POST /v2/screen

Cheap labels + consensus risk (Tier 0+1+2)

curl --request POST \
  --url https://api.aegis-kyt.com/v2/screen \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "address": "<string>",
  "network": "<string>"
}
'

{
  "schema_version": 2,
  "address": "0x21a31ee1afc51d94c2efccaa2092ad1028285549",
  "network": "ETH",
  "provider": "Aegis",
  "verdict": {
    "risk_level": "low",
    "risk_score": 12,
    "risk_categories": [
      "exchange"
    ],
    "consensus_found": true,
    "source_count": 2,
    "confidence": 0.74,
    "primary_source_slug": "graphsense-tagpacks",
    "label": "Binance.com",
    "sdn_match": null,
    "labels": [
      {
        "source": "graphsense-tagpacks",
        "source_name": "GraphSense TagPacks",
        "label": "Binance.com",
        "category": "exchange",
        "confidence": 92,
        "first_seen_at": "2025-08-12T00:00:00+00:00",
        "last_seen_at": "2026-04-29T00:00:00+00:00"
      }
    ],
    "smart_contract": null
  },
  "billing": {
    "model": "ledger",
    "charged_usd": "0.100000",
    "balance_usd": "42.500000",
    "monthly_spent_usd": "12.300000",
    "monthly_cap_usd": "500.000000"
  },
  "elapsed_ms": 240
}

POST

screen

Cheap labels + consensus risk (Tier 0+1+2)

curl --request POST \
  --url https://api.aegis-kyt.com/v2/screen \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "address": "<string>",
  "network": "<string>"
}
'

{
  "schema_version": 2,
  "address": "0x21a31ee1afc51d94c2efccaa2092ad1028285549",
  "network": "ETH",
  "provider": "Aegis",
  "verdict": {
    "risk_level": "low",
    "risk_score": 12,
    "risk_categories": [
      "exchange"
    ],
    "consensus_found": true,
    "source_count": 2,
    "confidence": 0.74,
    "primary_source_slug": "graphsense-tagpacks",
    "label": "Binance.com",
    "sdn_match": null,
    "labels": [
      {
        "source": "graphsense-tagpacks",
        "source_name": "GraphSense TagPacks",
        "label": "Binance.com",
        "category": "exchange",
        "confidence": 92,
        "first_seen_at": "2025-08-12T00:00:00+00:00",
        "last_seen_at": "2026-04-29T00:00:00+00:00"
      }
    ],
    "smart_contract": null
  },
  "billing": {
    "model": "ledger",
    "charged_usd": "0.100000",
    "balance_usd": "42.500000",
    "monthly_spent_usd": "12.300000",
    "monthly_cap_usd": "500.000000"
  },
  "elapsed_ms": 240
}

Auth: Required · Cost: 1 quota unit · Provider: Aegis only (Tier 0+1+2 — no graph traversal, no external providers)

The same SQL queries that x402-api’s $0.10 GET /screen/{chain}/{address} runs, billed via your V2 quota instead of via on-chain USDC. Designed for high-volume B2B integrations: a wallet running a pre-send screen on every user-typed address will use this endpoint, not /v2/check-address. Same compute as x402’s /screen, but settled off-chain through your subscription quota instead of an on-chain USDC transfer — no per-call settlement gas to amortise.

Request

curl -X POST https://api.aegis-kyt.com/v2/screen \
  -H "Authorization: Bearer aeg_YOUR_KEY_HERE" \
  -H "Content-Type: application/json" \
  -d '{
    "address": "TScSLnUodZVsgoGchZspDoimDjDB9bwqVv",
    "network": "TRON"
  }'

Field	Type	Notes
`address`	string	EVM hex (auto-lowercased) or base58 (TRON/BTC/SOL — case preserved)
`network`	string	Case-insensitive. Must be in Aegis ingestion footprint — currently BSC, ETH, TRON. Other networks return `400 unsupported_network`

There is no provider field — light always runs Aegis (Tier 0+1+2). If you need provider_b / provider_a or full 4-tier (with 1-hop + BFS), use POST /v2/check-address. Optional headers:

Header	Purpose
`Idempotency-Key: <≤64 chars>`	Replay-safe within 24h. Same key + same body → cached response, no charge. Different body → HTTP 409.

Response 200

{
  "schema_version": 1,
  "address": "TScSLnUodZVsgoGchZspDoimDjDB9bwqVv",
  "network": "TRON",
  "provider": "Aegis",
  "verdict": {
    "ok":                  true,
    "risk_level":          "medium",
    "risk_score":          50,
    "risk_categories":     ["mixer-adjacent"],
    "consensus_found":     true,
    "source_count":        3,
    "confidence":          0.78,
    "primary_source_slug": "graphsense-tag-pack",
    "label":               "TornadoCash 1-hop",
    "sdn_match":           null,
    "labels": [
      {
        "source":        "provider_a-verdicts",
        "source_name":   "provider_a",
        "label":         "Suspected mixer counterparty",
        "category":      "mixer-adjacent",
        "confidence":    78,
        "source_url":    "https://…",
        "first_seen_at": "2025-09-12T00:00:00Z",
        "last_seen_at":  "2026-04-29T00:00:00Z"
      }
    ]
  },
  "billing": {
    "quota_cost":   1,
    "remaining":    14,
    "period_start": "2026-05-01"
  },
  "elapsed_ms": 90
}

If we have no signal at all (no SDN hit, no consensus row, no claims) the call still returns 200 with verdict.consensus_found: false, verdict.labels: [], and quota is still charged — the customer paid for the lookup, not for a guarantee of a hit.

`verdict` object

Field	Type	Notes
`ok`	bool	Always `true` when status is 200
`risk_level`	enum \| null	`none` / `low` / `medium` / `high` / `critical` / `sanctioned`
`risk_score`	int 0..100 \| null	Aggregated across sources
`risk_categories`	string[]	Slugs only — see risk categories
`consensus_found`	bool	`false` → no consensus row exists for this address
`source_count`	int	How many sources contributed
`confidence`	float 0..1 \| null	Confidence-weighted consensus
`primary_source_slug`	string \| null	Highest-trust source contributing to the verdict
`label`	string \| null	Best human-readable label
`sdn_match`	object \| null	Tier-0 sanctions hit (OFAC SDN / UK OFSI / EU)
`labels[]`	array	Per-source label rows — same shape as x402 `/screen`

Errors

Same envelope as POST /v2/check-address. Notable codes:

HTTP	code	Why
400	`bad_request`	empty address / unknown network
400	`unsupported_network`	`network` not in Aegis ingestion footprint (currently BSC / ETH / TRON). Body has `supported_networks`
401	`missing_api_key`	no `Authorization: Bearer …`
401	`invalid_api_key`	unknown / revoked
402	`quota_exceeded`	body has `billing.remaining`
409	`idempotency_conflict`	same `Idempotency-Key`, different body
502	`backend_unavailable`	Supabase reachability failed. Quota refunded.

Pricing vs x402 `/screen`

This endpoint and x402 /screen return the same data — same SQL queries, same labels[] shape, same risk fields. They differ only in the commercial rail:

	V2 `/v2/screen`	x402 `/screen`
Audience	B2B partners (wallets, exchanges)	AI agents, anonymous
Settlement	Subscription quota debited per call (off-chain)	USDC on Base, settled per call (`$0.10` floor — gas + facilitator fee)
Onboarding	Generate `aeg_…` key in your kabinet	Sign EIP-3009 transferAuthorization
Auth	`Authorization: Bearer aeg_…`	None — payment IS the auth

If you’re a wallet putting this behind a “send to address” prompt for thousands of end-users, V2 is the right channel — same data, no on-chain settlement step on each call. Talk to sales for tier sizing.

Request

Response 200

`verdict` object

Errors

Pricing vs x402 `/screen`

See also

Authorizations

Headers

Body

Response

​Request

​Response 200

​verdict object

​Errors

​Pricing vs x402 /screen

​See also

Authorizations

Headers

Body

Response

Request

Response 200

`verdict` object

Errors

Pricing vs x402 `/screen`

See also