Audit a contract

curl --request GET \
  --url https://www.serializedaudit.io/api/audit-contract \
  --header 'X-Auth-Key: <api-key>'

const options = {method: 'GET', headers: {'X-Auth-Key': '<api-key>'}};

fetch('https://www.serializedaudit.io/api/audit-contract', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://www.serializedaudit.io/api/audit-contract",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "X-Auth-Key: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://www.serializedaudit.io/api/audit-contract"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("X-Auth-Key", "<api-key>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://www.serializedaudit.io/api/audit-contract")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["X-Auth-Key"] = '<api-key>'

response = http.request(request)
puts response.read_body

{
  "audit": {
    "isSafe": true,
    "isTokenSafe": true,
    "isHookSafe": null,
    "description": "Standard ERC-20 token. No owner privileges that can harm holders were detected.",
    "vulnerabilities": [],
    "name": "Example Token",
    "symbol": "EXMPL",
    "address": "0x6D7401F6f1fB09ff24a048337ff44D890CdF86F8",
    "chain": "BASE",
    "sourceType": "verified",
    "isProxy": false,
    "implementationAddress": null,
    "hookAddress": null,
    "hookAudit": null,
    "createdAt": "2026-06-22T10:00:00.000Z",
    "auditSystemVersion": "prod-v2.10",
    "latestAuditSystemVersion": "prod-v2.10"
  }
}

GET

audit-contract

Audit a contract

curl --request GET \
  --url https://www.serializedaudit.io/api/audit-contract \
  --header 'X-Auth-Key: <api-key>'

const options = {method: 'GET', headers: {'X-Auth-Key': '<api-key>'}};

fetch('https://www.serializedaudit.io/api/audit-contract', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://www.serializedaudit.io/api/audit-contract",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "X-Auth-Key: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://www.serializedaudit.io/api/audit-contract"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("X-Auth-Key", "<api-key>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://www.serializedaudit.io/api/audit-contract")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["X-Auth-Key"] = '<api-key>'

response = http.request(request)
puts response.read_body

{
  "audit": {
    "isSafe": true,
    "isTokenSafe": true,
    "isHookSafe": null,
    "description": "Standard ERC-20 token. No owner privileges that can harm holders were detected.",
    "vulnerabilities": [],
    "name": "Example Token",
    "symbol": "EXMPL",
    "address": "0x6D7401F6f1fB09ff24a048337ff44D890CdF86F8",
    "chain": "BASE",
    "sourceType": "verified",
    "isProxy": false,
    "implementationAddress": null,
    "hookAddress": null,
    "hookAudit": null,
    "createdAt": "2026-06-22T10:00:00.000Z",
    "auditSystemVersion": "prod-v2.10",
    "latestAuditSystemVersion": "prod-v2.10"
  }
}

Authorizations

X-Auth-Key

string

header

required

Your secret API key. Create one from your dashboard.

Query Parameters

chain

enum<string>

required

Chain the contract is deployed on, as a case-insensitive symbol. See Supported Chains.

Available options:

ETH,

OP,

ARB,

BASE,

BSC,

AVAX,

APE,

BLAST,

LINEA,

MANTLE,

POLYGON,

ZKEVM,

SCROLL,

SONIC,

ZKSYNC,

ABSTRACT,

MONAD,

PLASMA,

MEGAETH,

HYPE,

ROBINHOOD,

ARC,

STABLE

address

string

required

The contract address to audit.

Pattern: ^0x[a-fA-F0-9]{40}$

allow_decompile

enum<string>

default:true

Closed-source contracts are audited on decompiled bytecode (the most expensive tier). Set false to opt out: closed-source contracts then answer { "audit": null, "reason": "decompile_disabled" } instead of being decompiled, and cached decompiled verdicts are not served. Sent as the string "true"/"false" in the query.

Available options:

true,

false

async

enum<string>

default:false

Async mode. false (default): the request holds until the audit is done, classic synchronous behavior. true: if no cached audit exists, the audit is started in the background and the response is { status }; poll the SAME URL every 1-2s until it flips to { audit } (typically 10-30s for a first-time audit). There is no job id: an audit is idempotent per (chain, address), so the token address is the job handle. Billing is identical in both modes; progress responses are never billed. With subscribe=true you do not even poll: the finished verdict is pushed to you (over your SSE stream or webhook) the moment it lands (see SSE & Webhooks).

Available options:

true,

false

Subscribe this (chain, address) to push updates as part of this call. Once subscribed, any later verdict change (safe↔unsafe flip, owner change, a gate or honeypot flipping, or a closed-source token re-audited on its now-verified source) is pushed to you over a live SSE stream or a webhook, instead of you polling. Combined with async=true, the finished audit result is itself pushed when ready, so you fire the call and just consume the events. Subscribing works with or without a delivery transport configured; with neither, pull the changes from GET /api/events (see SSE & Webhooks). Charges the one-time subscribe fee for a genuinely-new token; idempotent for an already-subscribed one.

Available options:

true,

false

Response

The audit verdict, wrapped in an audit object.

Option 1
Option 2
Option 3

The response shape.

audit

object

required

The audit result.

Show child attributes

billing

object

Echo of what this call was billed, present only for authenticated API-key callers (never for anonymous/browser traffic). type is the bill category (e.g. cached, fresh_no_decompile, fresh_with_decompile, refresh) or null when the call is free; credits is the amount metered.

Show child attributes

⌘I

Get Started

API Reference

Reference

Programs

Resources

Audit a contract

Authorizations

Query Parameters

Response