Cradara-Karnóc Risk API
One engine, two products: the API calls the same Karnóc service as the app. Versioned paths; breaking changes only in a new version. Authentication: X-API-Key: ck_live_… (keys per customer, per-key rate limits).
| Endpoint | Returns |
|---|---|
GET /v1/tokens/{chain}/{address}/risk | Risk level, findings, checks not run, data age, evidence bundle ID |
GET /v1/addresses/{chain}/{address}/risk | Address risk level, list matches, findings |
GET /v1/evidence/{bundle_id} | Full evidence bundle for a past result |
POST /v1/monitors | Subscribe a token to continuous monitoring (optional signed webhook) |
GET /v1/usage | Calls used, plan limits |
GET /v1/feeds/malicious?since= | High and Critical results and confirmed labels (Phase 2) |
GET /v1/urls/check?url= | Phishing and look-alike checks |
POST /v1/transactions/simulate | Pre-signature simulation and approval decoding |
POST /v1/threat-reports | Report an address to the shared threat network |
GET /v1/deliveries/{date}.ndjson | Daily data file with SHA-256 header |
Example
curl -H "X-API-Key: $CRADARA_KEY" https://crypto.bapc.app/v1/tokens/ethereum/0x…/risk
MCP server
Point an MCP client at https://crypto.bapc.app/mcp (streamable HTTP, JSON responses) with the same API key. Tools: token_risk, address_risk, get_evidence, check_url.
Webhooks
Each delivery is signed: X-Cradara-Signature: sha256=HMAC(secret, timestamp + "." + body) with X-Cradara-Timestamp. Retries back off for up to 8 attempts.
Service terms (pilot)
- Uptime target 99.5% during the pilot; free check response under 5 seconds when cached, under 20 seconds for new tokens (targets, to be confirmed).
- Scores are one input, not a guarantee. Liability is limited as set out in the pilot agreement.
- Known limitations are listed in the methodology.