---
title: "Screen an EVM address and optionally a token contract"
method: POST
path: "/v1/metered/crypto-intel"
tags: ["Crypto"]
---

# Screen an EVM address and optionally a token contract

`POST /v1/metered/crypto-intel`

## Request

- Base URL: `https://api.relayshield.net`
- URL: `https://api.relayshield.net/v1/metered/crypto-intel`
- Auth: one of:
  - API key in header `X-RS-API-KEY`
  - HTTP bearer

Screens an EVM address for phishing, sanctions and cybercrime associations, and optionally screens a token contract for honeypot, mintable-supply, hidden-owner and sell-tax risk. Returns a composite rating plus cross-surface advisories pointing at the identity checks that pair with the finding.

**Billing.** $0.30 per successful call. Failed calls are never billed. Charged against prepaid credits when the balance covers it, otherwise metered to your card. Threat Intelligence subscribers and AWS Marketplace bundle customers call this at no extra charge.

**Note.** If the upstream screening provider is unreachable, the call still succeeds with empty flags rather than erroring. Treat an empty `address_flags` as 'no signal', not as a verified clean address.

## Request body

- object
  - `address` string, required: EVM address: `0x` followed by 40 hex characters.
  - `chain_id` string: EVM chain ID as a string. Defaults to `1` (Ethereum mainnet).
  - `token_address` string: Optional token contract to screen alongside the address. Same format as `address`.

## Response `200`

Success. `ok` is true and `data` holds the result.

- object
  - `ok` true, required
  - `data` object, required
    - `observed_at` string, date-time: When this verdict was observed. Cache keyed on this, not on receipt time.
    - `valid_for_seconds` integer: How long this verdict can be cached before it should be re-checked. Flagged results live 24 hours; clean results live 1 hour, because a hit stays a hit while a clean answer is the one that flips without telling whoever cached it. A degraded result lives 5 minutes. This is a caching hint and a policy default, not a measurement and not a safety guarantee: how fast a verdict really goes stale is bounded by upstream detection latency, which we do not control.
    - `expires_at` string, date-time: observed_at plus valid_for_seconds, precomputed.
    - `degraded` boolean: True when this answer was assembled from incomplete or failed upstream data. Treat it as NO VERDICT, never as clean. An outage that returns an empty finding list is otherwise indistinguishable from a real all-clear, and it fails in the permissive direction.
    - `address` string: The lowercased address.
    - `chain_id` string: The chain ID used.
    - `composite_risk` 'CRITICAL' | 'HIGH' | 'MEDIUM' | 'LOW': CRITICAL on a critical address or token flag, HIGH on any address flag or token warning, MEDIUM on a warning-tier address flag, otherwise LOW.
    - `address_flags` string[]: Raw risk flags returned for the address.
    - `correlation_advisories` string[]: Cross-surface guidance naming the identity endpoints to call next.
    - `token_risk` object: Present only when `token_address` was supplied and screening succeeded.
      - `contract_address` string: The token contract screened.
      - `token_name` string: Token name.
      - `token_symbol` string: Token symbol.
      - `critical_flags` string[]: Deal-breaker flags: honeypot, airdrop scam, fake token, sell tax at or above 50%.
      - `warning_flags` string[]: Caution flags: pausable transfers, mintable supply, hidden owner, sell tax 10-49%.

## Other responses

- `400`: `address` is missing or is not a valid EVM address.
- `401`: Missing or invalid API key.
- `402`: No credits and no active subscription. The response carries `topup_url`.
- `405`: Wrong HTTP method. Every endpoint is POST.

---

[API](https://skmtc.dev/relayshield/apis/relayshield-api.md) · [All operations](https://skmtc.dev/relayshield/apis/relayshield-api/llms.txt) · [OpenAPI document](https://skmtc.dev/relayshield/apis/relayshield-api/revisions/4d4721b936dd?raw)