$1.00 — Aegis full 4-tier verdict
curl --request GET \
--url https://x402.aegis-kyt.com/check-address/{chain}/{address}import requests
url = "https://x402.aegis-kyt.com/check-address/{chain}/{address}"
response = requests.get(url)
print(response.text)const options = {method: 'GET'};
fetch('https://x402.aegis-kyt.com/check-address/{chain}/{address}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));{
"schema_version": "public-1",
"address": "TXk6dYxN3sQcPqM2v7Lb4JrW8nTeF5aZ9h",
"network": "TRON",
"decision": "review",
"verdict": {
"ok": true,
"risk_level": "high",
"risk_score": 62,
"risk_categories": [
"sanctions_exposure",
"exchange"
],
"consensus_found": true,
"source_count": 4,
"confidence": 71,
"primary_source_slug": "aegis",
"label": null,
"sdn_match": null,
"tier3_applied": true,
"tier4_applied": true,
"sanctions_exposure_share": 0.083,
"vasp_attribution": null,
"evidence_provenance": [
{
"authority": "aegis_engine",
"authority_kind": "engine",
"source_slug": "bfs-multihop"
},
{
"authority": "us_ofac",
"authority_kind": "sovereign",
"source_slug": "ofac-sdn"
}
],
"jurisdiction_marker": null,
"empty_wallet": false,
"fallback_used": []
},
"elapsed_ms": 9840
}{
"detail": [
{
"loc": [
"body",
"address"
],
"msg": "Field required",
"type": "missing"
}
]
}x402 Endpoints (USDC pay-per-call)
GET /check-address/{chain}/{address}
Aegis full 4-tier verdict — SDN + 100+-source consensus + 1-hop inheritance + BFS exposure.
GET
/
check-address
/
{chain}
/
{address}
$1.00 — Aegis full 4-tier verdict
curl --request GET \
--url https://x402.aegis-kyt.com/check-address/{chain}/{address}import requests
url = "https://x402.aegis-kyt.com/check-address/{chain}/{address}"
response = requests.get(url)
print(response.text)const options = {method: 'GET'};
fetch('https://x402.aegis-kyt.com/check-address/{chain}/{address}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));{
"schema_version": "public-1",
"address": "TXk6dYxN3sQcPqM2v7Lb4JrW8nTeF5aZ9h",
"network": "TRON",
"decision": "review",
"verdict": {
"ok": true,
"risk_level": "high",
"risk_score": 62,
"risk_categories": [
"sanctions_exposure",
"exchange"
],
"consensus_found": true,
"source_count": 4,
"confidence": 71,
"primary_source_slug": "aegis",
"label": null,
"sdn_match": null,
"tier3_applied": true,
"tier4_applied": true,
"sanctions_exposure_share": 0.083,
"vasp_attribution": null,
"evidence_provenance": [
{
"authority": "aegis_engine",
"authority_kind": "engine",
"source_slug": "bfs-multihop"
},
{
"authority": "us_ofac",
"authority_kind": "sovereign",
"source_slug": "ofac-sdn"
}
],
"jurisdiction_marker": null,
"empty_wallet": false,
"fallback_used": []
},
"elapsed_ms": 9840
}{
"detail": [
{
"loc": [
"body",
"address"
],
"msg": "Field required",
"type": "missing"
}
]
}Tier: $1.00 · Asset: USDC · Network: Base
| Tier | What it does |
|---|---|
| 0 · SDN | Direct lookup against OFAC SDN + UK OFSI + EU sanctions lists |
| 1+2 · Consensus | 100+-source aggregation with severity caps + confidence scoring |
| 3 · One-hop | Inherits risk from immediate counterparties (haircut formula) |
| 4 · BFS | Multi-hop priority-queue exposure traversal (max 5 hops) |
decision. Every
source named in the response is either Aegis itself or an openly
licensed public source (sanctions lists, issuer blacklists, open label
registries) — third-party commercial data may inform the score, but is
never shown as a row, a slug or a label.
Path parameters
| Name | Type | Description |
|---|---|---|
chain | string | See networks |
address | string | Address; case-normalised per chain |
Request
curl -H "X-PAYMENT: <proof>" \
https://x402.aegis-kyt.com/check-address/tron/TXk6dYxN3sQcPqM2v7Lb4JrW8nTeF5aZ9h
Response — 200
{
"schema_version": "public-1",
"address": "TXk6dYxN3sQcPqM2v7Lb4JrW8nTeF5aZ9h",
"network": "TRON",
"decision": "review",
"verdict": {
"ok": true,
"risk_level": "high",
"risk_score": 62,
"risk_categories": ["sanctions_exposure", "exchange"],
"consensus_found": true,
"source_count": 4,
"confidence": 71,
"primary_source_slug": "aegis",
"label": null,
"sdn_match": null,
"tier3_applied": true,
"tier4_applied": true,
"sanctions_exposure_share": 0.083,
"vasp_attribution": null,
"evidence_provenance": [
{"authority": "aegis_engine", "authority_kind": "engine", "source_slug": "bfs-multihop"},
{"authority": "us_ofac", "authority_kind": "sovereign", "source_slug": "ofac-sdn"}
],
"jurisdiction_marker": null,
"empty_wallet": false,
"fallback_used": []
},
"elapsed_ms": 9840
}
Response — 202 (still running)
The full graph analysis can outlive the synchronous window (~25 s). You then get202 with a check_id; fetch the result for free — no second
payment:
{
"status": "timeout",
"check_id": "6f1c2b9e-0d4a-4e1b-9a53-2c7d8e1f4a60",
"retry_url": "/check-address-result/6f1c2b9e-0d4a-4e1b-9a53-2c7d8e1f4a60"
}
GET /check-address-result/{check_id} returns 200 with the same body
as above when done, 202 while running.
Response shape
| Field | Type | Notes |
|---|---|---|
decision | enum | accept / review / reject / unable — same traffic light as /v2/check-address |
verdict.risk_level, risk_score, risk_categories[] | … | Aegis’s verdict, same semantics as /screen |
verdict.source_count | int | How many sources spoke about the address — including ones we don’t name |
verdict.primary_source_slug | string | null | Open source that drove the verdict (ofac-sdn, tether-blacklist, …), or aegis when the verdict is our own conclusion |
verdict.label | string | null | Display name, only when it comes from an open source or our VASP registry |
verdict.sdn_match | object | null | Tier-0 hit on a sanctions list |
verdict.tier3_applied / tier4_applied | bool | Whether 1-hop inheritance / multi-hop BFS moved the verdict |
verdict.sanctions_exposure_share | number | null | Share of flow with sanctions exposure (0..1) |
verdict.vasp_attribution | object | null | Licensed-VASP attribution from our registry (source is registry:<entity> or aegis) |
verdict.evidence_provenance[] | object[] | Which authorities back the verdict — Aegis engine or open sources only |
elapsed_ms | int | Server-side wall time |
Use this vs other tiers
- **Use /screen ($0.10)** when you don't need graph traversal — saves $0.90. You still get every per-source label plus the consensus risk verdict.
- Use /check-transfer ($0.50) to screen an inbound transaction (per-sender exposure + policy alerts) rather than a single address.

