API docs · AML Safety

Getting started

The AML Safety API screens a TRON, Ethereum/EVM or Bitcoin address and returns a level, a score from 0 to 100 and the reasons. Every check and every decision is written to an append-only audit log.

Base URL: https://amlsafety.com. All requests and responses are JSON.

Authentication

Send your API key in the Authorization header. Keys are shown once when created; we only store a hash.

Authorization: Bearer aml_live_…

Check an address

POST/v1/check

Field	Type
`input`	string	A TRON, Ethereum or Bitcoin address, or a transaction ID. Required.
`side`	string	For a transaction ID: `received` (default; you got the money, we check the sender) or `sent` (we check the recipient).
`address`	string	For a transaction ID: your own address, so we pick the right transfer when there are several. Optional.
`ref`	string	Your own reference, e.g. an order ID. Optional, up to 64 chars.
`actor`	string	Who at your company ran it, e.g. `tg:981439460`. Kept in the audit log.

curl https://amlsafety.com/v1/check \ -H "Authorization: Bearer $AML_KEY" -H "Content-Type: application/json" \ -d '{"input":"TJQVmRR4fk71LDfU16iPQEGurMu7he1ySz","ref":"order-1042"}' { "id": "aml_3f9c1e07ab42", "created_at": "2026-10-11T14:02:11.204Z", "ref": "order-1042", "chain": "tron", "address": "TJQVmRR4fk71LDfU16iPQEGurMu7he1ySz", "score": 0, "level": "low", "reasons": [], "warnings": [], "rules_version": "v1", "data_as_of": { "ofac_sdn": "2026-10-11T06:00:04Z", "tether_tron": "2026-10-11T06:00:09Z" }, "sources_checked": ["database", "tether_tron_live"] }

For a transaction ID the response also has transaction: the hash, chain, the transfer we screened (from, to, asset, amount) and which side we checked. Stablecoin transfers are preferred when a transaction has several.

-d '{"input":"a5dfb473bd7df6fa4b787882a3240c9eab2842da546ae89a963002a201aacd16","side":"received"}'

Levels & reasons

Level	Score	Meaning
low	0–29	No known risk.
medium	30–69	Review first; a decision needs a note.
high	70–99	Strong warning; proceeding needs an override with a reason.
stop	100	Sanctioned, frozen by the issuer (or being frozen right now), or on your blocklist.

Each entry in reasons has a code, a plain-English text, the points it added and the source. warnings tells you when a live source could not be reached or a list is stale.

Code	Points	Meaning
`sanctioned`, `frozen`, `blocked`	100	On a US/UK/EU sanctions list, frozen by Tether/Circle/Paxos, or on your blocklist.
`freeze_pending`	100	Tether has proposed freezing the address on its multisig; the freeze isn’t executed yet.
`stolen`, `ransomware`, `mixer`	90	The address belongs to a hacker, received ransomware payments, or is a mixer.
`restricted_platform`	80	A wallet of a sanctioned platform (HTX, Garantex, Nobitex…).
`freeze_evasion`	80	Received USDT drained from a wallet minutes before Tether froze it.
`sanctioned_token`	80	Has used A7A5, the sanctioned ruble stablecoin.
`scam`	40–80	Phishing / scam reports, by confidence; several reports add up.
`gambling`	50	A gambling service’s address.
`received_from_*`	up to 60	Money received directly from a flagged address, by its share of all incoming funds (TRON; Ethereum with tracing on).
`sent_to_*`	0 or 70	Money sent to a flagged address; paying a sanctioned one scores 70.
`control_changed`	30	TRON wallet whose own key can no longer send alone (permissions changed): how hijacked wallets look. Confirm with the owner before paying.
`exchange`, `received_from_exchange`	0	Shown for information: the address is, or was paid by, an exchange.
`received_from_unidentified`, `shared_counterparties`, `poisoning_target`	0	Information: what kind of unlabelled wallets the money came from (OTC hubs, collectors…), counterparties seen behind other checked wallets, and look-alike addresses that targeted this wallet.

Get a check

GET/v1/check/:id: the stored check with every decision made on it.

Record a decision

POST/v1/check/:id/decision

Field
`action`	`proceed`, `override`, `reject` or `report`.
`reason`	Required for `override` and for decisions on `medium` checks.
`actor`	Who decided. Kept in the audit log.

proceed is refused on high and stop; use override with a reason so the audit log shows why.

Blocklist

POST/v1/block and POST/v1/unblock with { input, reason, actor }. A blocked address scores 100 (stop) from then on.

Errors & limits

Status	error	Meaning
400	`input_required`, `unrecognised_input`, `bad_side`, `tx_no_transfer`, `bad_action`, `reason_required`, `override_required`	Fix the request; `message` explains what is missing.
401	`missing_api_key`, `bad_api_key`	Check your key.
404	`not_found`, `tx_not_found`	No such check for your account, or the transaction isn’t on TRON, Ethereum or Bitcoin.
502	`tx_lookup_failed`	We couldn’t read the transaction from the chain right now; retry shortly.
429		More than 120 requests a minute.