# Gnosis Safe Spending Authority Drift Detector

> Gnosis Safe Spending Authority Drift Detector is a paid API for AI agents from api402x.com, paid per call via x402, $0.005/call, status down (last checked 2026-10-13).

Reads a Gnosis Safe's current owner set, threshold, modules, and guard from chain, then compares against its state at an earlier block to detect and pinpoint any changes in spending authority.

## Facts

- Endpoint: GET https://api402x.com/safe-signer-drift?utm_source=zero.xyz
- Price: $0.005/call
- Payment: x402
- Status: down
- Last checked: 2026-10-13
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/gnosis-safe-spending-authority-drift-detector-8cb9b25a
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_6hytiVCMeooyyYJDsZCku

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability gnosis-safe-spending-authority-drift-detector-8cb9b25a
```

Example prompt: Check if the Gnosis Safe at 0x91c32893216dE3eA0a55ABb9851f581d4503d39b on Ethereum mainnet (chain ID 1) has had any owner, threshold, or module changes in the last 30 days — I need to know if its spending authority has drifted.

## When to prefer this

Choose this endpoint when you need to detect whether a Gnosis Safe's spending authority has changed without maintaining your own historical baseline or running an indexer. It is especially valuable when historical RPC reads are required (archive nodes), since many public RPCs refuse or prune such requests. Prefer this over manual event log scraping when you need the exact block of change (binary-searched, not assumed), or when module changes — which can move funds with zero owner signatures — are a security concern. It requires no subscription, no prior state storage, and returns a definitive answer on the first call.

## Known failure modes

- Invalid or non-Safe address returns address_status indicating it is not a recognized Safe proxy
- Chain ID not supported returns an error listing supported chains
- Public RPC without archive capability would fail — endpoint uses archive-capable nodes internally so this is handled, but an unsupported chain_id may surface RPC errors
- lookback_blocks set beyond available chain history may return an error or fall back to genesis
- Malformed address (not 0x + 40 hex) returns a validation error
- Payment failure (x402) results in 402 response before any chain reads occur

## How this service works

Onchain- and crypto-market data for trading AI agents. Payment via x402 (USDC, exact scheme).

## Output

Returns a JSON object with: the Safe's current full state (owners list, threshold, modules, guard, nonce, singleton version, block number/timestamp); the baseline state read from chain history at the lookback block; a drift summary indicating 'changed' or 'unchanged', listing added/removed owners, added/removed modules, before/after threshold, before/after guard, the block where the change occurred (found via binary search), the number of archive RPC calls used to find it, and an archive proof showing which endpoint was used and that it can read historical state. Also includes address_status confirming the address is a valid Safe proxy.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "chain_id",
      "address"
     ],
     "properties": {
      "address": {
       "type": "string",
       "description": "REQUIRED. The Safe proxy address (0x + 40 hex) on that chain."
      },
      "chain_id": {
       "type": "string",
       "description": "REQUIRED. Numeric EVM chain id as a string, e.g. 1 (Ethereum), 8453 (Base), 42161 (Arbitrum), 10 (Optimism). A Safe proxy is often deployed at the same address on several chains but is a DIFFERENT Safe on each, so this is never guessed."
      },
      "lookback_blocks": {
       "type": "string",
       "description": "Optional. How far back the baseline is read, in blocks. Defaults to roughly 30 days for the given chain."
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object",
     "description": "Full JSON Schema for this response is at /openapi.json, and the free /preview sibling returns the same shape on live data. It is not inlined here because response headers have a hard 16 KB limit in common HTTP clients (Node's default) and this response is large. The example alongside is complete and real."
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "chain": "eip155:1",
  "drift": {
   "status": "changed",
   "guard_after": null,
   "guard_before": null,
   "owners_added": [
    "0x7bd3ab8fa37d63c04a8d0bee3298088c0f366709",
    "0x7d7e46bef5064cfae2ced5cc627141005d1cde76",
    "0xfe89cc7abb2c4183683ab71653c4cdc9b02d44b7"
   ],
   "version_after": "1.3.0",
   "owners_removed": [
    "0x0b8b1ed2594b36aedbf44dd17674f4686edfee6b",
    "0x70b8769b09af7447886620c20854c8b9119b5fee",
    "0xc02771315d0958f23a64140160e78ecb9bb8614e"
   ],
   "version_before": "1.3.0",
   "modules_enabled": [],
   "threshold_after": 2,
   "modules_disabled": [],
   "threshold_before": 3,
   "change_block_method": "binary_search_verified",
   "changed_to_current_at": {
    "block_number": "25647884",
    "block_timestamp": "2026-07-30T19:53:11.000Z"
   },
   "change_block_search_calls": 20
  },
  "address": "0x91c32893216dE3eA0a55ABb9851f581d4503d39b",
  "current": {
   "guard": {
    "note": null,
    "status": "none",
    "address": null
   },
   "nonce": "243",
   "owners": [
    "0x75d91395cd36f24f990bbde69993cb20b96ecfa6",
    "0x7bd3ab8fa37d63c04a8d0bee3298088c0f366709",
    "0x7d7e46bef5064cfae2ced5cc627141005d1cde76",
    "0xfe89cc7abb2c4183683ab71653c4cdc9b02d44b7"
   ],
   "modules": [],
   "version": "1.3.0",
   "singleton": "0xd9db270c1b5e3bd161e8c8503c55ceabee709552",
   "threshold": 2,
   "owner_count": 4,
   "block_number": "25744383",
   "module_count": 0,
   "block_timestamp": "2026-08-13T06:44:47.000Z"
  },
  "baseline": {
   "guard": {
    "note": null,
    "status": "none",
    "address": null
   },
   "nonce": "235",
   "owners": [
    "0x0b8b1ed2594b36aedbf44dd17674f4686edfee6b",
    "0x70b8769b09af7447886620c20854c8b9119b5fee",
    "0x75d91395cd36f24f990bbde69993cb20b96ecfa6",
    "0xc02771315d0958f23a64140160e78ecb9bb8614e"
   ],
   "modules": [],
   "version": "1.3.0",
   "singleton": "0xd9db270c1b5e3bd161e8c8503c55ceabee709552",
   "threshold": 3,
   "owner_count": 4,
   "block_number": "25529179",
   "module_count": 0,
   "block_timestamp": "2026-07-14T06:46:23.000Z"
  },
  "chain_id": 1,
  "fetched_at": "2026-08-13T06:44:52.937Z",
  "discrepancy": null,
  "archive_proof": {
   "endpoint": "tenderly-mainnet",
   "verified_at": "2026-08-13T06:44:53.713Z",
   "canary_absent_block": "12504267",
   "canary_present_block": "12504268"
  },
  "address_status": "safe",
  "spending_authority": {
   "guard": {
    "note": null,
    "status": "none",
    "address": null
   },
  
… (truncated)
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/gnosis-safe-spending-authority-drift-detector-8cb9b25a/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api402x.com](https://www.zero.xyz/host/api402x.com/llms.txt)