List ERC-4626 Vaults with Risk Scores

curl --request GET \
  --url https://api.webacy.com/vaults \
  --header 'x-api-key: <api-key>'

const options = {method: 'GET', headers: {'x-api-key': '<api-key>'}};

fetch('https://api.webacy.com/vaults', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.webacy.com/vaults",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "x-api-key: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.webacy.com/vaults"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("x-api-key", "<api-key>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api.webacy.com/vaults")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["x-api-key"] = '<api-key>'

response = http.request(request)
puts response.read_body

{
  "items": [
    {
      "metadata": {
        "address": "0x0deFfd509197aAD5207d2A55862835b467E8128F",
        "chain": "eth",
        "name": "Usual Boosted USDC",
        "symbol": "bbUSDC",
        "protocol": "morpho",
        "contract_type": "erc4626_vault",
        "tvl_usd": 245000000,
        "underlying_symbol": "USDC",
        "underlying_address": "0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48",
        "underlying_risk_tier": "battle_tested",
        "apy": 0.078,
        "looping_rate": 0.12,
        "listing_verdict": "safe_to_list",
        "attention_needed": false,
        "exit_recommendation": false,
        "score_delta_vs_prev": -2,
        "last_scored_at": "2026-03-31T16:43:01.093Z"
      },
      "risk": {
        "score": 18,
        "count": 2,
        "medium": 2,
        "high": 0,
        "overallRisk": 18,
        "issues": [
          {
            "score": 18,
            "tags": [
              {
                "type": "vault_governance_risk",
                "key": "vault-low-timelock",
                "name": "Low Timelock",
                "description": "Timelock shorter than recommended",
                "severity": 4
              }
            ],
            "categories": {
              "vault_governance_risk": {
                "key": "vault_governance_risk",
                "name": "Governance & Access Control",
                "description": "Risk factors related to ownership model, admin controls, and timelock configuration.",
                "tags": {
                  "vault-low-timelock": true
                }
              }
            }
          }
        ]
      },
      "tokens": []
    }
  ],
  "pagination": {
    "total": 1420,
    "page": 1,
    "pageSize": 50,
    "totalPages": 29
  },
  "aggregates": {
    "generated_at": "2026-03-31T16:43:01.093Z",
    "total_count": 1420,
    "tier_counts": {
      "low": 320,
      "medium": 480,
      "high": 390,
      "critical": 180,
      "unknown": 50
    },
    "total_tvl_usd": 12500000000,
    "attention_count": 45,
    "chain_counts": {
      "eth": 620,
      "arb": 280,
      "base": 210,
      "opt": 120,
      "pol": 110,
      "bsc": 80
    },
    "protocol_counts": {
      "morpho": 450,
      "aave": 320,
      "compound": 180,
      "euler": 150,
      "spark": 120,
      "fluid": 80,
      "beefy": 70,
      "yearn": 50
    },
    "highest_risk": [],
    "largest_tvl": []
  },
  "filtered_tier_counts": {
    "low": 320,
    "medium": 480,
    "high": 390,
    "critical": 180,
    "unknown": 50
  },
  "stale": false
}

{
  "message": "Unauthorized"
}

GET

vaults

List ERC-4626 Vaults with Risk Scores

curl --request GET \
  --url https://api.webacy.com/vaults \
  --header 'x-api-key: <api-key>'

const options = {method: 'GET', headers: {'x-api-key': '<api-key>'}};

fetch('https://api.webacy.com/vaults', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.webacy.com/vaults",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "x-api-key: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.webacy.com/vaults"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("x-api-key", "<api-key>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api.webacy.com/vaults")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["x-api-key"] = '<api-key>'

response = http.request(request)
puts response.read_body

{
  "items": [
    {
      "metadata": {
        "address": "0x0deFfd509197aAD5207d2A55862835b467E8128F",
        "chain": "eth",
        "name": "Usual Boosted USDC",
        "symbol": "bbUSDC",
        "protocol": "morpho",
        "contract_type": "erc4626_vault",
        "tvl_usd": 245000000,
        "underlying_symbol": "USDC",
        "underlying_address": "0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48",
        "underlying_risk_tier": "battle_tested",
        "apy": 0.078,
        "looping_rate": 0.12,
        "listing_verdict": "safe_to_list",
        "attention_needed": false,
        "exit_recommendation": false,
        "score_delta_vs_prev": -2,
        "last_scored_at": "2026-03-31T16:43:01.093Z"
      },
      "risk": {
        "score": 18,
        "count": 2,
        "medium": 2,
        "high": 0,
        "overallRisk": 18,
        "issues": [
          {
            "score": 18,
            "tags": [
              {
                "type": "vault_governance_risk",
                "key": "vault-low-timelock",
                "name": "Low Timelock",
                "description": "Timelock shorter than recommended",
                "severity": 4
              }
            ],
            "categories": {
              "vault_governance_risk": {
                "key": "vault_governance_risk",
                "name": "Governance & Access Control",
                "description": "Risk factors related to ownership model, admin controls, and timelock configuration.",
                "tags": {
                  "vault-low-timelock": true
                }
              }
            }
          }
        ]
      },
      "tokens": []
    }
  ],
  "pagination": {
    "total": 1420,
    "page": 1,
    "pageSize": 50,
    "totalPages": 29
  },
  "aggregates": {
    "generated_at": "2026-03-31T16:43:01.093Z",
    "total_count": 1420,
    "tier_counts": {
      "low": 320,
      "medium": 480,
      "high": 390,
      "critical": 180,
      "unknown": 50
    },
    "total_tvl_usd": 12500000000,
    "attention_count": 45,
    "chain_counts": {
      "eth": 620,
      "arb": 280,
      "base": 210,
      "opt": 120,
      "pol": 110,
      "bsc": 80
    },
    "protocol_counts": {
      "morpho": 450,
      "aave": 320,
      "compound": 180,
      "euler": 150,
      "spark": 120,
      "fluid": 80,
      "beefy": 70,
      "yearn": 50
    },
    "highest_risk": [],
    "largest_tvl": []
  },
  "filtered_tier_counts": {
    "low": 320,
    "medium": 480,
    "high": 390,
    "critical": 180,
    "unknown": 50
  },
  "stale": false
}

{
  "message": "Unauthorized"
}

Authorizations

x-api-key

string

header

required

Query Parameters

chain

enum<string>

Filter by blockchain network

Available options:

eth,

arb,

base,

opt,

pol,

bsc

tier

enum<string>

Filter by risk tier

Available options:

low,

medium,

high,

critical,

unknown

protocol

enum<string>

Filter by underlying protocol

Available options:

morpho,

aave,

compound,

euler,

spark,

fluid,

beefy,

yearn

contractType

enum<string>

Filter by vault contract type

Available options:

erc4626_vault,

strategy_vault,

lending_wrapper,

bridge_vault

underlying

string

Filter by underlying asset symbol (max 20 chars)

underlyingRisk

enum<string>

Filter by underlying asset risk tier

Available options:

battle_tested,

medium_risk,

high_risk,

crypto,

unknown

minTvl

number

Minimum TVL in USD

Required range: x >= 0

minScore

number

Minimum risk score (0-100)

Required range: 0 <= x <= 100

maxScore

number

Maximum risk score (0-100)

Required range: 0 <= x <= 100

attentionNeeded

boolean

Filter to vaults needing attention only

riskFlags

string

Comma-separated risk tag keys to filter by (max 500 chars)

riskFlagsMode

enum<string>

How to combine risk flags: any (OR) or all (AND)

Available options:

any,

all

string

Search by vault name, symbol, or address (max 100 chars)

sort

enum<string>

Sort key

Available options:

score_desc,

score_asc,

tvl_desc,

tvl_asc,

apy_desc,

looping_desc,

name_asc

page

integer

default:1

Page number for offset-based pagination (1-indexed)

Required range: x >= 1

pageSize

integer

default:50

Results per page for offset-based pagination (max 500)

Required range: 1 <= x <= 500

cursor

string

Opaque cursor from previous response for cursor-based pagination. When present, offset-based params (page, pageSize) are ignored.

limit

integer

default:100

Results per request for cursor-based pagination (max 500)

Required range: 1 <= x <= 500

Response

Paginated list of vaults with risk scores and ecosystem aggregates

Vault Rating Methodology Get Vault Risk Detail

⌘I

Overview

Stablecoin Risk

RWA Risk (v3)

Vault Risk V3

Vault Risk Rating (V2 — legacy)

Risk DD

Trading DD

Migrations

List ERC-4626 Vaults with Risk Scores

Authorizations

Query Parameters

Response