SCYTHE RADAROn-chain Data Analytics
STABLECOIN RISK API

Stablecoin Risk API — block dirty money before it lands

One POST returns a verdict on the funds, the payer and the payee — sanctioned, laundered, or clean — in under a second. Built for TRC20 and ERC20 settlement flows.

The flagship endpoint · POST /api/v1/screen

Send a transaction hash, get back a four-part verdict plus action guidance — proceed, review, refund, or block and report. TRON txids and EVM hashes are both accepted; the chain is detected from the hash when you omit it.

POST /api/v1/screen
X-API-Key: sr_live_xxxxxxxx
Idempotency-Key: 7f3c1a90-…

Content-Type: application/json
{ "tx_hash": "983de473ec323e4f…742cc", "chain": "tron" }
Live screening · Free 20 calls/day (Dev 200 / Pro 2,000)
// Response appears here
Verdict model · the same enums the large KYT vendors use

Every response uses the four enum sets shared with Chainalysis KYT / TRM / Bitrace. No proprietary vocabulary to map around.

EnumValuesMeaning
severityUNKNOWN LOW MEDIUM HIGH CRITICALHow exposed the payer is
riskTypesanction scam gambling launder-money mixer frozen-stablecoinWhy it is exposed
exposureOWNERSHIP COUNTERPARTY INDIRECTHow far the risk sits from the address
verdictallow review reject blockWhat to do next
actionGuidanceproceed manual_review refund_allowed block_reportallow → proceed · review → manual_review · reject → refund_allowed · block → block_report (freeze and report; do not return)
Response · dirty money is never an error

A sanctioned payer returns 200 with verdict=block. 4xx is reserved for malformed requests — a contract written for AI and agent consumption.

// HTTP 200 — the money is dirty, the call was fine
{
  "code": 0,
  "data": {
    "requestId": "req_9f2c…", "chain": "tron", "txHash": "983de473…742cc",
    "payer": { "address": "TA3941…X86mz", "riskScore": 95, "severity": "CRITICAL",
            "sanctionsHit": true, "exposure": "OWNERSHIP",
            "risks": [{ "riskType": "sanction", "riskLevel": "CRITICAL", "exposure": "OWNERSHIP" }] },
    "payee": { "address": "TR7NHq…jLj6t", "isNew": null, "firstDepositFromBlacklist": null },
    "verdict": "block", "actionGuidance": "block_report",
    "evidence": { "txExplorer": "https://tronscan.org/#/transaction/983de473…",
                  "reportSignature": "sha256:ecde3d08…" }
  }
}
POST/api/v1/screen GET/api/v1/risk GET/api/v1/demo/risk GET/api/v1/blacku GET/api/v1/profile GET/api/v1/lock GET/api/v1/deaths GET/api/v1/market GET/api/v1/trace POST/api/v1/case GET/api/v1/history
Pricing

Priced per call complexity, from $0.199 per point. The tier subscriptions below are the flat-rate option when your volume is predictable.

Free

  • 100 calls / day
  • Risk score + basic flags
  • Subscription-tier fields
Recommended · P2 open subscription

Dev

  • 5,000 calls / day
  • Full coded flags + dictionary
  • Death records / firstSeen fields
  • Commercial license · raw API data for your own product
  • On-chain Trace API · 200/day
  • Case Report API · 50/day
  • Smart-money track-record API · 2,000/day (on-chain proof included)

Pro

  • 50,000 calls / day
  • Webhook alerts
  • 30-day historical score curve
  • Dedicated channel
  • On-chain Trace API · 2,000/day
  • Case Report API · 500/day
  • Smart-money track-record API · 20,000/day
Integration

REST over HTTPS with an OpenAPI 3.1 spec. Send Idempotency-Key (or request_id) to make retries safe: a repeated key returns the identical result and is charged once. Every response carries rate-limit headers (X-RateLimit-Limit / -Remaining / -Reset).

Compliance boundary

A verdict is a risk signal, not an authorisation to seize. We advise; you decide. Where the verdict is block, funds should be frozen and reported — not returned to a sanctioned counterparty. We do not provide custody, fund recovery, or legal advice.

FAQ
Does this replace my existing risk score?No. /api/v1/screen is purpose-built for a single transaction; the classic risk endpoints are unchanged.
Can I screen TRC20 transfers?Yes. Send the TRON txid (64 hex, no 0x prefix) or the T-address directly. Sanctions screening covers the OFAC list mapped onto TRON.
What does severity UNKNOWN mean?We could not reach a conclusion — an unconfirmed transaction, for example. UNKNOWN always maps to verdict=review, never to allow.
Why is isNew sometimes null?null means undetermined, not false. On EVM chains isNew is derived from the payee's nonce; on TRON we cannot determine it yet and say so rather than guess.
Do failed calls consume quota?No. Parameter errors are rejected before the quota gate, and a request that reaches the upstream but yields no result is refunded automatically.
Is there an OpenAPI spec?Yes, OpenAPI 3.1 — available on request.
Quick start

One request, one checkup

# Get a free key: sign in then click "Get a free Key" above
curl "https://scytheradar.com/api/v1/risk?chain=bsc&addr=0x…" \
  -H "X-API-Key: sr_live_xxxxxxxx"

# flags dictionary (renders codes into 9 languages):
GET /api/v1/flags
API console · try your key (sign in and generate one above)
// Response appears here
On-chain Detective API · Now Open

Plug the case-report generator into your compliance / risk workflow

For exchange compliance teams, wallets, risk and anti-fraud platforms: trace scam fund flows in one request and generate a structured on-chain analysis document — billed per call.

Trace Engine

/api/v1/trace

Input a scam address or tx hash, trace funds layer-by-layer: flow graph, address clustering, timeline, CEX/mixer endpoints, recovery assessment.

GET /api/v1/trace?target=0x…&deep=1
-H "X-API-Key: sr_live_xxx"
Case Report

/api/v1/case

Turn a trace report into a court-grade HTML document: evidence chain, timeline, custom filing statement, real recovery cases — print-ready.

POST /api/v1/case
{"report": {...}, "victim": {...}}
Trace API Console · Dev/Pro tier
// Response appears here
Next

Sentry Pro Live

A 24/7 bodyguard for projects and communities: impersonation & fake-pool detection, LP moves, whale in/out, daily risk digest. Same engine as C-side sentry, subscribe from your account.

KOL Pro

290 SC/ mo
  • 1 token, 24/7 monitoring
  • Daily 09:00 risk digest + move alerts via Telegram
  • Webhook forwarding
  • Impersonation detection
Best for projects

Project Guard

990 SC/ mo
  • Impersonation detection (hourly new-pool scan)
  • LP moves + whale in/out alerts within 10 minutes
  • Risk API Dev quota (valid for the subscription term, auto-downgrades on expiry)

Community

490 SC/ mo
  • 3 tokens monitored
  • In-group suspicious contract / wording alerts
  • Member self-check /risk
  • Impersonation detection
Complete endpoint set · 18 endpoints

Everything the app can query, your backend can call

EndpointMethodFields / Limits
/api/v1/screenPOSTtx_hash chain verdict severity sanction Idempotency-Key
/api/v1/riskGETriskScore healthScore flags firstSeen deaths
/api/v1/demo/riskGETno key 6 / IP / day
/api/v1/blackuGETaddr | txhash upstream
/api/v1/profileGETentity OFAC mixer
/api/v1/lockGETlock burn owner honeypot
/api/v1/deathsGETlimit=50 q=
/api/v1/marketGETlevel newOnly
/api/v1/traceGETtarget=0x... deep=1
/api/v1/casePOSTreport HTML
/api/v1/historyGETdays=30
/api/v1/flagsGETdict 9 langs
/api/v1/plansGETtiers
/api/v1/usageGETtoken=
/api/v1/keyPOSTcreate rotate
/api/v1/watchGETPOSTlist add remove
/api/v1/webhookGETPOSTsubscribe list
/api/v1/webhook/testPOSTdelivery test

Score semantics (both fields are returned together, so there is no ambiguity): riskScore 0–100, higher is more dangerous; healthScore (= 100 − riskScore), higher is safer. The level field is derived from riskScore alone: WHITE / LOW / WATCH / HIGH / BLACK.

Agents & integrators: OpenAPI 3.1 · Integration contract

Webhook alerts · Pro tier

When risk changes, we knock first

CLIENTSCYTHERADARYOUR ENDPOINTPOST /api/v1/webhooksecret (returned once)POST /api/v1/watchbaseline on joinre-check loopperiodic sweepPOST your endpointHMAC-SHA256 signedretry x3exponential backoffauto-disablepersisted, on N failsno polling · server-initiated
# 1. Register a webhook (the secret is returned once only — save it immediately)
POST /api/v1/webhook
{"url":"https://your.app/hook","events":["watch.hit","watch.change","ping"]}

# 2. Register addresses to watch (a baseline is set on join, so "always dangerous" is never misfiled as a new change)
POST /api/v1/watch
{"addr":"0x…","chain":"bsc","label":"my token"}

# 3. Verify the signature (Node.js) — reject unsigned requests to prevent forged callbacks
const sig = "sha256=" + crypto.createHmac("sha256", SECRET).update(rawBody).digest("hex");
if (sig !== req.headers["x-sr-signature"]) return res.status(401).end();

# 4. Management: GET list · DELETE ?id= to remove · POST /api/v1/webhook/test to test delivery

# Security note: URLs must be public http/https; internal, loopback and cloud-metadata endpoints are rejected outright (SSRF protection)
SCYTHE RADAR for Business · Risk API v1 · data is for research only, not investment advice
ScytheRadar — helping those already at the table walk away alive.