# Holder Forensics

> Holder Forensics is a paid API for AI agents from 402.com.tr, paid per call via x402, $0.03/call, status unknown (last checked 2026-09-14).

Classifies a token's holder base into creator/owner holdings, benign infrastructure wallets (LP/CEX/bridge), and unlabelled wallets that pose real dump risk, plus identifies the largest non-infrastructure wallet.

## Facts

- Endpoint: GET https://402.com.tr/api/x402/holder-forensics
- Price: $0.03/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/holder-forensics-51b9a3ee
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_E1gHVbf-hUt_T7yFJ4xuI

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability holder-forensics-51b9a3ee
```

Example prompt: Can you run a holder forensics analysis on the token at contract address 0x1234...abcd and tell me how much the creator still holds, which of the top wallets are just LPs or exchanges, and which ones are unlabelled wallets that could actually dump the price?

## When to prefer this

Use this endpoint when you need to go beyond simple top-holder percentage statistics and actually understand the nature of concentration risk — specifically when you need to distinguish benign infrastructure wallets (LPs, CEXs, bridges) from unlabelled wallets that represent real sell pressure. Prefer this over generic holder analytics when assessing rug pull risk, due diligence before investment, or evaluating token health on Base.

## Known failure modes

- Invalid or non-existent contract address returns an error
- Contract address for a non-token contract may return unexpected results
- Very new tokens with few transactions may have incomplete holder data
- Rate limiting or payment failure returns 402 Payment Required
- Token on an unsupported chain returns no data

## How this service works

Goes past 'top-10 = X%' to classify the holder base: how much the creator & owner still hold, which top holders are infrastructure (LP/CEX/bridge — benign) vs unlabelled wallets (the concentration that can actually dump the price), and the largest non-infra wallet. Separating benign from dangerous concentration is the analysis others skip.

## Output

Returns a breakdown of the token's holder base including: how much the creator and owner wallets still hold, which top holders are classified as infrastructure (liquidity pools, CEX wallets, bridges — benign), which are unlabelled/unclassified wallets representing real dump risk, and the identity and size of the largest non-infrastructure wallet.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "pathParams": {
     "type": "object"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "address"
     ],
     "properties": {
      "address": {
       "type": "string",
       "description": "Token contract address"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/holder-forensics-51b9a3ee/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from 402.com.tr](https://www.zero.xyz/host/402.com.tr/llms.txt)