": "",
"symbol": "",
"launchedAt": "2025-06-27T03:37:05.000Z",
"successMetrics": {
"criteriaType": "bonding_curve_completion",
"targetValue": 69000,
"achievedValue": 69000,
"successPercentage": 100,
"liquidityAmount": 12000,
"migrationDestination": "raydium",
"additionalMetrics": {
"detectionMethod": "market_cap"
}
}
}
]
}
}
}
},
"check_id": "3f1c2b9e-7a4d-4e1b-9c55-0d6a2f8e4b71",
"checked_at": "2026-11-03T14:02:11.482Z",
"data_as_of": "2026-11-02T09:30:00.000Z"
}{
"address": "<string>",
"chain": "<string>",
"analysis_status": "pending",
"retry_after_seconds": 123,
"degraded": true,
"message": "<string>",
"check_id": "3f1c2b9e-7a4d-4e1b-9c55-0d6a2f8e4b71",
"checked_at": "2026-11-03T14:02:11.482Z",
"data_as_of": "2026-11-02T09:30:00.000Z"
}{
"message": "Unauthorized"
}{
"x402Version": 1,
"error": "payment required"
}{
"message": "Payment service temporarily unavailable"
}Risk intelligence for an address
Analyze any address for security threats, fraud indicators, and risk factors across supported blockchains.
Supported Address Types:
- Wallet addresses (EOA)
- Token/coin addresses
- Smart contract addresses
The API automatically detects the address type and returns relevant risk analysis. You do not need to use separate endpoints for different address types.
curl --request GET \
--url https://api.webacy.com/addresses/{address} \
--header 'x-api-key: <api-key>'import requests
url = "https://api.webacy.com/addresses/{address}"
headers = {"x-api-key": "<api-key>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {'x-api-key': '<api-key>'}};
fetch('https://api.webacy.com/addresses/{address}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.webacy.com/addresses/{address}",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"x-api-key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.webacy.com/addresses/{address}"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("x-api-key", "<api-key>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.webacy.com/addresses/{address}")
.header("x-api-key", "<api-key>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.webacy.com/addresses/{address}")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["x-api-key"] = '<api-key>'
response = http.request(request)
puts response.read_body{
"count": 1,
"medium": 0,
"high": 0,
"overallRisk": 0,
"addressType": "CONTRACT",
"tokenStandard": "ERC20",
"issues": [],
"details": {
"multiPlatformAnalysisData": {
"developerAddress": "ESoMiyuJ1ksL5L99LjYCcwjt7XR2B7hdn6mkbBDFbadV",
"analyzedAt": "2025-09-05T18:28:55.907Z",
"platformBreakdown": {
"pump_fun": {
"platform": "pump_fun",
"chains": [
"sol"
],
"totalLaunches": 74,
"successfulLaunches": 70,
"successRate": 94.59,
"totalFundsRaised": 0,
"platformRiskFactors": [
"Tokens consistently fail to gain traction"
],
"tokens": [
{
"tokenAddress": "99MgGxwRvApTLoKfXbY6HcXmNVbXY5quAYy3Mgtopump",
"platform": "pump_fun",
"chain": "sol",
"developerAddress": "ESoMiyuJ1ksL5L99LjYCcwjt7XR2B7hdn6mkbBDFbadV",
"successful": false,
"status": "rugged",
"name": "Dug the Dog",
"symbol": "Dug",
"launchedAt": "2025-06-27T03:36:23.000Z"
},
{
"tokenAddress": "4wTV1YmiEkRvAtNtsSGPtUrqRYQMe5SKy2uB4Jjaxnjf",
"platform": "pump_fun",
"chain": "sol",
"developerAddress": "ESoMiyuJ1ksL5L99LjYCcwjt7XR2B7hdn6mkbBDFbadV",
"successful": true,
"status": "successful",
"name": "",
"symbol": "",
"launchedAt": "2025-06-27T03:37:05.000Z",
"successMetrics": {
"criteriaType": "bonding_curve_completion",
"targetValue": 69000,
"achievedValue": 69000,
"successPercentage": 100,
"liquidityAmount": 12000,
"migrationDestination": "raydium",
"additionalMetrics": {
"detectionMethod": "market_cap"
}
}
}
]
}
}
}
},
"check_id": "3f1c2b9e-7a4d-4e1b-9c55-0d6a2f8e4b71",
"checked_at": "2026-11-03T14:02:11.482Z",
"data_as_of": "2026-11-02T09:30:00.000Z"
}{
"address": "<string>",
"chain": "<string>",
"analysis_status": "pending",
"retry_after_seconds": 123,
"degraded": true,
"message": "<string>",
"check_id": "3f1c2b9e-7a4d-4e1b-9c55-0d6a2f8e4b71",
"checked_at": "2026-11-03T14:02:11.482Z",
"data_as_of": "2026-11-02T09:30:00.000Z"
}{
"message": "Unauthorized"
}{
"x402Version": 1,
"error": "payment required"
}{
"message": "Payment service temporarily unavailable"
}Query Parameters
Selected chain. This includes 'eth', 'base', 'bsc', 'pol', 'opt', 'arb', 'sol', 'sei', 'sui', 'btc', 'stellar', 'robinhood', and 'hedera'. For Hedera, both native (0.0.X) and EVM address formats are supported.
eth, base, bsc, pol, opt, sol, arb, sei, sui, btc, stellar, hedera, robinhood Opt-in, EVM only (eth, bsc, arb, base, pol). Screens the wallet's incoming funds up to 2 hops for senders flagged in Webacy's risk labels (sanctions, hacks, mixers, scams/phishing, money laundering, DPRK, address poisoning, analyst flags) and returns the result in fund_flow_exposure. A finding raises the score only when it is at least 1% of the inflow of a recognised token the wallet is actually funded in (native coin, verified or community-listed token; the wallet's most-received such token, or one it received at least 5 times): a direct sender of at least 5% → HIGH, otherwise MEDIUM; hop-2 findings also require the flagged address to have sent the intermediary at least 1% of its inflow of a token that is material to that intermediary. Address-poisoning and analyst-flagged senders are reported but never score. Trusted addresses (verified actor or listing) get the findings for information only. The first call for a wallet returns status: pending (with retry_after_seconds) while the exposure is computed in the background; results are cached for 24 hours (2 hours when inflow_truncated is true). With the flag on a supported chain every 200 response — including one whose fund_flow_exposure.status is pending — is billed as its own, higher-priced endpoint (address-risk-score-fund-flow); see the pricing page for current rates. A 202 response (the address risk analysis itself is still being computed) is a different case and is not billed. Applies regardless of modules. A refreshCache=true call keeps serving the last outcome while the new trace runs.
Comma-separated list of risk analysis modules to execute. Available modules control which specific risk analyses are performed. DEFAULT: All modules are analyzed for complete risk assessment. PERFORMANCE: Specify specific modules to filter results and improve response time. EXAMPLE: Use 'developer_migration' to analyze multi-platform token launch patterns for serial token creators.
Risk analysis modules. Each module analyzes specific risk categories: governance_analysis (contract ownership, upgradeability), token_security (freezeable, mintable, blacklist), contract_analysis (vulnerabilities), market_data (price, volatility), holder_analysis (token distribution), liquidity_analysis (pool data), fraud_detection (drainer, rugpull), sanctions_compliance (OFAC), mixer_detection (tornado cash), address_behavior (trading patterns), transaction_analysis (address poisoning), reputation_analysis (reported addresses), solana_specific (bundling, sniping), evm_specific (gas optimization), sui_specific (coin standards, object model), basic_info (address metadata), security_essentials (core security flags only), fund_flow_screening (simplified boolean indicators for fund flow risks including OFAC, hackers, mixers, drainers, FBI IC3, and Tornado Cash), developer_migration (multi-platform token launch analysis for detecting serial token creators and rugpull patterns across platforms like pump.fun and moonshot)
source_code_analysis, governance_analysis, token_security, contract_analysis, market_data, holder_analysis, liquidity_analysis, fraud_detection, sanctions_compliance, mixer_detection, address_behavior, transaction_analysis, reputation_analysis, solana_specific, evm_specific, sui_specific, basic_info, security_essentials, fund_flow_screening, developer_migration Response
Success
Audit-trail fields on risk responses: which check this was, when it was served, and how fresh the data is.
Whether any data source or risk rule produced data for this address. false means nothing is known about it: it has no transactions, no balance and no deployed code, nothing flagged it, and it carries no labels or classification. Its overallRisk of 0 is then not a clean score, and the only issues it can carry are the insufficient balance and transaction tags. true whenever the address has on-chain activity, is a contract, or any rule raised a finding, including when the score is 0. Additive field: overallRisk is still returned as a number.
true
Legacy field indicating if the address has bytecode deployed (true) or is an EOA (false). For more detailed classification, use addressType. Note: May be true for EIP-7702 delegated EOAs that have bytecode but are functionally EOAs. Optional for chains without smart contracts (e.g., BTC).
false
Detailed classification of the address type. Indicates whether the address is an EOA, smart contract, token, contract wallet, or other chain-specific type. For EIP-7702 delegated EOAs, this will be 'EOA' even if bytecode exists. May be undefined if classification is unavailable.
CONTRACT, EOA, TOKEN, CONTRACT_WALLET, OBJECT, PACKAGE, DYNAMIC_FIELD, UNKNOWN Token standard classification if the address represents a token contract (e.g., ERC20, ERC721, SPL). Only populated for token addresses. May be undefined for non-token addresses or if standard cannot be determined.
ERC20, ERC1155, ERC721, SPL, NFT, JETTON, JETTON_WALLET, TONNFT, UNKNOWN, SUI_COIN, SUI_NFT, STELLAR_ASSET 