# x402check Risk Check

> x402check Risk Check is a paid API for AI agents from x402check.xyz, paid per call via x402, $0.0035/call, status unknown (last checked 2026-10-13).

Runs pre-payment risk checks (OFAC SDN, phishing/drainer feeds, drainer infrastructure, transaction simulation, injected-instruction analysis) on an address or transaction and returns a signed ES256 attestation with a risk tier and score.

## Facts

- Endpoint: POST https://x402check.xyz/v1/risk-check?utm_source=zero.xyz
- Price: $0.0035/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-13
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/x402check-risk-check-bc5238a5
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_EaopgIF2Bi66CUticu049

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability x402check-risk-check-bc5238a5 -d '<json body>'
```

Example prompt: Before you send that 50 USDC payment to 0xAbC123…, run a full risk check on the recipient address — I need to know if it's sanctioned, linked to any drainer or phishing campaign, and get back a signed attestation of the result.

## When to prefer this

Use this endpoint when an AI agent or wallet needs a cryptographically verifiable, multi-signal risk verdict before executing or authorizing an on-chain payment — especially in x402 payment flows where auditability and sanctions compliance are required. Prefer it over generic blockchain analytics when you need a single signed attestation covering OFAC SDN, drainer/phishing feeds, live drainer infrastructure monitoring, and transaction simulation together in one call.

## Known failure modes

- Invalid or malformed address input returns a 400 error
- Network unavailability of sanctions or phishing feed sources may cause partial check results
- Expired attestation if cached result is used beyond expires_at
- Unrecognized transaction format may prevent simulation analysis
- Rate limiting or quota exhaustion may block checks during high traffic

## How this service works

Pre-payment risk checks for x402 agents and wallets: OFAC SDN, phishing and drainer feeds, a live watch of drainer infrastructure, transaction simulation and injected-instruction analysis. Every verdict is an ES256 attestation that states which checks ran.

## Output

A JSON object containing a compact JWS (ES256) attestation signed by did:web:x402check.xyz, a risk tier (e.g. 'high'), a numeric risk score, a boolean indicating checks ran, an evidence block with onchain activity and sanctions status, a list of risk categories (e.g. 'unlimited_approval', 'new_address'), and timestamps for when the check ran and when it expires.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "aud": {
   "type": "string",
   "maxLength": 256,
   "description": "Audience to bind the attestation to"
  },
  "chain": {
   "type": "string",
   "maxLength": 64,
   "description": "A known CAIP-2 id or alias, e.g. base, ethereum, solana; it must be able to hold the wallet (an EVM address on an eip155 chain)"
  },
  "domain": {
   "type": "string",
   "maxLength": 2048,
   "description": "The site or dApp involved"
  },
  "wallet": {
   "type": "string",
   "maxLength": 160,
   "minLength": 1,
   "description": "The counterparty to check: recipient, spender, operator or pay_to (EVM, Solana, Bitcoin or Tron address, or a CAIP-10 id whose chain can hold it). A mixed-case EVM address must carry a valid EIP-55 checksum"
  },
  "context": {
   "type": "string",
   "maxLength": 4096,
   "description": "The content the agent acted on, verbatim: checked for injected instructions"
  },
  "payment": {
   "type": "object",
   "properties": {
    "asset": {
     "type": "string"
    },
    "amount": {
     "type": "string",
     "pattern": "^\\d{1,78}$"
    },
    "pay_to": {
     "type": "string"
    },
    "network": {
     "type": "string"
    },
    "resource": {
     "type": "string",
     "pattern": "^https?://\\S+$",
     "maxLength": 512
    }
   },
   "description": "The payment this check is for; the attestation is bound to it",
   "additionalProperties": false
  },
  "screening": {
   "type": "object",
   "required": [
    "sanctions"
   ],
   "properties": {
    "sanctions": {
     "enum": [
      "clean",
      "flagged",
      "unknown"
     ],
     "type": "string"
    }
   },
   "description": "The caller's own sanctions screening: recorded as asserted, it can only raise risk",
   "additionalProperties": false
  },
  "interaction": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "enum": [
      "native_transfer",
      "token_transfer",
      "token_approval",
      "nft_approval",
      "permit_signature",
      "order_signature",
      "message_signature",
      "contract_call"
     ],
     "type": "string"
    },
    "unlimited": {
     "type": "boolean"
    }
   },
   "description": "What the agent is about to do (type), and whether an approval is unlimited",
   "additionalProperties": false
  },
  "transaction": {
   "type": "object",
   "required": [
    "from"
   ],
   "properties": {
    "to": {
     "type": "string",
     "pattern": "^0x[0-9a-fA-F]{40}$"

… (truncated)
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "jws": "eyJhbGciOiJFUzI1NiIsImtpZCI6Impldi1hdHRlc3QtdjEiLCJ0eXAiOiJyaXNrLWNoZWNrK2p3dCJ9…",
  "tier": "high",
  "score": 40,
  "checked": true,
  "evidence": {
   "onchain": {
    "activity": "none",
    "is_contract": false
   },
   "sanctions": {
    "list": "ofac-sdn",
    "status": "not_listed"
   }
  },
  "provider": "did:web:x402check.xyz",
  "categories": [
   "approval_to_eoa",
   "unlimited_approval",
   "new_address"
  ],
  "checked_at": "2026-09-30T12:00:00.000Z",
  "expires_at": "2026-09-30T13:00:00.000Z"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/x402check-risk-check-bc5238a5/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from x402check.xyz](https://www.zero.xyz/host/x402check.xyz/llms.txt)