---
title: "Static bytecode capability and proxy observations"
method: GET
path: "/v1/audit/{address}"
tags: ["Capabilities"]
---

# Static bytecode capability and proxy observations

`GET /v1/audit/{address}`

## Request

- Base URL: `https://api.m2msentinel.com`
- URL: `https://api.m2msentinel.com/v1/audit/{address}`
- Auth: one of:
  - API key in header `x-api-key`
  - HTTP bearer
  - API key in header `PAYMENT-SIGNATURE`

Reports selected bytecode patterns and common proxy structures. `notASafetyGuarantee` is always true; absence of a pattern is not evidence of safety.

## Path parameters

- `address` string, required

## Response `200`

Capability report. `capabilityRating` is `UNVERIFIED` and `capabilityScore` is null when RPC trust is below evidence grade.

- AuditResponse
  - `status` string
  - `payoutWallet` string
  - `audit` object
    - `address` string, required
    - `analysisKind` 'STATIC_BYTECODE_CAPABILITY_HEURISTIC', required
    - `notASafetyGuarantee` true, required
    - `reachability` 'NOT_ESTABLISHED', required
    - `limitations` string[], required
    - `proxyResolution` ProxyResolution
      - `isProxy` boolean
      - `proxyType` 'NONE' | 'EIP1967_DIRECT' | 'EIP1822_UUPS' | 'ZEPPELINOS_LEGACY' | 'EIP1967_BEACON' | 'EIP1967_BEACON_UNRESOLVED' | 'EIP1167_MINIMAL_PROXY' | 'DELEGATECALL_PROXY_SUSPECTED' | 'CYCLE_DETECTED' | 'MAX_DEPTH_EXCEEDED'
      - `targetAddress` string
      - `beaconAddress` string
      - `confidence` 'HIGH' | 'MEDIUM' | 'LOW'
      - `resolutionPath` object[]
        - `from` string
        - `to` string
        - `via` string
      - `warning` string
      - `note` string
    - `dissection` Dissection
      - `isValidContract` boolean
      - `bytecodeSizeBytes` integer
      - `targetBytecodeHash` string, nullable: Cryptographic SHA-256 hash of the analyzed bytecode
      - `capabilities` Capability[]
        - `type` 'DELEGATECALL' | 'SELFDESTRUCT' | 'MINT_SELECTOR' | 'PAUSE_SELECTOR' | 'FREEZE_SELECTOR', required
        - `confidence` 'HIGH' | 'MEDIUM' | 'LOW', required
        - `reachability` 'NOT_ESTABLISHED', required
        - `byteOffsetHex` string
        - `selectorHex` string
        - `snippetHex` string
        - `evidence` string, required
      - `detectedCapabilities` string[]
      - `metadata` object
        - `disclaimer` string
    - `capabilityRating` string
    - `verdict` Verdict
      - `capabilityRating` 'NO_SELECTED_CAPABILITIES_DETECTED' | 'REVIEW_RECOMMENDED' | 'MULTIPLE_FLAGS' | 'NOT_A_CONTRACT' | 'UNVERIFIED', required
      - `reachability` 'NOT_ESTABLISHED', required
      - `evidenceGrade` boolean, required: False when RPC trust or proxy resolution was insufficient to publish a capability label.
      - `reason` string, required
      - `explanation` string, required
      - `executableCapabilities` string[], required
    - `capabilityScore` integer, nullable
    - `scoreBreakdown` object[]
    - `scoreMeaning` string, nullable
    - `evidenceGrade` boolean
    - `reproducibility` Reproducibility: Deterministic reproducibility metadata and cryptographic bytecode hashes for independent verification.
      - `chainId` integer
      - `network` string
      - `contractAddress` string
      - `runtimeBytecodeHash` string, nullable: SHA-256 hash of the target contract deployed runtime bytecode.
      - `isProxy` boolean
      - `implementationAddress` string, nullable
      - `implementationBytecodeHash` string, nullable: SHA-256 hash of the implementation bytecode if target is a proxy.
      - `rulesetVersion` string
      - `engineVersion` string
      - `evidenceGrade` boolean
      - `trustLevel` string
      - `retrievedAt` string, date-time
    - `network` string
    - `provenance` Provenance: Where a value came from and how old it is. Present on every data response.
      - `source` string
      - `endpoint` string
      - `trustLevel` 'HIGH_TRUST_PRIMARY' | 'QUORUM_PUBLIC' | 'DEGRADED_LOW_TRUST'
      - `agreement` integer: Providers that returned the selected result.
      - `sampled` integer: Providers that answered at all.
      - `retrievedAt` string, date-time
      - `ageSeconds` integer
      - `network` string
      - `note` string, nullable

## Other responses

- `400`: Malformed input
- `401`: Missing or invalid credential, or a credential was supplied in the query string
- `402`: No credential supplied for a payable route, or the issuance-anchored 31-day credit allowance is exhausted
- `405`: Verb not supported. HEAD is refused on protected routes because it would execute a metered handler while suppressing the body.
- `429`: A plan burst limit or bounded public/intent retry limit was exceeded
- `503`: A required dependency is unavailable; the request failed closed

---

[API](https://skmtc.dev/m2msentinel/apis/m2m-sentinel-base-contract-capability-checks-before-you-sign.md) · [All operations](https://skmtc.dev/m2msentinel/apis/m2m-sentinel-base-contract-capability-checks-before-you-sign/llms.txt) · [OpenAPI document](https://skmtc.dev/m2msentinel/apis/m2m-sentinel-base-contract-capability-checks-before-you-sign/revisions/2dadd4e704fd?raw)