Skip to main content

​
2026-10-15

Docs. TON is now listed consistently in POST /v2/screen and POST /v2/check-address (with request examples), the Networks table and the OpenAPI schemas. A confirmed centralized-exchange address reads the same on every surface and network: low, score at most 5 (it previously varied between 5 and 20 by endpoint). A single external-provider signal on TON never exceeds review. TON network. ton is available on /screen, /check-address, /inspect-address and /check-transfer (label-only: labels, sanctions, external risk providers, one-hop counterparties; no multi-hop graph). See Networks.

​
2026-10-14 (later)

V2 POST /v2/screen — schema 6: same public view as x402 /screen.
  • ➖ Removed: verdict.source_count, verdict.confidence, verdict.primary_source_slug, coverage.source_count, sdn_match.id, smart_contract.tags. Labels and category sources from our internal working sources are no longer listed. If you read any of these fields, stop.
  • verdict.label is the owner’s name (entity) or the token’s symbol for an ownerless token contract; the generic suspicious category is no longer shown on low-risk token contracts.
  • ➖ verdict.risk_category_detail[] removed as well — /v2/screen now has the same shape as x402 /screen.

​
2026-10-14

x402 /screen — schema 6: tells you what the address is, names the owner more often, and stops exposing internals.
  • ➕ New block smart_contract (schema 5): kind = EOA / contract / token_contract / unknown, verified live on chain, with the token’s symbol, decimals and logo_url. is_contract: null means “could not verify”, never “no”. Previously this came only from our database and reported many real contracts (e.g. USDT on BSC) as false.
  • ➕ entity is now resolved from every corroborated link (primary, complementary, …), so exchanges — including sanctioned ones — get their name and logo. risk.label is the owner’s name when an entity is named (the token’s symbol for an ownerless token contract).
  • ➖ Removed from the response (schema 6): risk.source_count, risk.confidence, risk.primary_source_slug, risk.tier3_applied, sdn_match.id, smart_contract.tags; coverage.one_hop is now ran / skipped (no reason string). Labels from our internal working sources are no longer listed. If you read any of these fields, stop.
  • ⚡ Repeat lookups of the same address are served from a short cache (a few milliseconds).
  • Price unchanged.

​
2026-10-13

/screen now names the VASP that owns the address and links its PNG logo — additive.
  • ➕ New field entity on x402 GET /screen (top level, schema_version 3 → 4) and V2 POST /v2/screen (verdict.entity, schema_version 4 → 5): {slug, name, category, logo_url, logo_source}.
  • 🖼 logo_url is a 160×160 transparent PNG, served from the open kyt-entity-registry (jsDelivr); null when we have no PNG.
  • entity: null means “no corroborated VASP link” — not “clean”. Never returned on hack / scam-class verdicts. Existing fields are unchanged.
  • Price unchanged.

​
2026-10-12

V2 balance is now counted in credits — additive fields, nothing renamed.
  • 💳 1 credit = 1 unit of your balance = 1 USDT of top-up. Nothing was converted: a balance of 9.85 is 9.85 credits, /v2/check-address costs 1 credit, /v2/check-transfer 0.5, /v2/screen 0.1.
  • ➕ Every billing block now also carries credits_charged, credits_balance, credits_monthly_spent, credits_monthly_cap and unit: "credits" — same values as charged_usd, balance_usd, monthly_spent_usd, monthly_cap_usd.
  • ➕ 402 bodies (insufficient_funds, monthly_cap_exceeded) add balance_credits, requested_credits, monthly_spent_credits, monthly_cap_credits and unit. The human-readable message still prints $ amounts — parse the numeric fields.
  • ➕ GET /v2/balance adds balance_credits, monthly_spent_credits, monthly_cap_credits and unit; GET /v2/networks adds providers.Aegis.prices_credits next to prices_usd.
  • 🔒 All *_usd fields stay, unrenamed — existing integrations need no change.
  • 💰 Top-ups are paid in USDT on TRON: 10 USDT → 11 credits, 50 → 60, 100 → 125. Credits never expire.
  • x402 is unchanged: still priced and settled per call in USDC on Base.

​
2026-10-10

Docs brought in line with the live API.
  • 📄 V2: billing is per call from your USD balance (same prices as x402), not a monthly unit quota; auth is Authorization: Bearer aeg_…; keys are self-serve in Account → API.
  • 📄 Webhooks REST (/v1/webhooks) takes an Aegis-issued integration key, not the V2 aeg_… key — V2 customers use the dashboard.
  • 📄 Networks: check-transfer accepts ETH, BSC, POLYGON, BASE, ARBITRUM, TRON; screen and check-address stay ETH, BSC, TRON.
  • 🧹 The disabled Stripe callback is no longer listed in the V2 OpenAPI.
  • 🤖 For agents: aegis-kyt.com/llms.txt and the RFC 9727 API catalog.

​
2026-08-09

GET /v2/sanctioned/lookup retired.
  • 🗑️ Removed the name/slug sanctions-roster probe. It saw effectively no traffic since it shipped in May, and address screening — /v2/screen and /v2/check-address — covers the cases customers actually asked for. Calls now return 404.
  • 📄 The reference for it is gone from this site along with the endpoint.

​
2026-06-01

API unified to a single Aegis verdict — consensus tier removed.
  • 🗑️ Removed the multi-provider consensus tier: x402 GET /screen/consensus ($2.00) and V2 POST /v2/checkAddressConsensus are gone.
  • ✏️ Renamed for symmetry: x402 /screen/deep → /check-address ($1.00), /screen/tx → /check-transfer ($0.50).
  • ✏️ V2 now mirrors x402 1:1 at the same prices: checkAddressLight → /v2/screen ($0.10), checkAddress → /v2/check-address (Aegis-only, $1.00), new /v2/check-transfer ($0.50).
  • Third-party scoring still runs under the hood (opt-in) when the on-chain graph is sparse — folded into the single Aegis verdict, no separate provider selection.

​
2026-05-20

Webhooks documented + new tx.policy.alert.triggered event.
  • 🎉 New nav group Webhooks covers events, HMAC signature format, retry policy, and the full CRUD on /v1/webhooks/*.
  • 🎉 New event type tx.policy.alert.triggered — fires when a KYT /check-transfer (or /v1/aegis/tx) check raises a policy alert above your alert_min_level. Body shape + alert fields in Event schemas.
  • 🎉 New POST /v1/webhooks/{sub_id}/test — fire a synthetic delivery through the same HMAC + retry plumbing real events use, so you can verify your receiver before going live. See Manage subscriptions.
  • The other events (aegis.bfs.completed, aegis.bfs.failed, aegis.check.high_risk) have been live for a while but weren’t documented externally — fixed now.
x402: new GET /check-transfer/{chain}/{tx_hash} tier — Transaction Check (KYT).
  • 🎉 New GET /check-transfer/{chain}/{tx_hash} ($0.50) — submit an on-chain transaction hash, get back AML policy alerts for every sender that funded the tx. Decode + Tier 4 BFS exposure analysis + USD-weighted composite + Aegis Standard Policy. See /check-transfer.
  • Synchronous wait up to 30 s. If the underlying check completes in that window: 200 with the full result. If not: 202 with a check_id and a free retry URL — you pay only once per (chain, tx_hash).
  • 🎉 New GET /check-transfer-result/{check_id} — free, rate-limited, idempotent. Fetch the deferred result from the 202 retry URL. See /check-transfer-result.
  • Path collision note: the retry URL is tx-result (hyphen), not tx/result (slash). The x402 SDK matches paid paths as regex; a child path would otherwise double-charge. Hyphenated sibling guarantees no overlap.
  • /check-transfer supports ETH, BSC, POLYGON, BASE, ARBITRUM, TRON. Same chain set as /screen and /check-address.

​
2026-05-05

x402 tier consolidation: 4 → 3 paid tiers.
  • 🎉 New GET /screen/{chain}/{address} ($0.10) — returns per-source labels plus the Aegis consensus risk verdict in one body. See /screen.
  • 🗑️ Removed GET /label/{chain}/{address} ($0.10).
  • 🗑️ Removed GET /screen/light/{chain}/{address} ($0.20).
  • Customers using either old path were paying twice for what is essentially one DB join — they now get the same data for $0.10 via /screen. Daily revenue digest showed zero callers on the old paths, so they were removed cleanly with no deprecation period.
  • /check-address ($1.00) and /screen/consensus ($2.00) unchanged. /screen/consensus is still gated by Phase 8 burn-in — discovery doc advertises it with available: false.
V2 API: new POST /v2/screen.
  • Server-side mirror of x402 /screen — same SQL, same labels[] shape, same risk fields — billed via subscription quota instead of on-chain USDC. See /v2/screen.
  • 1 quota unit per call. Supports BSC / ETH / TRON (Aegis ingestion footprint). Supabase reachability failures (502 backend_unavailable) refund the quota.
  • Designed for high-volume B2B integrations: a wallet running a pre-send screen on every user-typed address should call this endpoint instead of x402 /screen — same data, settled via subscription quota without a per-call on-chain step.
  • New page added to the V2 introduction navigation group. Pricing-vs-x402 explainer added there too.

​
2026-04-30

MVP launch — Phase 1 + 2 + 6.
  • 🎉 https://x402.aegis-kyt.com/ is live. Landing page, discovery, health probe, and the four paid tier endpoints (/label, /screen/light, /check-address, /screen/consensus) all serve the x402 402 Payment Required quote.
  • Settlement: Base Sepolia (testnet) for the first 24 h burn-in. Production flip to Base mainnet pending end-to-end paid-call validation.
  • Tier handlers return STUB JSON ({schema_version, tier, todo: …}) pending Phase 3 wiring of real label / risk queries.
  • Coinbase x402 SDK (x402[fastapi,evm,httpx]>=2.8) handles EIP-3009 signature verification + Coinbase-facilitator settlement.
  • Audit log lands in public.x402_payments (one row per verified proof) with UNIQUE(payer, nonce) replay-protection.
What’s NOT shipped yet:
  • Real handler logic (Phase 3) — currently stubs.
  • Mainnet flip (Phase 8).
  • Per-payer rate-limiting, daily revenue digest (Phase 7).
  • Bulk-screen (POST /screen/bulk) — defer until paying customer asks.
Internal roadmap tracks open follow-ups; release notes update here as each milestone ships.