GET /screen/{chain}/{address}

$0.10 — per-source labels + Aegis consensus risk score

curl --request GET \
  --url https://x402.aegis-kyt.com/screen/{chain}/{address}

const options = {method: 'GET'};

fetch('https://x402.aegis-kyt.com/screen/{chain}/{address}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

{
  "schema_version": 6,
  "address": "0x56eddb7aa87536c09ccc2793473599fd21a8b17f",
  "chain": "ETH",
  "labels": [
    {
      "source": "brianleect-labels",
      "source_name": "brianleect/etherscan-labels",
      "label": "Binance 17",
      "category": "exchange",
      "confidence": null,
      "source_url": "https://github.com/brianleect/etherscan-labels/blob/923aba72c7e2d0682f7ae6194b6140bd90668dc9/data/etherscan/accounts/binance.json",
      "first_seen_at": "2026-10-10T11:30:21.225429+00:00",
      "last_seen_at": "2026-10-10T11:30:21.225429+00:00"
    },
    {
      "source": "immike-multichain-labels",
      "source_name": "ImMike/crypto-wallet-address-labels",
      "label": "Binance",
      "category": "exchange",
      "confidence": null,
      "source_url": "https://www.binance.com/en/blog/community/our-commitment-to-transparency-2895840147147652626",
      "first_seen_at": "2026-10-10T10:30:16.552047+00:00",
      "last_seen_at": "2026-10-10T10:30:16.552047+00:00"
    }
  ],
  "risk": {
    "risk_level": "low",
    "risk_score": 5,
    "is_risky": false,
    "risk_categories": [
      "exchange"
    ],
    "label": "Binance",
    "consensus_found": false
  },
  "smart_contract": {
    "is_contract": false,
    "token_contract": false,
    "kind": "EOA",
    "symbol": null,
    "decimals": null,
    "is_well_known": false,
    "logo_url": null,
    "primary_entity": null,
    "complementary_entities": [
      {
        "slug": "binance-com",
        "display_name": "Binance",
        "category": "centralized_exchange",
        "logo_url": null,
        "registry_slug": "binance-com"
      }
    ]
  },
  "entity": {
    "slug": "binance-com",
    "name": "Binance",
    "category": "centralized_exchange",
    "logo_url": "https://cdn.jsdelivr.net/gh/maslovsa/kyt-entity-registry@main/logos/exchanges/binance-com.png",
    "logo_source": "registry"
  },
  "sdn_match": null,
  "coverage": {
    "tiers": [
      "sdn",
      "consensus"
    ],
    "one_hop": "skipped",
    "graph_analysed": false
  },
  "elapsed_ms": 4446
}

{
  "detail": [
    {
      "loc": [
        "body",
        "address"
      ],
      "msg": "Field required",
      "type": "missing"
    }
  ]
}

GET

screen

{chain}

{address}

$0.10 — per-source labels + Aegis consensus risk score

curl --request GET \
  --url https://x402.aegis-kyt.com/screen/{chain}/{address}

const options = {method: 'GET'};

fetch('https://x402.aegis-kyt.com/screen/{chain}/{address}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

{
  "schema_version": 6,
  "address": "0x56eddb7aa87536c09ccc2793473599fd21a8b17f",
  "chain": "ETH",
  "labels": [
    {
      "source": "brianleect-labels",
      "source_name": "brianleect/etherscan-labels",
      "label": "Binance 17",
      "category": "exchange",
      "confidence": null,
      "source_url": "https://github.com/brianleect/etherscan-labels/blob/923aba72c7e2d0682f7ae6194b6140bd90668dc9/data/etherscan/accounts/binance.json",
      "first_seen_at": "2026-10-10T11:30:21.225429+00:00",
      "last_seen_at": "2026-10-10T11:30:21.225429+00:00"
    },
    {
      "source": "immike-multichain-labels",
      "source_name": "ImMike/crypto-wallet-address-labels",
      "label": "Binance",
      "category": "exchange",
      "confidence": null,
      "source_url": "https://www.binance.com/en/blog/community/our-commitment-to-transparency-2895840147147652626",
      "first_seen_at": "2026-10-10T10:30:16.552047+00:00",
      "last_seen_at": "2026-10-10T10:30:16.552047+00:00"
    }
  ],
  "risk": {
    "risk_level": "low",
    "risk_score": 5,
    "is_risky": false,
    "risk_categories": [
      "exchange"
    ],
    "label": "Binance",
    "consensus_found": false
  },
  "smart_contract": {
    "is_contract": false,
    "token_contract": false,
    "kind": "EOA",
    "symbol": null,
    "decimals": null,
    "is_well_known": false,
    "logo_url": null,
    "primary_entity": null,
    "complementary_entities": [
      {
        "slug": "binance-com",
        "display_name": "Binance",
        "category": "centralized_exchange",
        "logo_url": null,
        "registry_slug": "binance-com"
      }
    ]
  },
  "entity": {
    "slug": "binance-com",
    "name": "Binance",
    "category": "centralized_exchange",
    "logo_url": "https://cdn.jsdelivr.net/gh/maslovsa/kyt-entity-registry@main/logos/exchanges/binance-com.png",
    "logo_source": "registry"
  },
  "sdn_match": null,
  "coverage": {
    "tiers": [
      "sdn",
      "consensus"
    ],
    "one_hop": "skipped",
    "graph_analysed": false
  },
  "elapsed_ms": 4446
}

{
  "detail": [
    {
      "loc": [
        "body",
        "address"
      ],
      "msg": "Field required",
      "type": "missing"
    }
  ]
}

Tier: $0.10 · Asset: USDC · Network: Base

Tier 0+1+2+3 in one call:

sdn_match — direct lookup against OFAC SDN, UK OFSI, and EU sanctions lists. If the address is sanctioned, this is populated and risk.risk_level is forced to "sanctioned".
labels[] — per-source claims from openly licensed public sources (sanctions lists, Tether/Circle blacklists, GraphSense tagpacks and other open registries, our VASP registry). Licensed commercial intelligence informs the score but is never listed — see Source naming.
risk — the Aegis verdict: multi-source consensus (Tier 1+2) plus 1-hop inheritance (Tier 3) from the address’s immediate counterparties on TRON and EVM chains. No multi-hop BFS.
smart_contract — what kind of address it is, verified live on chain: EOA, contract, token_contract or unknown, plus the token’s symbol, decimals and icon.
entity — who owns the address (name + PNG logo), from any corroborated link.

Designed for “what is this address, and is it dangerous?” — sanctions screen + AML labels + risk score in a single $0.10 settlement.

2026-05-05. This endpoint replaces the old $0.10 /label and $0.20 /screen/light paths. Both are removed — same data is now returned here for $0.10. If your client still hits the old paths, it will get HTTP 404; update to /screen/{chain}/{address}.

Path parameters

Name	Type	Description
`chain`	string	Network slug — see networks. e.g. `eth`, `tron`, `bsc`, `ton` (label-only, see networks)
`address`	string	Address. EVM addresses are lowercased server-side; TRON / BTC / SOL kept as-is (case-sensitive)

Request

# Probe — no payment, returns 402 with quote
curl https://x402.aegis-kyt.com/screen/eth/0x6b175474e89094c44da98b954eedeac495271d0f

# With X-PAYMENT (signed via the Coinbase x402 SDK)
curl -H "X-PAYMENT: <base64-proof>" \
     https://x402.aegis-kyt.com/screen/eth/0x6b175474e89094c44da98b954eedeac495271d0f

Response — 200

A wallet of a known exchange:

{
  "schema_version": 6,
  "address": "0x56eddb7aa87536c09ccc2793473599fd21a8b17f",
  "chain": "ETH",
  "labels": [
    {
      "source": "brianleect-labels",
      "source_name": "brianleect/etherscan-labels",
      "label": "Binance 17",
      "category": "exchange",
      "confidence": null,
      "source_url": "https://github.com/brianleect/etherscan-labels/blob/923aba72c7e2d0682f7ae6194b6140bd90668dc9/data/etherscan/accounts/binance.json",
      "first_seen_at": "2026-10-10T11:30:21.225429+00:00",
      "last_seen_at": "2026-10-10T11:30:21.225429+00:00"
    },
    {
      "source": "immike-multichain-labels",
      "source_name": "ImMike/crypto-wallet-address-labels",
      "label": "Binance",
      "category": "exchange",
      "confidence": null,
      "source_url": "https://www.binance.com/en/blog/community/our-commitment-to-transparency-2895840147147652626",
      "first_seen_at": "2026-10-10T10:30:16.552047+00:00",
      "last_seen_at": "2026-10-10T10:30:16.552047+00:00"
    }
  ],
  "risk": {
    "risk_level": "low",
    "risk_score": 5,
    "is_risky": false,
    "risk_categories": [
      "exchange"
    ],
    "label": "Binance",
    "consensus_found": false
  },
  "smart_contract": {
    "is_contract": false,
    "token_contract": false,
    "kind": "EOA",
    "symbol": null,
    "decimals": null,
    "is_well_known": false,
    "logo_url": null,
    "primary_entity": null,
    "complementary_entities": [
      {
        "slug": "binance-com",
        "display_name": "Binance",
        "category": "centralized_exchange",
        "logo_url": null,
        "registry_slug": "binance-com"
      }
    ]
  },
  "entity": {
    "slug": "binance-com",
    "name": "Binance",
    "category": "centralized_exchange",
    "logo_url": "https://cdn.jsdelivr.net/gh/maslovsa/kyt-entity-registry@main/logos/exchanges/binance-com.png",
    "logo_source": "registry"
  },
  "sdn_match": null,
  "coverage": {
    "tiers": [
      "sdn",
      "consensus"
    ],
    "one_hop": "skipped",
    "graph_analysed": false
  },
  "elapsed_ms": 4446
}

A token contract (USDT) — kind: token_contract, with the token’s icon:

{
  "schema_version": 6,
  "address": "0xdac17f958d2ee523a2206206994597c13d831ec7",
  "chain": "ETH",
  "labels": [
    {
      "source": "trust-wallet-assets",
      "source_name": "Trust Wallet Assets",
      "label": "Trust Wallet: Tether",
      "category": "erc20",
      "confidence": null,
      "source_url": "https://github.com/trustwallet/assets/tree/master/blockchains/ethereum/assets/0xdAC17F958D2ee523a2206206994597C13D831ec7",
      "first_seen_at": "2026-04-22T12:37:43.862352+00:00",
      "last_seen_at": "2026-10-13T07:00:04.314927+00:00"
    },
    {
      "source": "brianleect-labels",
      "source_name": "brianleect/etherscan-labels",
      "label": "Tether USD",
      "category": "token_contract",
      "confidence": null,
      "source_url": "https://github.com/brianleect/etherscan-labels/blob/923aba72c7e2d0682f7ae6194b6140bd90668dc9/data/etherscan/tokens/stablecoin.json",
      "first_seen_at": "2026-10-10T11:30:12.878164+00:00",
      "last_seen_at": "2026-10-10T11:30:12.878164+00:00"
    }
  ],
  "risk": {
    "risk_level": "low",
    "risk_score": 5,
    "is_risky": false,
    "risk_categories": [
      "exchange"
    ],
    "label": "Tether",
    "consensus_found": false
  },
  "smart_contract": {
    "is_contract": true,
    "token_contract": true,
    "kind": "token_contract",
    "symbol": "USDT",
    "decimals": 6,
    "is_well_known": true,
    "logo_url": "https://assets.coingecko.com/coins/images/325/thumb/Tether.png?1696501661",
    "primary_entity": {
      "slug": "tether",
      "display_name": "Tether",
      "category": "stablecoin_issuer",
      "logo_url": null,
      "registry_slug": "tether"
    },
    "complementary_entities": []
  },
  "entity": {
    "slug": "tether",
    "name": "Tether",
    "category": "stablecoin_issuer",
    "logo_url": "https://cdn.jsdelivr.net/gh/maslovsa/kyt-entity-registry@main/logos/psp/tether.png",
    "logo_source": "registry"
  },
  "sdn_match": null,
  "coverage": {
    "tiers": [
      "sdn",
      "consensus"
    ],
    "one_hop": "skipped",
    "graph_analysed": false
  },
  "elapsed_ms": 3991
}

SDN hit example (sdn_match populated; risk.risk_level is always "sanctioned" when this is non-null):

{
  "schema_version": 6,
  "address": "TMuCgBejD5RsNANZdjGtaM3YyKGNgDoy7N",
  "chain": "TRON",
  "labels": [
    {
      "source": "ofac-sdn",
      "source_name": "OFAC SDN Sanctions List",
      "label": "OFAC SDN: Grinex",
      "category": "sanctioned",
      "confidence": null,
      "source_url": null,
      "first_seen_at": "2026-04-09T21:11:54.865709+00:00",
      "last_seen_at": "2026-10-14T06:00:29.339603+00:00"
    },
    {
      "source": "tether-blacklist",
      "source_name": "Tether USDT On-Chain Blacklist",
      "label": "Tether blacklist - TMuCgB",
      "category": "tether_blacklist",
      "confidence": null,
      "source_url": "https://tronscan.org/#/address/TMuCgBejD5RsNANZdjGtaM3YyKGNgDoy7N",
      "first_seen_at": "2025-08-14T21:15:09+00:00",
      "last_seen_at": "2026-09-13T13:13:42.996747+00:00"
    }
  ],
  "risk": {
    "risk_level": "sanctioned",
    "risk_score": 100,
    "is_risky": true,
    "risk_categories": [
      "ofac-sdn",
      "sanctioned",
      "enforcement_action",
      "sanctions_exposure",
      "exchange"
    ],
    "label": "Grinex",
    "consensus_found": true
  },
  "smart_contract": {
    "is_contract": false,
    "token_contract": false,
    "kind": "EOA",
    "symbol": null,
    "decimals": null,
    "is_well_known": false,
    "logo_url": null,
    "primary_entity": null,
    "complementary_entities": []
  },
  "entity": {
    "slug": "grinex",
    "name": "Grinex",
    "category": "centralized_exchange",
    "logo_url": "https://cdn.jsdelivr.net/gh/maslovsa/kyt-entity-registry@main/logos/sanctioned/grinex.png",
    "logo_source": "registry"
  },
  "sdn_match": {
    "address": "TMuCgBejD5RsNANZdjGtaM3YyKGNgDoy7N",
    "asset_type": "TRX",
    "entity_name": "Grinex",
    "programs": [
      "CYBER4"
    ],
    "sanctions_types": [
      "Block",
      "Program"
    ],
    "listing_date": "2025-08-14"
  },
  "coverage": {
    "tiers": [
      "sdn",
      "consensus"
    ],
    "one_hop": "skipped",
    "graph_analysed": false
  },
  "elapsed_ms": 503
}

Top level

Field	Type	Notes
`schema_version`	int	Currently `6` (see the changelog)
`address`	string	The address as you sent it (modulo case-normalisation per chain)
`chain`	string	Echo of the path param (uppercased — `ETH`, `TRON`, …)
`labels[]`	array	Per-source label rows. `[]` if no source has labelled the address
`risk`	object	Aegis consensus verdict. See below
`smart_contract`	object	What the address is — see `smart_contract` below
`entity`	object \| null	VASP that owns the address, with a PNG logo. See `entity` below. `null` when we have no corroborated VASP link — that is not “clean”
`sdn_match`	object \| null	OFAC / OFSI / EU sanctions hit. `null` when the address is not sanctioned. When non-null, `risk.risk_level` is always `"sanctioned"`

`entity` object

Who owns the address, for showing a name and a logo next to the verdict.

Field	Type	Notes
`slug`	string	Stable key of the entity in the Aegis registry
`name`	string	Display name
`category`	string \| null	e.g. `centralized_exchange`, `payment_processor`, `defi_protocol`
`logo_url`	string \| null	Absolute https URL of a 160×160 transparent PNG. `null` when we have no PNG — draw your own placeholder; we never return a generic “unknown” image
`logo_source`	string \| null	`registry` (the open kyt-entity-registry, served via jsDelivr) · `upload` (our own storage) · `null`

entity is null when the address has no corroborated link to a VASP, when the verdict carries hack / scam / phishing / ransomware categories (a victim’s logo is never shown on an attacker’s address), and for unattributed placeholder entities. The logo URL follows the registry’s main branch, so an image can be replaced over time: cache it on your side, but do not treat it as immutable.

`sdn_match` object (when non-null)

Field	Type	Notes
`address`	string	Canonical address as stored in the sanctions list
`asset_type`	string \| null	E.g. `"Digital Currency Address"`
`entity_name`	string \| null	Sanctioned entity name (`"TORNADO CASH"`, `"GARANTEX"`, …)
`programs`	string[]	Sanctions programs, e.g. `["CYBER2"]`
`sanctions_types`	string[]	E.g. `["Block"]`
`listing_date`	string \| null	ISO 8601 date when added to the list

`labels[]` rows

Field	Type	Notes
`source`	string	Slug — stable identifier of the ingest source (e.g. `ofac-sdn`, `tether-blacklist`, `graphsense-tagpacks`). Only Aegis’s own and openly licensed public sources are ever listed — see Source naming
`source_name`	string	Human-readable source name
`label`	string \| null	The text label this source attached (`"Binance.com"`, `"Suspected mixer counterparty"`, …)
`category`	string \| null	Source-specific category slug
`confidence`	int 0..100 \| null	Per-source confidence in this claim
`source_url`	string \| null	URL where this claim originated, if available
`first_seen_at`	ISO 8601 \| null	When the source first observed this label
`last_seen_at`	ISO 8601 \| null	When the source last confirmed this label

Stale claims are filtered out — you only see currently-believed labels. Sorted newest-last_seen_at first.

`risk` object

Field	Type	Notes
`risk_level`	enum \| null	`none` / `low` / `medium` / `high` / `critical` / `sanctioned`
`risk_score`	int 0..100 \| null	Consensus risk score
`is_risky`	bool	True for `medium` and above
`risk_categories`	string[]	Slugs only — see risk categories
`label`	string \| null	Headline name: the owner’s name when `entity` is named; for a token contract with no named owner, the token’s symbol (e.g. `WETH`); otherwise a name stated by a public label row
`consensus_found`	bool	`false` → no consensus row exists

`smart_contract` object

Verified live (an on-chain code check, not only our database), so a fresh contract is recognised too.

Field	Type	Notes
`kind`	string	`EOA` — an ordinary account (every BTC / LTC address too) · `contract` · `token_contract` (ERC-20 / BEP-20 / TRC-20) · `unknown` — could not be verified
`is_contract`	bool \| null	`null` means we could not verify — it is not the same as `false`
`token_contract`	bool	`true` for a token contract
`symbol`, `decimals`	string, int \| null	Token details (token contracts)
`logo_url`	string \| null	The token’s icon; `null` when none is known
`is_well_known`	bool	Listed in the major token lists
`primary_entity`, `complementary_entities[]`	object, array	Issuer / related entities of the token or protocol

`coverage` object

Field	Type	Notes
`tiers`	string[]	Tiers that ran: `sdn`, `consensus`, and `one_hop` when 1-hop analysis ran
`one_hop`	string	`ran` or `skipped` (BTC and other networks without counterparty data are `skipped`)
`graph_analysed`	bool	Whether counterparties were examined at all

If we have no signal at all (no claims AND no consensus row), the endpoint still returns 200 with labels: [] and risk.consensus_found: false. Same paid-for-lookup contract: you paid for the lookup, not for a guarantee of a hit.

Response — 402

See Authentication for the quote schema.

Response — 503 (busy)

When screening capacity is saturated the endpoint answers within a few seconds with 503 and a Retry-After header, instead of holding the connection open. Retry after the indicated number of seconds.

{"detail": {"error": {"code": "screen_busy", "message": "screening capacity is saturated — retry shortly"}}}

When to use this vs other tiers

Use Check Address ($1.00) when you need multi-hop BFS exposure (source of funds several hops away). This tier stops at immediate counterparties.
Use Check Transfer ($0.50) to screen an inbound transaction rather than a single address.

High-volume B2B integrations

If you’re a wallet or exchange running a pre-send screen on every user-typed address, paying $0.10 per click adds up fast. Use the V2 API’s POST /v2/screen instead — sanctions + consensus (no 1-hop), billed from a prepaid balance, with no on-chain settlement floor.

Path Parameters

chain

string

required

address

string

required

Response

Successful Response

The response is of type Response Tier Screen Screen Chain Address Get · object.

Get started

Authentication

x402 Endpoints (USDC pay-per-call)

V2 Public API

Webhooks (push events)

Methodology

Reference

Other

GET /screen/{chain}/{address}

Path parameters

Request

Response — 200

Top level

`entity` object

`sdn_match` object (when non-null)

`labels[]` rows

`risk` object

`smart_contract` object

`coverage` object

Response — 402

Response — 503 (busy)

When to use this vs other tiers

High-volume B2B integrations

Path Parameters

Response

​Path parameters

​Request

​Response — 200

​Top level

​entity object

​sdn_match object (when non-null)

​labels[] rows

​risk object

​smart_contract object

​coverage object

​Response — 402

​Response — 503 (busy)

​When to use this vs other tiers

​High-volume B2B integrations

Path Parameters

Response

Path parameters

Request

Response — 200

Top level

`entity` object

`sdn_match` object (when non-null)

`labels[]` rows

`risk` object

`smart_contract` object

`coverage` object

Response — 402

Response — 503 (busy)

When to use this vs other tiers

High-volume B2B integrations