# Verdix

> Pre-transfer risk API for EVM addresses on Base. Paid per request via x402 (USDC on Base mainnet, settled through Coinbase's CDP facilitator). POST an address, get back a safe/caution/danger verdict with reasons before you send it funds.

`safe` means the checks below found no risk signal at the time of the request — it is not a guarantee. `caution` means either a check couldn't complete (HTTP 503, reasons `data_unavailable:...`; never charged) or a weaker signal was found that isn't proof of a scam (a complete, charged answer). `danger` means a risk signal matched — see `reasons`.

## Endpoints

- `POST https://api.verdixapi.com/risk/address/lite` — $0.01. List screen only: OFAC, scam/phishing lists, address-poisoning lookalikes, burn addresses, phishing-lure tokens and flagged deployers. Answers `no_known_risk` / `caution` / `danger` and **never `safe`**: `no_known_risk` means nothing matched these lists, not that the address is safe. Skips address age, flash-loan and unverified-contract signals; use quick for a full check. Also screens **Ethereum mainnet** addresses with `"chain": "ethereum"` (same $0.01, paid in USDC on Base): OFAC, known scam/phishing addresses (GoPlus), burn addresses and Verdix's Ethereum address-poisoning data (lookalikes found by a daily scan, **not live**): the answer adds `"data_through": "YYYY-MM-DD"` (last UTC day fully covered) and `"coverage": "daily, not live"`; the `phishing_token` and flagged-deployer checks work on Base only and are listed in `not_checked` on Ethereum. If the Ethereum data is more than 2 days old the answer is a 503 `caution`, never charged.
- `POST https://api.verdixapi.com/risk/address/quick` — $0.02. Fast screen for small, routine transfers.
- `POST https://api.verdixapi.com/risk/address/standard` — $0.10. Recommended default; adds deeper on-chain behaviour analysis.
- `POST https://api.verdixapi.com/risk/address/deep` — $0.50. For large or first-time transfers (runs the same checks as standard today).
- `POST https://api.verdixapi.com/risk/address` — legacy combined route, offers all three prices in one 402 (`accepts[]`, tagged `extra.tier`); a generic x402 client that always pays `accepts[0]` gets quick regardless of what it asks for in the body. New integrations should call one of the tier URLs above instead.
- `GET https://api.verdixapi.com/check/api?address=0x...` — **free**, no payment, rate-limited (30/min, 500/day per IP). Address-poisoning lookup only: answers exactly `{"flagged": true|false, "first_seen": ISO time or null, "kind": "poisoning_lookalike"|"fake_token"|"poisoning_dispatcher"|null}`. `flagged: false` means no poisoning record, **not** that the address is safe (no sanctions, scam-list or contract checks). Add `&chain=ethereum` for Ethereum mainnet (default `base`): same fields plus `"data_through"` and `"coverage": "daily, not live"` (a daily scan, not live). Human page: https://api.verdixapi.com/check
- A plain `GET` on any URL above returns that same route's `402 Payment Required` preview, unpaid — no payment is taken and no check runs.

Request body: `{"address": "0x...40 hex chars...", "chain": "base"}`. `chain` defaults to `base`; only the lite route also accepts `"ethereum"` (see above); quick/standard/deep are Base only, and any other chain gets a 400 (never charged). On the legacy route only, an optional `"tier"` field picks quick/standard/deep in the *unpaid* 402 preview; once a payment is verified, the tier actually paid for is what runs, never the body's claim.

Quick, standard and deep check: OFAC sanctions, scam/phishing/exploit address lists, live address-poisoning lookalikes, burn addresses, and contract/deployer risk signals (phishing-lure tokens, flash-loan-receiver contracts, flagged or unverified deployers). Standard and deep additionally run on-chain behaviour analysis (transfer history, activity patterns) instead of quick's fast address-age read.

Three contract reasons that on their own mean `caution`, never `danger`:

- `unverified_contract`: the address is a contract whose source code is not verified (on Blockscout or Sourcify), so what it does can't be read. Many legitimate contracts are unverified; this says Verdix can't vouch for it, not that it is malicious.
- `unverified_dormant_contract`: a contract not verified on Blockscout that fewer than 25 transactions ever touched. Exploit and phishing contracts are often used once and dropped, but so are retired bots and test deployments.
- `recipient_is_token_contract`: the address is an ERC-20 token contract (for example the USDC contract itself). Sending a token to a token contract almost always loses it; you probably meant a wallet address.

An unverified contract and a token contract are never `safe`. If you meant to pay a person, a contract address is worth a second look either way.

One scam-list reason that means `caution`, never `danger` or `safe` (all tiers, lite included):

- `scam_list_indirect_flag`: the address is a well-known official contract or exchange wallet on Base (for example the WETH predeploy or a Coinbase hot wallet), and the scam list (GoPlus) only says it is *near* malicious activity: it created, funded or traded with honeypot or malicious contracts. Busy infrastructure touches such contracts all the time, so this is not called danger, but Verdix doesn't call it safe either. Any other scam-list flag on the same address is still `danger`.

## Docs

- Pricing and per-tier checks: https://api.verdixapi.com/pricing
- Free address-poisoning checker (paste one Base address): https://api.verdixapi.com/check
- Address-poisoning stats (lookalikes our watcher flagged on Base: today, 7 days, total; counts only, rebuilt hourly): https://api.verdixapi.com/stats
- For businesses (feed of flagged poisoning lookalikes on Base as a daily file, API, updated hourly, on request; Ethereum in early access as a daily file on request, delivered within 1 business day, no feed API yet (single addresses: `/check/api` and lite with `chain=ethereum`); free one-time sample, then a 30-day pilot, $249): https://api.verdixapi.com/business
- Address-poisoning guides (what it is, wallets, fake tokens, business payouts, what to do after a loss): https://api.verdixapi.com/guides
- OpenAPI schema: https://api.verdixapi.com/openapi.json
- Terms: https://api.verdixapi.com/terms
- x402 discovery manifest: https://api.verdixapi.com/.well-known/x402.json
- MCP server (stdio, `npx -y verdix-mcp`, v0.4.0, pays from your own wallet): https://github.com/verdixapi/verdix-mcp
- Vercel AI SDK tool (`npm install verdix-ai-sdk`, v0.4.0, pays from the agent's own wallet; `verdixNeedsApproval` asks the user only on caution/danger): https://api.verdixapi.com/ai-sdk
- LangChain tool (`pip install langchain-verdix`, v0.3.0, pays from the agent's own wallet): https://github.com/verdixapi/langchain-verdix
- Lite tool in all three (since verdix-mcp 0.3.0, verdix-ai-sdk 0.3.0, langchain-verdix 0.2.0): `check_address_risk_lite` (`checkAddressRiskLite` in the AI SDK), $0.01, calls `/risk/address/lite`. Its clean answer is `no_known_risk`, never `safe`; use the quick tier when you need `safe`.
- Ethereum and the free lookup in the packages (since verdix-mcp 0.4.0, verdix-ai-sdk 0.4.0, langchain-verdix 0.3.0, verdix-guard 0.2.0): the lite tool takes `chain: "ethereum"` (still $0.01, paid in USDC on Base; lists and Ethereum address-poisoning data from a **daily scan, not live**: each answer says `dataThrough`). Never `safe`. Free poisoning lookup tools (no wallet, nothing paid): `check_address_poisoning` (MCP), `checkAddressPoisoning` (AI SDK), `VerdixPoisoningTool` (LangChain). verdix-guard screens Ethereum payments only with the opt-in `ethereum: 'lite'`.
- Pre-send guard (`npm install verdix-guard`, v0.2.0): screens the recipient of every x402 payment or viem transfer before it is signed and blocks `danger`; lite tier by default, cached, daily budget: https://github.com/verdixapi/verdix-guard
- Article: "Stop your AI agent from paying a scammer" (why and how to screen a recipient before an agent pays): https://dev.to/verdixapi/stop-your-ai-agent-from-paying-a-scammer-32o9