How to integrate

​

1. Fire the audit

curl "https://www.serializedaudit.io/api/audit-contract?chain=base&address=0x6D7401F6f1fB09ff24a048337ff44D890CdF86F8&async=true&subscribe=true" \
  -H "X-Auth-Key: sk_live_your_key_here"

• { "audit": { ... } }: the token was already audited. Store it, you are done. The subscription is created either way.
• { "status": "FETCHING" | "DECOMPILING" | "ANALYZING" }: a fresh audit is running. Do nothing. The finished verdict arrives on your stream.

​

2. Hold the stream

import EventSource from "eventsource"; // any server-side SSE client works

const es = new EventSource("https://www.serializedaudit.io/api/stream", {
  headers: { "X-Auth-Key": process.env.SERIALIZED_API_KEY },
});
es.addEventListener("audit.changed", (e) => {
  const evt = JSON.parse(e.data);
  cache.set(`${evt.chain}:${evt.address}`, evt.audit);
});

• The stream carries events for the tokens you are subscribed to.
• Solana works the same way: chain=solana and the token’s mint address, exactly as written. See Solana tokens.
• evt.audit is the complete new verdict, the exact same object /audit-contract returns. Storing it is the entire update.
• Reconnection and resume are automatic (Last-Event-ID): after a disconnect you receive everything you missed, in order.
• We send a keepalive comment every 25 seconds. Reconnect on any disconnect, with your own backoff.

​

What it gives you

• Every subscribed token is re-checked onchain continuously, and every verdict change is pushed: a safe/unsafe flip, an owner change or renounce, a gate or a honeypot turning on or off.
• Re-audits we trigger are free, including closed-source tokens whose source verifies later: you receive the verified verdict automatically.
• Your users always see the current verdict. There is no stale-data window.
• Your credit spend drops: a subscription is 2 credits once per token, instead of refresh calls forever. See Credits & Billing.

​

What NOT to build

• No polling loop. Do not re-call /audit-contract to keep a verdict fresh. Changes come to you.
• No cache TTL. A stored verdict stays valid until an audit.changed event replaces it.
• No re-fetch on push. The event already contains the full audit. Do not call the API back.
• No status polling. With async=true&subscribe=true the result is pushed. Polling still works, it is just never needed.

​

Alternatives, when they fit better

• Synchronous + subscribe: call /audit-contract with only subscribe=true and get the audit directly in the response (the call stays open while a fresh audit runs). The stream still handles all future changes.
• Webhooks instead of SSE: we POST each event, HMAC-signed, to your HTTPS endpoint. Same payloads, same guarantees. See SSE & Webhooks.
• Catch-up replay: GET /api/events?since=<last_id> returns anything you missed. It is the durable backstop behind both transports.