Screening

Screen one or more addresses: who they are and what they are worth in risk

The primary endpoint. Give it addresses, get back for each one what is claimed about it, one winner per question (axes), its display name (label), its money-laundering risk (risk), and on request its counterparties, where its money came from and the incidents it appears in.

Batch: up to 100 addresses in one call, each with its own chain, enriched concurrently. Each address costs one rate-limit unit.

Read not_found before concluding anything. Addresses we hold no data for are NOT in entities; they are listed in not_found with a reason. Treating a missing address as a zero score is the commonest way to misread this endpoint: it turns 'we have never seen this wallet' into 'this wallet is clean', which is exactly backwards for a freshly created one.

A missing block means it was not asked for. include selects blocks and the response carries exactly those: no risk key means the score was not requested, never that it is zero.

Who the address is lives in axes, not in one field. Seven questions (account_type, business, actor, membership, legal_status, asset_control, structure), always all seven keys, null where nobody made a claim. Claims on different axes do not compete, so a sanctioned exchange is reported as both.

The platform's risk is the address's risk. When an address resolves to a platform (axes.business.brand) — by its own label or through its cluster — the platform's score, a sanction on the organisation or the risk of its jurisdiction, is part of the address's direct exposure (risk.breakdown.brand_direct), capped by the rank of whoever linked the address to the platform. An exchange hot wallet scores 0 on its traffic and 50 to 90 if the exchange itself is designated, depending on who labelled it.

All time references are block numbers, not timestamps.

post/v2/enrich

Request

  • Base URL: https://intelapi.publicaml.org
  • URL: https://intelapi.publicaml.org/v2/enrich
  • Auth: one of:
    • API key in header X-API-Key
    • none

Request body

includestring[]

Which blocks to compute and return. The names are the blocks of the response: axes returns label + axes (+ kyc_origin), risk returns risk, counterparties returns counterparties and the fields derived from them (counterparties_meta, counterparties_truncated, behavioral_signals, inferred, mixer_interaction, peel_chain), source_of_funds returns source_of_funds, incidents returns incidents + incidents_total. category and aml_score are accepted as older names for axes and risk.

Default (no include): axes, risk, counterparties, source_of_funds. incidents is an add-on: off by default, and asking for it alone ADDS it to the defaults rather than replacing them. To trim the defaults, name the blocks you want. An unknown value is a 400, never a silently dropped block.

This is the cost knob. counterparties and source_of_funds scan the graph and dominate the call; for bulk labelling include: ["axes"] is roughly an order of magnitude faster and far less likely to meet a degraded risk store.

top_ninteger

How many counterparties (and source-of-funds buckets) to return per address.

debugboolean

Adds _trace, a server-side timing report. Diagnostic; its shape is not part of the contract.

Response

Per-address results. Check both entities and not_found.

request_idstring

Quote this when reporting a problem.

processing_time_msinteger

Changes

No recorded changes to this operation across all 1 revision of this API.