Skip to main content
POST
Scan an Unsigned Transaction (pre-signature)

Authorizations

X-API-KEY
string
header
required

Authorization method required to allow user to access the api endpoints.

Body

application/json
network
enum<string>
required
Available options:
solana
Example:

"solana"

transaction
string
required

The complete serialized unsigned transaction — account list, instructions, blockhash — as one encoded string (what a wallet holds immediately before signing).

Required string length: 1 - 4096
Example:

"AQAAAAAAAAAA…"

encoding
enum<string>

Encoding of transaction. Defaults to base64.

Available options:
base64,
base58
signer_address
string

The signing account. Defaults to the fee payer derived from the payload.

Maximum string length: 64
origin
string

Origin (dApp URL) that produced this transaction. Recorded with the scan and forwarded to intent extraction.

Maximum string length: 2048

Response

200 - application/json
screen_id
string
required
Example:

"a1b2c3d4-e5f6-7890-abcd-ef1234567890"

network
enum<string>
required
Available options:
solana
payload_sha256
string
required

SHA-256 of the decoded payload bytes — the scan identity of this (still unsigned) transaction.

severity
enum<string>
required

Worst single signal across counterparties and findings.

Available options:
severe,
high,
medium,
low,
none
counterparties
object[]
required
findings
object[]
required
notes
object[]
required
timestamp
string
required
Example:

"2026-08-18T14:30:00Z"

meta
object
required
signer
string

The signing account this scan assumed.

intent
object | null

LLM-extracted intent. Null when extraction was unavailable or timed out (see notes).

simulation
object | null

What signing actually does. Null when simulation failed.

Last modified on September 3, 2026