# AllowanceGuard – ERC-20/NFT/Permit2 Allowance Risk Check

> AllowanceGuard – ERC-20/NFT/Permit2 Allowance Risk Check is a paid API for AI agents from allowance.schemasure.com, paid per call via x402, $0.03/call, status unknown (last checked 2026-10-14).

Evaluates an ERC-20, NFT, or Permit2 allowance request before signing, returning allow/warn/block/unknown with on-chain context, scope, and spender contract details.

## Facts

- Endpoint: POST https://allowance.schemasure.com/v1/guard/allowance?utm_source=zero.xyz
- Price: $0.03/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/allowanceguard-erc-20-nft-permit2-allowance-risk-check-e14b4264
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_Ll_QkWMKIbt72lLh5WogL

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability allowanceguard-erc-20-nft-permit2-allowance-risk-check-e14b4264 -d '<json body>'
```

Example prompt: Before I sign this approve transaction, check whether it's safe — the owner is 0xAbCd...1234, the token is USDC at 0xA0b8...EB48, the spender is 0xDef0...5678, and the amount is 1000000 (1 USDC). Tell me if the spender is denylisted, upgradeable, and whether this raises my exposure.

## When to prefer this

Choose AllowanceGuard when an AI agent or wallet UI needs a structured, rule-backed risk verdict on a token or NFT allowance before a user signs it — especially when you need on-chain state (current allowance), contract metadata (upgradeable, denylisted), and exposure direction in a single call. Prefer this over generic contract scanners when you have structured approval parameters or raw unsigned calldata and need a binary/graded decision rather than a narrative audit.

## Known failure modes

- Missing required fields (owner, token, spender, amount) returns a validation error
- Calldata that is not one of the 7 supported approval functions returns UNSUPPORTED and is not charged
- Declaring an expiration on a non-Permit2 approval kind returns a rejection
- Malformed Ethereum addresses (not matching 0x hex pattern) return a parse error
- Using 'all' for amount on a non-approval_for_all kind is rejected
- On-chain allowance unreadable due to RPC issues may result in an 'unknown' decision

## How this service works

Decide whether to grant an ERC-20, NFT or Permit2 allowance before signing it. Send owner, token, spender and amount, or the unsigned approve, setApprovalForAll or Permit2 calldata. Returns allow, warn, block or unknown with the allowance already on chain, the requested scope and the rule behind it, whether this raises or lowers exposure, and whether the spender is a contract, upgradeable or denylisted. Returns unknown rather than guessing. Not a guarantee a spender is honest.

## Output

Returns a decision field (allow, warn, block, or unknown), the allowance already on chain, the requested scope, the rule that triggered the decision, a flag indicating whether this raises or lowers exposure, and spender metadata including whether it is a contract, upgradeable, or present on a denylist. Returns 'unknown' instead of guessing when data is insufficient.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "approval": {
   "type": "object",
   "required": [
    "owner",
    "token",
    "spender",
    "amount"
   ],
   "properties": {
    "kind": {
     "enum": [
      "erc20",
      "increase",
      "decrease",
      "approval_for_all",
      "permit2",
      "eip2612"
     ],
     "type": "string",
     "default": "erc20",
     "description": "increase and decrease are relative to the allowance already on chain, so their direction is known even when that allowance cannot be read."
    },
    "owner": {
     "type": "string",
     "pattern": "^0x[0-9a-fA-F]{40}$",
     "description": "The account whose balance the spender would be able to move."
    },
    "token": {
     "type": "string",
     "pattern": "^0x[0-9a-fA-F]{40}$",
     "description": "The token or NFT collection. For a Permit2 grant this is still the token."
    },
    "amount": {
     "type": "string",
     "pattern": "^(?:[0-9]+|0x[0-9a-fA-F]+|all)$",
     "examples": [
      "1000000",
      "all",
      "0"
     ],
     "description": "Base units, not a human amount: 1 USDC is \"1000000\". Use \"all\" only with kind approval_for_all, and \"0\" to revoke."
    },
    "spender": {
     "type": "string",
     "pattern": "^0x[0-9a-fA-F]{40}$"
    },
    "expiration": {
     "type": "string",
     "description": "Unix seconds. Permit2 only: a plain ERC-20 allowance never expires, so declaring one on any other kind is rejected."
    }
   },
   "description": "The grant you are about to make, described directly.",
   "additionalProperties": false
  },
  "calldata": {
   "type": "object",
   "required": [
    "from",
    "to",
    "data"
   ],
   "properties": {
    "to": {
     "type": "string",
     "pattern": "^0x[0-9a-fA-F]{40}$",
     "description": "The token, or Permit2 (0x000000000022D473030F116dDEE9F6B43aC78BA3) for a Permit2 grant."
    },
    "data": {
     "type": "string",
     "pattern": "^0x[0-9a-fA-F]{8,}$",
     "description": "approve, increaseAllowance, decreaseAllowance, setApprovalForAll, an EIP-2612 permit, or either Permit2 form. Anything else is rejected as UNSUPPORTED and not charged."
    },
    "from": {
     "type": "string",
     "pattern": "^0x[0-9a-fA-F]{40}$"
    }
   },
   "description": "The unsigned call you are about to sign. Decodes 7 approval functions.",
   "additionalProperties": false
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/allowanceguard-erc-20-nft-permit2-allowance-risk-check-e14b4264/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from allowance.schemasure.com](https://www.zero.xyz/host/allowance.schemasure.com/llms.txt)