> ## Documentation Index
> Fetch the complete documentation index at: https://docs.range.org/llms.txt
> Use this file to discover all available pages before exploring further.

# Fetch Assessment Evidence

> Fetch full evidence for a previous address screen or pre-signature transaction scan using its screen ID.



## OpenAPI

````yaml get /v2/risk/evidence/{screenId}
openapi: 3.0.0
info:
  title: Range Risk API
  description: The Range Risk API for risk assessment of crypto addresses.
  version: 1.7.29
  contact: {}
servers:
  - url: https://api.range.org
    description: Range API Server
security:
  - Authorization: []
tags:
  - name: Risk
    description: Get risk information about a crypto address.
  - name: Risk v2
    description: >-
      Address risk assessment, workspace configuration, and signals catalogue
      (API v2).
  - name: Simulator
    description: Simulate a transaction on a network.
paths:
  /v2/risk/evidence/{screenId}:
    get:
      tags:
        - Risk v2
      summary: Get Evidence by screen_id
      description: >-
        Returns the full evidence breakdown for a previously issued screen_id,
        grouped by pillar (attribution, exposure, behaviour) and signal,
        alongside the original risk assessment. A screen_id issued by `POST
        /v2/risk/transaction/scan` resolves here too, returning the scan-shaped
        evidence (the stored scan plus per-counterparty assessments). Scoped to
        the calling workspace.
      operationId: getEvidence
      parameters:
        - name: screenId
          required: true
          in: path
          schema:
            type: string
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                anyOf:
                  - $ref: '#/components/schemas/EvidenceResponseDto'
                  - $ref: '#/components/schemas/ScanEvidenceResponseDto'
components:
  schemas:
    EvidenceResponseDto:
      type: object
      properties:
        screen_id:
          type: string
          example: a1b2c3d4-e5f6-7890-abcd-ef1234567890
        assessment:
          $ref: '#/components/schemas/RiskAssessmentDto'
        attribution_evidence:
          type: array
          items:
            $ref: '#/components/schemas/AttributionEvidenceEntryDto'
        exposure_evidence:
          type: array
          items:
            $ref: '#/components/schemas/ExposureEvidenceEntryDto'
        behaviour_evidence:
          type: array
          items:
            $ref: '#/components/schemas/BehaviourEvidenceEntryDto'
      required:
        - screen_id
        - assessment
        - attribution_evidence
        - exposure_evidence
        - behaviour_evidence
    ScanEvidenceResponseDto:
      type: object
      properties:
        screen_id:
          type: string
        scan:
          $ref: '#/components/schemas/TransactionScanResponseDto'
        counterparty_assessments:
          description: Full Address Risk v2 assessments for every screened counterparty.
          type: array
          items:
            $ref: '#/components/schemas/RiskAssessmentDto'
        simulator_account_risk:
          type: object
          description: >-
            Simulator's own per-account verdicts (1–10 proximity model),
            retained as evidence — range-api's assessments above are the
            authoritative verdicts.
      required:
        - screen_id
        - scan
        - counterparty_assessments
    RiskAssessmentDto:
      type: object
      properties:
        screen_id:
          type: string
          example: a1b2c3d4-e5f6-7890-abcd-ef1234567890
        address:
          type: string
          example: '0x742d35Cc6634C0532925a3b844Bc9e7595f2bD28'
        address_active_on:
          example:
            - ethereum
            - polygon
          description: >-
            Networks this address has labelled activity on (from
            addresses.labels).
          type: array
          items:
            type: string
        total_incoming_usd:
          type: number
          example: 1842300.45
          description: >-
            All-counterparty incoming USD volume (lifetime). 0 for unsupported
            networks.
        total_outgoing_usd:
          type: number
          example: 1798450.12
          description: All-counterparty outgoing USD volume (lifetime).
        malicious_incoming_usd:
          type: number
          example: 184500
          description: USD volume from counterparties tagged as malicious.
        malicious_outgoing_usd:
          type: number
          example: 92300
          description: USD volume to counterparties tagged as malicious.
        severity:
          type: string
          example: high
          enum:
            - severe
            - high
            - medium
            - low
            - none
          description: Worst individual signal severity across all three pillars.
        attribution:
          $ref: '#/components/schemas/AttributionSummaryDto'
        exposure:
          $ref: '#/components/schemas/ExposureSummaryDto'
        behaviour:
          $ref: '#/components/schemas/BehaviourSummaryDto'
        timestamp:
          type: string
          example: '2026-05-04T14:30:00Z'
        evidence:
          type: object
          description: >-
            Present only when `include_evidence=true`. Same shape as GET
            /v2/risk/evidence/:screenId minus the wrapping screen_id.
      required:
        - screen_id
        - address
        - address_active_on
        - total_incoming_usd
        - total_outgoing_usd
        - malicious_incoming_usd
        - malicious_outgoing_usd
        - severity
        - attribution
        - exposure
        - behaviour
        - timestamp
    AttributionEvidenceEntryDto:
      type: object
      properties:
        signal:
          type: string
          example: sanctions_ofac
        evidence:
          type: array
          items:
            $ref: '#/components/schemas/EvidenceDto'
      required:
        - signal
        - evidence
    ExposureEvidenceEntryDto:
      type: object
      properties:
        signal:
          type: string
          example: obfuscation
        evidence:
          type: array
          items:
            $ref: '#/components/schemas/EvidenceDto'
      required:
        - signal
        - evidence
    BehaviourEvidenceEntryDto:
      type: object
      properties:
        behaviour:
          type: string
          example: smurfing
        evidence:
          type: array
          items:
            $ref: '#/components/schemas/EvidenceDto'
      required:
        - behaviour
        - evidence
    TransactionScanResponseDto:
      type: object
      properties:
        screen_id:
          type: string
          example: a1b2c3d4-e5f6-7890-abcd-ef1234567890
        network:
          type: string
          enum:
            - solana
        payload_sha256:
          type: string
          description: >-
            SHA-256 of the decoded payload bytes — the scan identity of this
            (still unsigned) transaction.
        signer:
          type: string
          description: The signing account this scan assumed.
        severity:
          type: string
          enum:
            - severe
            - high
            - medium
            - low
            - none
          description: Worst single signal across counterparties and findings.
        intent:
          nullable: true
          description: >-
            LLM-extracted intent. Null when extraction was unavailable or timed
            out (see notes).
          type: object
          allOf:
            - $ref: '#/components/schemas/ScanIntentDto'
        simulation:
          nullable: true
          description: What signing actually does. Null when simulation failed.
          type: object
          allOf:
            - $ref: '#/components/schemas/ScanSimulationDto'
        counterparties:
          type: array
          items:
            $ref: '#/components/schemas/ScanCounterpartyDto'
        findings:
          type: array
          items:
            $ref: '#/components/schemas/ScanFindingDto'
        notes:
          type: array
          items:
            $ref: '#/components/schemas/ScanNoteDto'
        timestamp:
          type: string
          example: '2026-08-18T14:30:00Z'
        meta:
          $ref: '#/components/schemas/ScanMetaDto'
      required:
        - screen_id
        - network
        - payload_sha256
        - severity
        - counterparties
        - findings
        - notes
        - timestamp
        - meta
    AttributionSummaryDto:
      type: object
      properties:
        triggered:
          type: array
          items:
            $ref: '#/components/schemas/AttributionSignalResultDto'
      required:
        - triggered
    ExposureSummaryDto:
      type: object
      properties:
        triggered:
          type: array
          items:
            $ref: '#/components/schemas/ExposureSignalResultDto'
      required:
        - triggered
    BehaviourSummaryDto:
      type: object
      properties:
        detected:
          type: array
          items:
            $ref: '#/components/schemas/BehaviourSignalResultDto'
      required:
        - detected
    EvidenceDto:
      type: object
      properties:
        type:
          type: string
          example: counterparty
          enum:
            - transaction
            - counterparty
            - pattern
            - attribution
        summary:
          type: string
          example: Interacted with OFAC-sanctioned address 0xDEF... on 2026-03-15
        details:
          type: object
          additionalProperties: true
          example:
            address: 0xDEF...
            tx_hash: 0x789...
            timestamp: '2026-03-15T14:22:00Z'
            entity: Tornado Cash
            list: OFAC SDN
      required:
        - type
        - summary
        - details
    ScanIntentDto:
      type: object
      properties:
        summary:
          type: string
          example: Swap 100 USDC for SOL on Jupiter
        action:
          type: string
          example: swap
        confidence:
          type: string
          example: high
          enum:
            - high
            - medium
            - low
      required:
        - summary
    ScanSimulationDto:
      type: object
      properties:
        simulation_success:
          type: boolean
          example: true
        asset_diffs:
          type: array
          items:
            $ref: '#/components/schemas/ScanAssetDiffDto'
        state_changes:
          description: Human-readable predicted state changes, from the simulator.
          type: array
          items:
            type: string
        programs_invoked:
          type: array
          items:
            type: object
            properties:
              name:
                type: string
              id:
                type: string
            required:
              - name
              - id
      required:
        - simulation_success
        - asset_diffs
        - state_changes
        - programs_invoked
    ScanCounterpartyDto:
      type: object
      properties:
        address:
          type: string
        source:
          type: string
          enum:
            - asset-diff
            - permission-target
            - static-account
          description: >-
            Why this account was screened. `static-account` appears only on the
            simulation-failed fallback path. Invoked programs are never screened
            — see `simulation.programs_invoked` for what the transaction calls.
        severity:
          type: string
          enum:
            - severe
            - high
            - medium
            - low
            - none
        triggered_signals:
          description: Signals that fired on this counterparty, across pillars.
          type: array
          items:
            type: string
      required:
        - address
        - source
        - severity
        - triggered_signals
    ScanFindingDto:
      type: object
      properties:
        signal:
          type: string
          example: authority-change
        severity:
          type: string
          enum:
            - severe
            - high
            - medium
            - low
        caption:
          type: string
          example: Token Authority … changed
        evidence:
          type: object
          description: Signal-specific supporting details.
      required:
        - signal
        - severity
        - caption
    ScanNoteDto:
      type: object
      properties:
        code:
          type: string
          example: coverage-truncated
        message:
          type: string
          example: Counterparty screening truncated to 50 accounts (63 selected).
      required:
        - code
        - message
    ScanMetaDto:
      type: object
      properties:
        counterparties_screened:
          type: number
          example: 12
        counterparties_screened_complete:
          type: boolean
          example: true
          description: >-
            False on any counterparty coverage gap: a screen failed (medium
            counterparty-screening-partial finding), a token account had no
            resolvable owner wallet (medium counterparty-owner-unresolved
            finding), or the selection was truncated at the cap (medium
            coverage-truncated finding). Either way the gap lifts the verdict.
            Analogous to poisoning_screened.
        coverage_truncated:
          type: boolean
          example: false
        poisoning_screened:
          type: boolean
          example: true
          description: >-
            False when the lookalike screen did not run or did not complete —
            treat as NOT SCREENED, never as clean. Vacuously true when the
            transaction credits no owner-resolvable recipients (recipients
            excluded by counterparty-owner-unresolved are covered by that
            finding, not by this flag).
        simulate_ms:
          type: number
          example: 420
        screening_ms:
          type: number
          example: 610
        poisoning_ms:
          type: number
          example: 480
        intent_ms:
          type: number
          example: 900
        total_ms:
          type: number
          example: 1450
      required:
        - counterparties_screened
        - counterparties_screened_complete
        - coverage_truncated
        - poisoning_screened
        - simulate_ms
        - screening_ms
        - poisoning_ms
        - intent_ms
        - total_ms
    AttributionSignalResultDto:
      type: object
      properties:
        signal:
          type: string
          example: sanctions_ofac
        severity:
          type: string
          example: severe
          enum:
            - severe
            - high
            - medium
            - low
        result:
          type: boolean
          example: true
      required:
        - signal
        - severity
        - result
    ExposureSignalResultDto:
      type: object
      properties:
        signal:
          type: string
          example: compliance-risk
        mode:
          type: string
          example: percentage
          enum:
            - percentage
        result:
          type: boolean
          example: true
        percentage:
          type: string
          example: 42.30%
          description: >-
            Exposed bucket volume as a share of total counterparty volume,
            formatted human-readable.
        summary:
          type: string
          example: >-
            42.30% of counterparty volume is compliance-risk, crossing the 5%
            (high) threshold.
          description: Human-readable explanation of why this signal fired.
      required:
        - signal
        - mode
        - result
        - percentage
        - summary
    BehaviourSignalResultDto:
      type: object
      properties:
        behaviour:
          type: string
          example: smurfing
        severity:
          type: string
          example: high
          enum:
            - severe
            - high
            - medium
            - low
        confidence:
          type: number
          example: 0.78
          minimum: 0
          maximum: 1
        ignored:
          type: boolean
          example: true
          description: >-
            True when the workspace set this behaviour to detect-only. Reported
            for visibility and excluded from the screen severity.
      required:
        - behaviour
        - severity
        - confidence
    ScanAssetDiffDto:
      type: object
      properties:
        account:
          type: string
          description: Account whose balance changes.
        owner:
          type: string
          description: >-
            Owner wallet when `account` is a token account; equals `account`
            otherwise.
        asset:
          type: string
          example: EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v
          description: Token mint, or `SOL` for native lamport changes.
        amount:
          type: number
          example: 100.5
        direction:
          type: string
          enum:
            - credit
            - debit
      required:
        - account
        - asset
        - amount
        - direction
  securitySchemes:
    Authorization:
      type: apiKey
      in: header
      name: X-API-KEY
      description: Authorization method required to allow user to access the api endpoints.

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.