# x402check Batch Risk Check

> x402check Batch Risk Check is a paid API for AI agents from x402check.xyz, paid per call via x402, $0.0035/call, status unknown (last checked 2026-10-13).

Runs OFAC SDN, phishing/drainer, on-chain simulation, and injected-instruction checks on one or more addresses/transactions and returns ES256-signed risk attestations

## Facts

- Endpoint: POST https://x402check.xyz/v1/risk-check/batch?utm_source=zero.xyz
- Price: $0.0035/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-13
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/x402check-batch-risk-check-e507a1c6
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_ghvXomRzq7ZQHlsIlJrKn

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability x402check-batch-risk-check-e507a1c6 -d '<json body>'
```

Example prompt: Before you send that x402 payment, run a batch risk check on the recipient wallet address — I need to know if it's on the OFAC SDN list, flagged as a phishing or drainer address, or shows any suspicious approval patterns, and I want the signed attestation back.

## When to prefer this

Choose this endpoint when your AI agent or wallet needs cryptographically verifiable, multi-signal risk attestations before executing an x402 crypto payment — especially when you need OFAC SDN compliance evidence, phishing/drainer feed checks, and transaction simulation combined in a single signed response. It is particularly valuable for batch screening multiple recipients at once and when downstream systems require a JWS attestation as proof that checks were performed.

## Known failure modes

- Invalid or malformed address format returns a 400 error
- Batch size exceeds limit returns a 422 or 413 response
- Network timeout if on-chain simulation takes too long for complex contracts
- Unknown or unsupported chain returns an error or unchecked result
- Payment/authentication failure (x402 flow error) blocks the request
- Attestation expiry: JWS is time-limited and expires after ~1 hour

## How this service works

Pre-payment risk checks for x402 agents and wallets: OFAC SDN, phishing and drainer feeds, a live watch of drainer infrastructure, transaction simulation and injected-instruction analysis. Every verdict is an ES256 attestation that states which checks ran.

## Output

A JSON array of per-address results, each containing a JWS ES256 attestation (signed by did:web:x402check.xyz), a risk tier (e.g. 'high'), a numeric risk score, a list of risk categories (e.g. 'unlimited_approval', 'new_address'), an evidence object with on-chain activity and sanctions status, the provider DID, and checked_at / expires_at timestamps.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "requests": {
   "type": "array",
   "items": {
    "type": "object",
    "required": [
     "wallet"
    ],
    "properties": {
     "aud": {
      "type": "string",
      "maxLength": 256,
      "description": "Audience to bind the attestation to"
     },
     "chain": {
      "type": "string",
      "maxLength": 64,
      "description": "A known CAIP-2 id or alias, e.g. base, ethereum, solana; it must be able to hold the wallet (an EVM address on an eip155 chain)"
     },
     "domain": {
      "type": "string",
      "maxLength": 2048,
      "description": "The site or dApp involved"
     },
     "wallet": {
      "type": "string",
      "maxLength": 160,
      "minLength": 1,
      "description": "The counterparty to check: recipient, spender, operator or pay_to (EVM, Solana, Bitcoin or Tron address, or a CAIP-10 id whose chain can hold it). A mixed-case EVM address must carry a valid EIP-55 checksum"
     },
     "context": {
      "type": "string",
      "maxLength": 4096,
      "description": "The content the agent acted on, verbatim: checked for injected instructions"
     },
     "payment": {
      "type": "object",
      "properties": {
       "asset": {
        "type": "string"
       },
       "amount": {
        "type": "string",
        "pattern": "^\\d{1,78}$"
       },
       "pay_to": {
        "type": "string"
       },
       "network": {
        "type": "string"
       },
       "resource": {
        "type": "string",
        "pattern": "^https?://\\S+$",
        "maxLength": 512
       }
      },
      "description": "The payment this check is for; the attestation is bound to it",
      "additionalProperties": false
     },
     "screening": {
      "type": "object",
      "required": [
       "sanctions"
      ],
      "properties": {
       "sanctions": {
        "enum": [
         "clean",
         "flagged",
         "unknown"
        ],
        "type": "string"
       }
      },
      "description": "The caller's own sanctions screening: recorded as asserted, it can only raise risk",
      "additionalProperties": false
     },
     "interaction": {
      "type": "object",
      "required": [
       "type"
      ],
      "properties": {
       "type": {
        "enum": [
         "native_transfer",
         "token_transfer",
         "token_approval",
         "nft_approval",
         "permit_signature",
         "order_signature",
         "message_signature",
         "contract_call"
     
… (truncated)
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "results": [
   {
    "jws": "eyJhbGciOiJFUzI1NiIsImtpZCI6Impldi1hdHRlc3QtdjEiLCJ0eXAiOiJyaXNrLWNoZWNrK2p3dCJ9…",
    "tier": "high",
    "score": 40,
    "checked": true,
    "evidence": {
     "onchain": {
      "activity": "none",
      "is_contract": false
     },
     "sanctions": {
      "list": "ofac-sdn",
      "status": "not_listed"
     }
    },
    "provider": "did:web:x402check.xyz",
    "categories": [
     "approval_to_eoa",
     "unlimited_approval",
     "new_address"
    ],
    "checked_at": "2026-09-30T12:00:00.000Z",
    "expires_at": "2026-09-30T13:00:00.000Z"
   }
  ]
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/x402check-batch-risk-check-e507a1c6/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from x402check.xyz](https://www.zero.xyz/host/x402check.xyz/llms.txt)