---
title: "Screen a wallet address across EVM, Solana, TON, or Bitcoin for known scam, exploit, drainer, or sanctions-list association before your agent transacts with it"
method: POST
path: "/v1/payg/wallet-risk"
tags: ["x402 pay-per-call"]
---

# Screen a wallet address across EVM, Solana, TON, or Bitcoin for known scam, exploit, drainer, or sanctions-list association before your agent transacts with it

`POST /v1/payg/wallet-risk`

## Request

- Base URL: `https://api.relayshield.net`
- URL: `https://api.relayshield.net/v1/payg/wallet-risk`
- Auth: none required

Screen a wallet address across EVM, Solana, TON, or Bitcoin for known scam, exploit, drainer, or sanctions-list association before your agent transacts with it. Returns a risk level and specific risk flags. The recommended first call for any autonomous trading or DeFi agent before interacting with a new counterparty wallet. Every verdict carries a freshness contract: `observed_at`, `valid_for_seconds` and `expires_at` tell a caller how long the answer can be cached before it must be paid for again. The TTL is deliberately asymmetric, since a flagged address stays flagged while a clean verdict is the one that flips without warning: flagged 24h, clean 1h, and 5m when `degraded` is true because an upstream source was unavailable.

**Billing.** $0.05 in USDC per call over x402, on Base or Solana. No API key, no signup and no
subscription. Send the request with no payment header, take the `402` challenge that comes back,
pay it, and repeat the request. Only successful calls are charged.

## Request body

- object
  - `address` string, required: Wallet address: EVM (0x), Solana (base58), TON (EQ.../UQ...), or Bitcoin

## Response `200`

Payment settled and the check ran. `ok` is true and `data` holds the result.

- object
  - `ok` true, required
  - `data` object, required

## Other responses

- `400`: A required field is missing or malformed. Never billed.
- `402`: Payment required. The body carries a complete x402 version 2 challenge with the accepted networks, the amount in USDC base units, and the recipient. Pay it and repeat the request with the payment header.
- `405`: Wrong HTTP method. Every endpoint is POST.

---

[API](https://skmtc.dev/relayshield/apis/relayshield-api.md) · [All operations](https://skmtc.dev/relayshield/apis/relayshield-api/llms.txt) · [OpenAPI document](https://skmtc.dev/relayshield/apis/relayshield-api/revisions/4d4721b936dd?raw)