POST

/v1/enrich

Risk score with full breakdown, entity attribution, source of funds and counterparties. The main endpoint.

One call per batch of addresses. The response carries the score and the reason for it: aml_score_breakdown separates direct exposure (the address itself is on a list or matched a detector) from indirect exposure (it received funds from such an address), and propagated_sources lists each contributing source with its category, the number of hops away it sits and the score it contributed. Optional include[] blocks add entity attribution, counterparties and source of funds in the same round trip rather than as follow-up calls.

Request

curl -X POST https://intelapi.publicaml.org/v1/enrich \
  -H 'Content-Type: application/json' \
  -d '{
  "addresses": [
    { "wallet_address": "0x…", "chain": "ETH" }
  ],
  "include": ["aml_score", "category", "counterparties", "source_of_funds"],
  "top_n": 5
}'

Response

{
  "entities": [
    {
      "wallet_address": "0x08723392ed15743cc38513c4925f5e6be5c17243",
      "chain": "ETH",
      "aml_score": 100.0,
      "label": "Chatex (OFAC Sanctioned)",
      "category": "cex",
      "cluster_id": "unnamed:eth:0x08723392…",
      "aml_score_breakdown": {
        "direct_exposure": 100.0,
        "indirect_exposure": 90.0,
        "exposure_direction": "inbound",
        "frozen_direct": {
          "issuers": ["circle", "tether"],
          "tokens": ["USDC", "USDT"],
          "score": 90.0
        },
        "propagated_sources": [
          {
            "category": "sanction",
            "source": "chainabuse:opensanctions",
            "hops": 0,
            "score": 100.0,
            "direction": "inbound"
          }
        ]
      }
    }
  ]
}

Response fields

Field	Type	Meaning
aml_score	number	0-100. The headline risk figure.
aml_score_breakdown.direct_exposure	number	Contribution from the address itself being listed or detected.
aml_score_breakdown.indirect_exposure	number	Contribution from funds received from, or sent to, a risky address.
aml_score_breakdown.propagated_sources[]	array	Every source that fed the score: category, source feed, hops away, score contributed, direction.
aml_score_breakdown.frozen_direct	object	Present when the address is frozen by a token issuer. Names the issuers and tokens.
label	string	Human name of the entity, when known.
category	string	Entity class: cex, dex-aggregator, mixer, gambling, and so on.
cluster_id	string	Id of the cluster the address belongs to. Feed this to /v1/entities and /v1/cluster-mappings.

Things that catch people out

The field is wallet_address here. /v1/address-transactions and /v1/trace take address instead - the two are not interchangeable and the wrong one returns 400.
A score of 0 with a label present is a real answer, not a miss: a named venue that has no risk exposure scores 0.

Try it

The interactive console runs this endpoint against live data from the browser, with no key and no signup.

Open the sandbox at intelapi.publicaml.org