curl --request GET \
--url https://api.range.org/v2/risk/address \
--header 'X-API-KEY: <api-key>'import requests
url = "https://api.range.org/v2/risk/address"
headers = {"X-API-KEY": "<api-key>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {'X-API-KEY': '<api-key>'}};
fetch('https://api.range.org/v2/risk/address', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.range.org/v2/risk/address",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"X-API-KEY: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.range.org/v2/risk/address"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("X-API-KEY", "<api-key>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.range.org/v2/risk/address")
.header("X-API-KEY", "<api-key>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.range.org/v2/risk/address")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["X-API-KEY"] = '<api-key>'
response = http.request(request)
puts response.read_body{
"screen_id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
"address": "0x742d35Cc6634C0532925a3b844Bc9e7595f2bD28",
"address_active_on": [
"ethereum",
"polygon"
],
"total_incoming_usd": 1842300.45,
"total_outgoing_usd": 1798450.12,
"malicious_incoming_usd": 184500,
"malicious_outgoing_usd": 92300,
"severity": "high",
"attribution": {
"triggered": [
{
"signal": "sanctions_ofac",
"severity": "severe",
"result": true
}
]
},
"exposure": {
"triggered": [
{
"signal": "compliance-risk",
"mode": "percentage",
"result": true,
"percentage": "42.30%",
"summary": "42.30% of counterparty volume is compliance-risk, crossing the 5% (high) threshold."
}
]
},
"behaviour": {
"detected": [
{
"behaviour": "smurfing",
"severity": "high",
"confidence": 0.78,
"ignored": true
}
]
},
"timestamp": "2026-05-04T14:30:00Z",
"meta": {
"es_attribution_ms": 120,
"config_ms": 5,
"ch_counterparties_ms": 340,
"ch_totals_ms": 80,
"es_interchain_ms": 210,
"helius_ms": 150,
"solana_address_risk_ms": 40,
"features_redis_ms": 60,
"counterparty_attribution_ms": 0,
"parallel_ms": 350,
"total_ms": 410,
"signals": [
"ofac-sanctioned",
"fraud-ml-liquidity-rug"
]
},
"evidence": {}
}Score a Single Address
Returns a risk assessment with tier, triggered exposure signals, and detected behaviours. Pass signals= to run a subset of the catalogue.
curl --request GET \
--url https://api.range.org/v2/risk/address \
--header 'X-API-KEY: <api-key>'import requests
url = "https://api.range.org/v2/risk/address"
headers = {"X-API-KEY": "<api-key>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {'X-API-KEY': '<api-key>'}};
fetch('https://api.range.org/v2/risk/address', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.range.org/v2/risk/address",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"X-API-KEY: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.range.org/v2/risk/address"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("X-API-KEY", "<api-key>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.range.org/v2/risk/address")
.header("X-API-KEY", "<api-key>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.range.org/v2/risk/address")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["X-API-KEY"] = '<api-key>'
response = http.request(request)
puts response.read_body{
"screen_id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
"address": "0x742d35Cc6634C0532925a3b844Bc9e7595f2bD28",
"address_active_on": [
"ethereum",
"polygon"
],
"total_incoming_usd": 1842300.45,
"total_outgoing_usd": 1798450.12,
"malicious_incoming_usd": 184500,
"malicious_outgoing_usd": 92300,
"severity": "high",
"attribution": {
"triggered": [
{
"signal": "sanctions_ofac",
"severity": "severe",
"result": true
}
]
},
"exposure": {
"triggered": [
{
"signal": "compliance-risk",
"mode": "percentage",
"result": true,
"percentage": "42.30%",
"summary": "42.30% of counterparty volume is compliance-risk, crossing the 5% (high) threshold."
}
]
},
"behaviour": {
"detected": [
{
"behaviour": "smurfing",
"severity": "high",
"confidence": 0.78,
"ignored": true
}
]
},
"timestamp": "2026-05-04T14:30:00Z",
"meta": {
"es_attribution_ms": 120,
"config_ms": 5,
"ch_counterparties_ms": 340,
"ch_totals_ms": 80,
"es_interchain_ms": 210,
"helius_ms": 150,
"solana_address_risk_ms": 40,
"features_redis_ms": 60,
"counterparty_attribution_ms": 0,
"parallel_ms": 350,
"total_ms": 410,
"signals": [
"ofac-sanctioned",
"fraud-ml-liquidity-rug"
]
},
"evidence": {}
}Authorizations
Authorization method required to allow user to access the api endpoints.
Query Parameters
Time window for analysis: 30d, 90d, 180d, 365d, or all.
Comma-separated catalogue ids to run (see GET /v2/risk/signals). Omitted = full assessment. Echoed on meta.signals as the ids that actually ran (requested ∩ workspace-enabled).
Response
"a1b2c3d4-e5f6-7890-abcd-ef1234567890"
"0x742d35Cc6634C0532925a3b844Bc9e7595f2bD28"
Networks this address has labelled activity on (from addresses.labels).
["ethereum", "polygon"]
All-counterparty incoming USD volume (lifetime). 0 for unsupported networks.
1842300.45
All-counterparty outgoing USD volume (lifetime).
1798450.12
USD volume from counterparties tagged as malicious.
184500
USD volume to counterparties tagged as malicious.
92300
Worst individual signal severity across all three pillars.
severe, high, medium, low, none "high"
Show child attributes
Show child attributes
Show child attributes
Show child attributes
Show child attributes
Show child attributes
"2026-05-04T14:30:00Z"
Per-upstream-call latency (ms) for this screen.
Show child attributes
Show child attributes
Present only when include_evidence=true. Same shape as GET /v2/risk/evidence/:screenId minus the wrapping screen_id.
Was this page helpful?