openapi: 3.1.0 info: version: 2.0.0 title: AML API OAuth Assets Wallet Analyses API x-explorer-description: '# Welcome to the Elliptic API Explorer This area allows you to experiment with API requests in your browser. Browse to a request of interest and `Try it out`. If you are looking for the full documentation, head over to [the docs section](/developers/docs) ## Authentication Authentication in this explorer is accomplished using a JWT bearer token. This will allow your logged in user to make requests to our API if permitted. API authentication does not use JWTs, please see the [auth cookbooks](https://app.elliptic.co/#section/Cookbooks/Authentication) in the documentation for instructions on how to authenticate with our API programatically. ## Environment **Any requests made here will run against the environment you are logged in to. We advise using your sandbox environment so as not to pollute your production dataset** ' description: "# Introduction\n**Welcome to the Elliptic API Documentation**\n\nIn its simplest form, the Elliptic API allows you to [submit batches of transactions programmatically](#operation/analysisBatch), without human intervention. By connecting directly from your internal systems, you control what is submitted for analysis and when. Your compliance team can then log into the Elliptic web interface and analyse the results of the requested transaction screenings.\n\nBeyond batch-submitting transactions, the Elliptic API can also be used to obtain immediate responses to transaction or address analysis requests through our [synchronous endpoint](#operation/analysisSync). This option returns the result of the analysis in the same request in case you want to use the information for immediate reference. This is only recommended if you have a low volume of transactions (due to API rate limiting) and you need access to the results immediately for compliance workflow reasons. If you have high volumes or do not need to make time critical responses, use the [batch endpoint](#operation/analysisBatch).\n\nThe API can also be used to interrogate your analyzed customers, transactions, addresses and risk rules, pulling information at scale, with the filters of your choice. For example, if you want to import all the analyzed transactions with the respective dollar amount, risk score, CustomerID, etc into your Transaction Monitoring System you can do so by using the GET endpoints. You can find more information about this in the [get all analysis results section](#operation/getAllAnalyses).\n\nAdditionally, for more advanced use-cases, the Elliptic API can also be used to carry out workflows programmatically (i.e. set transactions notes etc.). This is particularly helpful if you are using Elliptic through your own bespoke built Transaction Monitoring System, rather than the Elliptic AML web interface.\n\n# Experimenting with the API\nIf you'd like to make some requests with the API in your browser, head over to the [API explorer](/developers/explorer)\n\n## Getting Started\n1. First, request your API keys through your Customer Success Manager or via [customers@elliptic.co](mailto:customers@elliptic.co). For privacy reasons, you will be asked for a keybase username or PGP Public Key;\n2. [Authenticate with the API](#section/Authentication), using the credentials provided in step 1 as this will allow you to pass our API’s user verification;\n3. [Submit your first test request](#operation/analysisSync). The submitted transactions will appear immediately in the Elliptic AML web interface.\n# Configuration\n### Types\n All timestamps are represented as ISO8601-formatted date strings with time zone.\n### Requests\n All HTTP requests and responses are application/json content type and typical HTTP response status codes for success and failure are used.\n All successful requests will respond with an HTTP 2xx status code and will contain a body (except in the case of a 204). The body varies by endpoint and will be described for each resource below, but will contain a JSON data object or array (for individual and multiple resources, respectively).\n All other requests will respond with an HTTP 4xx or 5xx status code. Furthermore, the body will contain an array of error messages to help with understanding the cause of failure.\n### Rate Limiting\n There is a global limit of 500 requests per minute. This applies to all requests (GET, POST, etc.).\n If the limit is reached an HTTP 429 status code will be returned.\n\n The following headers are returned by each request\n\n Header | Description\n ------ | -----------\n X-RateLimit-Limit | The limit of the current endpoint\n X-RateLimit-Remaining | The remaining rate limit\n X-RateLimit-Reset | The timestamp after which the limit will reset (unix epoch timestamp)\n\n# Authentication\nAll HTTP requests to API endpoints require authentication and authorization. For code samples see our [Authenication Cookbooks](#section/Cookbooks/Authentication)\n\nElliptic will provide an API key and secret which must be used to set HTTP headers. These headers will be used to verify and authorize all requests.\n\nThe following headers should be added to all HTTP requests:\n\nKey | Value\n--- | ---\nx-access-key | \\\nx-access-sign | \\\nx-access-timestamp | \\ (in milliseconds)\n\nExamples of how to generate the signature can be found to the below. The following variables are referenced:\n\nVariable | Description\n------- | ---------\nTIME_OF_REQUEST_IN_MS | The current time formatted as the current unix timestamp (in milliseconds)\nSIGNATURE_OF_REQUEST | A Base64 string encoded HMAC-SHA256 of REQUEST_TEXT signed with the Base64 decoded SECRET\nREQUEST_TEXT | a plain string concatenation of: TIME_OF_REQUEST_IN_MS, HTTP_METHOD (uppercase), HTTP_PATH (lowercase API path including query string), REQUEST_BODY (string encoded JSON object, or “{}” if there is no body)\n\nFrom now on, all code examples will assume you are attaching the authentication headers\n\n# Cookbooks\n\n## Authentication\nWe've provided Authentication cookbooks for commonly used langauges below. If your language isn't listed here, [let us know](mailto:customers@elliptic.co) and we'll add it\n\n\n\n\n
Java\n\n```java\nimport javax.crypto.Mac;\nimport javax.crypto.spec.SecretKeySpec;\nimport org.apache.commons.codec.binary.Base64;\nimport java.security.InvalidKeyException;\nimport java.security.NoSuchAlgorithmException;\n\npublic class EllipticAuth {\n /*\n * Generate a signature for use when signing a request to the API\n *\n * - secret: your secret supplied by Elliptic - a base64 encoded string\n * - time_of_request: current time, in milliseconds, since 1 Jan 1970 00:00:00 UTC\n * - http_method: must be uppercase\n * - http_path: API endpoint including query string\n * - payload: string encoded JSON object or \"{}\" if there is no request body\n */\n public static String get_signature(String secret, String time_of_request, String http_method, String http_path, String payload) {\n\n try {\n // create a SHA256 HMAC using the supplied secret, decoded from base64\n Mac hmac = Mac.getInstance(\"HmacSHA256\");\n SecretKeySpec secret_key = new SecretKeySpec(Base64.decodeBase64(secret), \"HmacSHA256\");\n hmac.init(secret_key);\n\n // concatenate the request text to be signed\n String request_text = time_of_request + http_method + http_path.toLowerCase() + payload;\n\n // update the HMAC with the text to be signed\n hmac.update(request_text.getBytes());\n\n // output the signature as a base64 encoded string\n return Base64.encodeBase64String(hmac.doFinal());\n } catch(InvalidKeyException | NoSuchAlgorithmException e) {\n throw new RuntimeException(e);\n }\n }\n\n public static String SECRET = \"894f142d667e8cdaca6822ac173937af\"; // Supplied by Elliptic - a base64 encoded string\n // Disclaimer: this secret is just an example\n public static String TIME_OF_REQUEST_IN_MS = \"1478692862000\"; // For real world use currentTimeMillis()\n public static String EXAMPLE_PAYLOAD = \"[{\\\"customer_reference\\\":\\\"123456\\\",\\\"subject\\\":{\\\"asset\\\":\\\"BTC\\\",\\\"hash\\\":\\\"accf5c09cc027339a3beb2e28104ce9f406ecbbd29775b4a1a17ba213f1e035e\\\",\\\"output_address\\\":\\\"15Hm2UEPaEuiAmgyNgd5mF3wugqLsYs3Wn\\\",\\\"output_type\\\":\\\"address\\\",\\\"type\\\":\\\"transaction\\\"},\\\"type\\\":\\\"source_of_funds\\\"}]\";\n\n public static void main(String[] args) {\n // Example One: POST with payload\n System.out.println(get_signature(EllipticAuth.SECRET, EllipticAuth.TIME_OF_REQUEST_IN_MS, \"POST\", \"/v2/analyses\", EXAMPLE_PAYLOAD));\n // 65mQHB2o95lL3I+N/bZYwDC9p2YvNwsVDnXr8u72hUk=\n\n // Example Two: GET with empty payload\n System.out.println(get_signature(EllipticAuth.SECRET, EllipticAuth.TIME_OF_REQUEST_IN_MS, \"GET\", \"/v2/customers\", \"{}\"));\n // cN9fRUqeT7UnwwpkBZaNmnwxKAPHkhytdXelfUVvxMI=\n return;\n }\n}\n```\n\n
\n\n
Ruby\n\n```ruby\nrequire 'base64'\nrequire 'json'\nrequire 'openssl'\n\n=begin\n Generate a signature for use when signing a request to the API\n\n - secret: your secret supplied by Elliptic - a base64 encoded string\n - time_of_request: current time, in milliseconds, since 1 Jan 1970 00:00:00 UTC\n - http_method: must be uppercase\n - http_path: API endpoint including query string\n - payload: string encoded JSON object or '{}' if there is no request body\n=end\ndef get_signature(secret, time_of_request, http_method, http_path, payload)\n # concatenate the request text to be signed\n request_text = time_of_request + http_method + http_path.downcase + payload\n\n # create a SHA256 HMAC using the supplied secret, decoded from base64, and update it with the request_text\n hmac = OpenSSL::HMAC.digest('SHA256', Base64.decode64(secret), request_text)\n\n # output the signature as a base64 encoded string\n signed = Base64.encode64(hmac).strip.encode('UTF-8')\nend\n\nSECRET = '894f142d667e8cdaca6822ac173937af' # Supplied by Elliptic\n# Disclaimer: this secret is just an example\nTIME_OF_REQUEST_IN_MS = '1478692862000' # For real world use (Time.now.to_i * 1000)\nEXAMPLE_PAYLOAD = [\n {\n \"customer_reference\": \"123456\",\n \"subject\": {\n \"asset\": \"BTC\",\n \"hash\": \"accf5c09cc027339a3beb2e28104ce9f406ecbbd29775b4a1a17ba213f1e035e\",\n \"output_address\": \"15Hm2UEPaEuiAmgyNgd5mF3wugqLsYs3Wn\",\n \"output_type\": \"address\",\n \"type\": \"transaction\"\n },\n \"type\": \"source_of_funds\"\n }\n]\n\n# Example One: POST with payload - you only need to run JSON.generate when passing a request body\nputs(get_signature(SECRET, TIME_OF_REQUEST_IN_MS, 'POST', '/v2/analyses', JSON.generate(EXAMPLE_PAYLOAD)))\n# 65mQHB2o95lL3I+N/bZYwDC9p2YvNwsVDnXr8u72hUk=\n\n# Example Two: GET with empty payload - do not run JSON.generate with no request body, pass an empty object as string\nputs(get_signature(SECRET, TIME_OF_REQUEST_IN_MS, 'GET', '/v2/customers', '{}'))\n# cN9fRUqeT7UnwwpkBZaNmnwxKAPHkhytdXelfUVvxMI\n```\n\n
\n\n
C#\n\n```c#\nusing System;\nusing System.Security.Cryptography;\nusing System.Text;\n\npublic class EllipticAuth\n{\n\n /// Generate a signature for use when signing a request to the API\n /// your secret supplied by Elliptic - a base64 encoded string\n /// current time, in milliseconds, since 1 Jan 1970 00:00:00 UTC\n /// must be uppercase\n /// API endpoint including query string\n /// string encoded JSON object or '{}' if there is no request body\n public static String get_signature(string secret, string time_of_request, string http_method, string http_path, string payload) {\n string output = \"\";\n\n // create a SHA256 HMAC using the supplied secret, decoded from base64\n var encoding = new ASCIIEncoding();\n byte[] keyByte = Convert.FromBase64String(secret);\n\n // concatenate the request text to be signed\n string request_text = time_of_request + http_method + http_path + payload;\n\n // update the HMAC with the text to be signed\n byte[] msgBytes = encoding.GetBytes(request_text);\n using (var hmac = new HMACSHA256(keyByte))\n {\n byte[] hashed = hmac.ComputeHash(msgBytes);\n // output the signature as a base64 encoded string\n output = Convert.ToBase64String(hashed);\n }\n\n return output;\n }\n\n public static string SECRET = \"894f142d667e8cdaca6822ac173937af\"; // Supplied by Elliptic - a base64 encoded string\n // Disclaimer: this secret is just an example\n public static string TIME_OF_REQUEST_IN_MS = \"1478692862000\"; // For real world use DateTimeOffset.Now.ToUnixTimeMilliseconds();\n public static string EXAMPLE_PAYLOAD = \"[{\\\"customer_reference\\\":\\\"123456\\\",\\\"subject\\\":{\\\"asset\\\":\\\"BTC\\\",\\\"hash\\\":\\\"accf5c09cc027339a3beb2e28104ce9f406ecbbd29775b4a1a17ba213f1e035e\\\",\\\"output_address\\\":\\\"15Hm2UEPaEuiAmgyNgd5mF3wugqLsYs3Wn\\\",\\\"output_type\\\":\\\"address\\\",\\\"type\\\":\\\"transaction\\\"},\\\"type\\\":\\\"source_of_funds\\\"}]\";\n\n public static void Main()\n {\n // Example One: POST with payload\n Console.WriteLine(get_signature(EllipticAuth.SECRET, EllipticAuth.TIME_OF_REQUEST_IN_MS, \"POST\", \"/v2/analyses\", EXAMPLE_PAYLOAD));\n // 65mQHB2o95lL3I+N/bZYwDC9p2YvNwsVDnXr8u72hUk=\n\n // Example Two: GET with empty payload\n Console.WriteLine(get_signature(EllipticAuth.SECRET, EllipticAuth.TIME_OF_REQUEST_IN_MS, \"GET\", \"/v2/customers\", \"{}\"));\n // cN9fRUqeT7UnwwpkBZaNmnwxKAPHkhytdXelfUVvxMI=\n return;\n }\n}\n```\n\n
\n\n
PHP\n\n```php\n/**\n* Generate a signature for use when signing a request to the API\n*\n* @param $secret your secret supplied by Elliptic - a base64 encoded string\n* @param $time_of_request current time, in milliseconds, since 1 Jan 1970 00:00:00 UTC\n* @param $http_method must be uppercase\n* @param $http_path API endpoint including query string\n* @param $payload string encoded JSON object or '{}' if there is no request body\n*/\nfunction get_signature(\n $secret,\n $time_of_request,\n $http_method,\n $http_path,\n $payload\n) {\n // create a SHA256 HMAC using the supplied secret, decoded from base64\n $ctx = hash_init('sha256', HASH_HMAC, base64_decode($secret));\n // concatenate the request text to be signed\n $request_text = $time_of_request . $http_method . $http_path . $payload;\n // update the HMAC with the text to be signed\n hash_update($ctx, $request_text);\n // output the signature as a base64 encoded string\n return base64_encode(hex2bin(hash_final($ctx)));\n}\n\n$SECRET = '894f142d667e8cdaca6822ac173937af'; // Supplied by Elliptic\n// Disclaimer: this secret is just an example\n$TIME_OF_REQUEST_IN_MS = 1478692862000; // For real world use something like (int)(microtime(true)*1000)\n\n$EXAMPLE_PAYLOAD = [[\n \"customer_reference\" => \"123456\",\n \"subject\" => [\n \"asset\" => \"BTC\",\n \"hash\" => \"accf5c09cc027339a3beb2e28104ce9f406ecbbd29775b4a1a17ba213f1e035e\",\n \"output_address\" => \"15Hm2UEPaEuiAmgyNgd5mF3wugqLsYs3Wn\",\n \"output_type\" => \"address\",\n \"type\" => \"transaction\"\n ],\n \"type\" => \"source_of_funds\"\n ]];\n\n// Example One: POST with payload - you only need to run json_encode when passing a request body\necho get_signature($SECRET, $TIME_OF_REQUEST_IN_MS, 'POST', '/v2/analyses', json_encode($EXAMPLE_PAYLOAD)) . \"\\n\";\n// 65mQHB2o95lL3I+N/bZYwDC9p2YvNwsVDnXr8u72hUk=\n\n// Example Two: GET with empty payload - do not run json_encode with no request body, pass an empty object as string\necho get_signature($SECRET, $TIME_OF_REQUEST_IN_MS, 'GET', '/v2/customers', '{}') . \"\\n\";\n// cN9fRUqeT7UnwwpkBZaNmnwxKAPHkhytdXelfUVvxMI=\n```\n\n
\n\n
Golang\n\n```go\npackage main\n\nimport (\n \"crypto/hmac\"\n \"crypto/sha256\"\n \"encoding/base64\"\n \"fmt\"\n \"log\"\n \"strconv\"\n \"strings\"\n)\n\n// Generate a signature for use when signing a request to the API\n// - secret: your secret supplied by Elliptic - a base64 encoded string\n// - time_of_request: current time, in milliseconds, since 1 Jan 1970 00:00:00 UTC\n// - http_method: must be uppercase\n// - http_path: API endpoint including query string\n// - payload: string encoded JSON object or '{}' if there is no request body\nfunc get_signature(secret string, time_of_request int64, http_method string, http_path string, payload string) string {\n // create a SHA256 HMAC using the supplied secret, decoded from base64\n ds, err := base64.StdEncoding.DecodeString(secret)\n if err != nil {\n log.Fatal(\"error:\", err)\n }\n h := hmac.New(sha256.New, []byte(ds))\n\n // concatenate the request text to be signed\n request_text := strconv.FormatInt(time_of_request, 10) + http_method + strings.ToLower(http_path) + payload\n\n // update the HMAC with the text to be signed\n h.Write([]byte(request_text))\n\n // output the signature as a base64 encoded string\n return base64.StdEncoding.EncodeToString([]byte(h.Sum(nil)))\n}\n\nfunc main() {\n secret := \"894f142d667e8cdaca6822ac173937af\" // Supplied by Elliptic\n // Disclaimer: this secret is just an example\n time_of_request_in_ms := int64(1478692862000) // For real world use time.Now().UnixMilli()\n\n example_payload := `[{\"customer_reference\":\"123456\",\"subject\":{\"asset\":\"BTC\",\"hash\":\"accf5c09cc027339a3beb2e28104ce9f406ecbbd29775b4a1a17ba213f1e035e\",\"output_address\":\"15Hm2UEPaEuiAmgyNgd5mF3wugqLsYs3Wn\",\"output_type\":\"address\",\"type\":\"transaction\"},\"type\":\"source_of_funds\"}]`\n\n // Example One: POST with payload - you only need to run stringify json when passing a request body\n fmt.Println(get_signature(secret, time_of_request_in_ms, \"POST\", \"/v2/analyses\", example_payload))\n // 65mQHB2o95lL3I+N/bZYwDC9p2YvNwsVDnXr8u72hUk=\n\n // Example Two: GET with empty payload - do not run stringify with no request body, pass an empty object as string\n fmt.Println(get_signature(secret, time_of_request_in_ms, \"GET\", \"/v2/customers\", `{}`))\n // cN9fRUqeT7UnwwpkBZaNmnwxKAPHkhytdXelfUVvxMI=\n}\n```\n\n
\n\n
Postman\n\n```javascript\n/**\n* This function will create signature on the base of API_SECRET\n* variable set in Postman. Use it as pre-request script in Postman\n*/\nfunction makeSignature() {\n const timestamp = Date.now();\n // This regex assumes that the URLs you are using in postman have the hostname templated\n // like {{AML_API_HOST}}/your/url so won’t work if instead you are using the AML API host set directly in the URL bar\n const pathRegex = /(?:{{[^}]*}})(.*$)/g;\n const match = pathRegex.exec(request.url);\n const path = /\\?$/.test(match[1]) ? match[1].substring(0, match[1].length - 1) : match[1];\n const strBody = (typeof request.data == 'object' ? '{}' : JSON.stringify(JSON.parse(request.data)));\n const text = timestamp + request.method.toUpperCase() + path.toLowerCase() + strBody;\n const key = CryptoJS.enc.Base64.parse(pm.variables.get(\"API_SECRET\"));\n const hmac = CryptoJS.algo.HMAC.create(CryptoJS.algo.SHA256, key);\n hmac.update(text);\n const signature = CryptoJS.enc.Base64.stringify(hmac.finalize());\n return [signature, timestamp];\n}\n\nvar sig = makeSignature();\n\n// These variables should be consumed in the request header configuration\npostman.setGlobalVariable('REQ_SIGNATURE', sig[0]);\npostman.setGlobalVariable(\"REQ_TIMESTAMP\", sig[1]);\npostman.setGlobalVariable(\"REQ_DATA\", typeof request.data);\n```\n\n
\n\n### Debugging Authentication\nThe `WWW-Authenticate` response header gives useful information to help understand what's going wrong:\n - `error_description=\"invalid signature\"`: The signature generated by your code does not match what we've generated on the API\n - `error_description=\"invalid timestamp 1605268999252\"`: The timestamp you've provided is invalid, it should be milliseconds since epoch\n - No error discription usually indicates that the key you're using is invalid\n" servers: - url: https://aml-api.elliptic.co/v2 description: Production security: - oauth2: - openid - profile - apiKey: [] signature: [] timestamp: [] tags: - name: Wallet Analyses description: 'Run blockchain analysis against one or more wallets. Get and update previously run analyses. ' paths: /wallet/synchronous: post: tags: - Wallet Analyses summary: Run a single analysis description: Given a subject address, analysis type of type "wallet_exposure" and an optional customer_reference, perform the requested analysis and return the result requestBody: content: application/json: schema: $ref: '#/components/schemas/WalletRequestSingle' responses: '200': description: Successful wallet analysis response content: application/json: schema: $ref: '#/components/schemas/WalletAnalysisResponse' '400': $ref: '#/components/responses/400Post' '401': $ref: '#/components/responses/401' '403': $ref: '#/components/responses/403' '404': $ref: '#/components/responses/NotInBlockchain' '429': $ref: '#/components/responses/TooManyRequestsError' '500': $ref: '#/components/responses/500' /wallet: post: tags: - Wallet Analyses summary: Run a batch of analyses. description: 'Performs a batch of analyses (the max batch size is 100). Responses will contain IDs of the newly created analysis. ' requestBody: content: application/json: schema: $ref: '#/components/schemas/WalletRequestBatch' responses: '200': description: Successful analysis batch response content: application/json: schema: title: WalletBatchResponse type: array description: details of each submitted analysis items: type: object properties: id: type: string format: UUIDv4 example: b7535048-76f8-4f60-bdd3-9d659298f9e7 type: $ref: '#/components/schemas/WalletAnalysisType' subject: allOf: - $ref: '#/components/schemas/AnalysisSubject' analysed_by: type: object description: the actor who requested the analysis properties: id: type: string description: the actor id format: UUIDv4 example: b7535048-76f8-4f60-bdd3-9d659298f9e7 analysed_at: type: string format: date-time description: the timestamp of when this analysis was completed customer: type: object properties: id: type: string format: UUIDv4 description: the UUIDv4 of the customer this analysis is associated with example: b7535048-76f8-4f60-bdd3-9d659298f9e7 nullable: true reference: type: string description: the string reference that has been given to this customer. Can be empty example: foobar team_id: description: UUIDv4 identifier of the team the user belongs to type: string format: UUIDv4 example: e333694b-c7c7-4a36-bf35-ed2615865242 created_at: description: ISO date time with time zone (UTC) of when the analysis was first analysed type: string format: date-time example: '2015-05-13T10:36:21.000Z' updated_at: description: ISO date time with time zone (UTC) of when the wallet analysis was last updated type: string format: date-time example: '2015-05-13T10:36:21.000Z' process_status: description: the process status ('running','complete','error') type: string example: running enum: - running - complete - error process_status_id: type: integer description: 'The screening process status. - A 1 number means the process status is running. - A 2 number means the process status is completed. - A 3 indicates the process status has an error. ' enum: - 1 - 2 - 3 example: 2 error: type: object description: Property containing information about a failed screening, null unless process_status = 'error' properties: message: type: string description: error message example: something went wrong nullable: true workflow_status: $ref: '#/components/schemas/WalletAnalysisResponse/properties/workflow_status' workflow_status_id: $ref: '#/components/schemas/WalletAnalysisResponse/properties/workflow_status_id' required: - id - type - subject - analysed_by - analysed_at additionalProperties: false '207': description: Contains a partial error content: application/json: schema: type: array items: anyOf: - $ref: '#/components/schemas/BadRequestError' - $ref: '#/paths/~1wallet/post/responses/200/content/application~1json/schema/items' '400': description: Bad Request content: application/json: schema: type: array items: $ref: '#/components/schemas/BadRequestError' '401': $ref: '#/components/responses/401' '403': $ref: '#/components/responses/403' '500': $ref: '#/components/responses/500' get: tags: - Wallet Analyses summary: Paginate all analyses description: Paginate through all analyses, with various sort/filter parameters. parameters: - name: min_outflow_usd in: query description: minimum outflow USD value schema: type: number format: float minimum: 0 - name: max_outflow_usd in: query description: maximum outflow USD value schema: type: number format: float minimum: 0 - name: min_inflow_usd in: query description: minimum inflow USD value schema: type: number format: float minimum: 0 - name: max_inflow_usd in: query description: maximum inflow USD value schema: type: number format: float minimum: 0 - name: analysed_at_before in: query description: only return wallet analyses that has been analysed before the given time (ISO8601 datetime) schema: type: string format: date-time example: '2030-02-26T14:33:34.787Z' - name: analysed_at_after in: query description: only return wallet analyses that has been analysed after the given time (ISO8601 datetime) schema: type: string format: date-time example: '2010-02-26T14:33:34.787Z' - name: customer_reference_contains in: query description: only return wallet analyses whose customer reference contains the given string schema: type: string minLength: 1 - name: address_hash_contains in: query description: filter wallet analyses whose address contains the given string schema: type: string minLength: 1 - name: customer_reference in: query description: only return wallet analyses whose customer reference equals the given string schema: type: string minLength: 1 - name: workflow_status in: query description: only return analyses whose workflow status matches any of the given values. Accepts a single value or an array of values. schema: title: WorkflowStatusQueryArray description: Array of workflow status values for filtering analyses. "archived" is deprecated and you should use "closed" instead. type: array items: type: string enum: - active - archived - escalated - closed - name: address_hash in: query description: filter wallet analyses whose address equals the given string schema: type: string minLength: 1 - name: entity_name_contains in: query description: filter wallet analyses whose name contains the given string schema: type: string minLength: 1 - name: entity_category_contains in: query description: filter wallet analyses whose category contains the given string schema: type: string minLength: 1 - name: min_risk_score in: query description: minimum risk score schema: type: number format: float minimum: 0 maximum: 10 - name: max_risk_score in: query description: maximum risk score schema: type: number format: float minimum: 0 maximum: 10 - name: min_risk_score_change in: query description: minimum risk score change since last screening schema: type: number format: float minimum: -10 maximum: 10 - name: max_risk_score_change in: query description: maximum risk score change since last screening schema: type: number format: float minimum: -10 maximum: 10 - name: coverage in: query description: return the wallet analyses for a certain coverage level schema: type: array items: type: string enum: - full - sanctions - holistic - name: process_status in: query description: return rows that are in any of the states specified in the array. Each element is one of (running, complete, error). schema: type: array items: type: string enum: - running - complete - error - name: asset in: query description: return only wallet analyses that has been made on a particular asset or asset/blockchain combination schema: type: array items: type: string - name: risk_rules in: query description: return wallets that has triggered at least one of the specified risk_rules. To get wallet analyses that have not triggered any rules, include empty string in your query. e.g. "?risk_rules=,f7c36274-ba55-4f6b-8d46-d8cbe97d7c32" schema: type: array items: type: string format: NullableUUIDv4 - name: analysed_by in: query description: the ID of the actor who ran the query schema: type: string format: UUIDv4 - name: customer_id in: query description: the ID of the customer this wallet analysis is linked to schema: type: string format: UUIDv4 - name: assigned_team_user_id in: query description: return wallets that are assigned to the given team user ID(s). To get wallet analyses that are unassigned, include an empty string in your query. Multiple IDs can be provided as a comma-separated list. schema: type: array items: type: string format: NullableUUIDv4 - name: screening_source in: query description: Indicates whether the screening was done via the Synchronous endpoint, Asynchronous endpoint, as part of the Automatic Rescreening feature or as a fallback system rescreening in case of error schema: type: array items: type: string enum: - sync - async - system_rescreen - automatic_rescreen - continuous_monitoring - name: sort in: query description: sort by criterion schema: type: string enum: - entity_name - -entity_name - entity_category - -entity_category - outflow_usd - -outflow_usd - inflow_usd - -inflow_usd - asset - -asset - customer_reference - -customer_reference - analysed_at - -analysed_at - risk_score - -risk_score - workflow_status - -workflow_status default: -analysed_at - name: page in: query description: pagination page number schema: type: integer format: int32 minimum: 0 default: 1 - name: per_page in: query description: pagination per page number, has a maximum value of 500. schema: type: number format: int32 minimum: 0 maximum: 500 default: 20 - name: limit in: query description: The maximum number of results that are counted. If more analyses than this number are present then this number is returned. This improves the performance of queries over large datasets schema: type: number example: 10000 responses: '200': description: Successful wallet analysis response content: application/json: schema: type: object title: PaginatedWallets description: Paginated array of wallet analyses properties: page: type: number format: int32 minimum: 0 example: 5 per_page: type: number format: int32 minimum: 0 example: 5 total_pages: type: number format: int32 minimum: 0 example: 5 total_items: type: number format: int32 minimum: 0 example: 5 items: type: array description: array of analyses items: title: WalletAnalysisGetAllResponse type: object description: Response for Wallet Analysis get all properties: id: type: string format: UUIDv4 example: b7535048-76f8-4f60-bdd3-9d659298f9e7 type: $ref: '#/components/schemas/WalletAnalysisType' subject: allOf: - $ref: '#/components/schemas/WalletAnalysisSubject' - type: object customer: type: object properties: id: type: string format: UUIDv4 description: the UUIDv4 of the customer this analysis is associated with example: b7535048-76f8-4f60-bdd3-9d659298f9e7 reference: type: string description: the string reference that has been given to this customer example: foobar blockchain_info: description: The relevant blockchain data related to the subject's hash type: object properties: cluster: type: object properties: inflow_value: type: object description: value of cluster's inflowing funds properties: usd: type: number nullable: true description: Transaction amount expressed in US dollars of the blockchain it has occurred in the most precise unit possible, e.g. satoshis for bitcoin example: 38383838 outflow_value: type: object description: value of cluster's outflowing funds properties: usd: type: number nullable: true created_at: description: ISO date time with time zone (UTC) of when the analysis was first analysed type: string format: date-time example: '2015-05-13T10:36:21.000Z' updated_at: description: ISO date time with time zone (UTC) of when the wallet analysis was last updated type: string format: date-time example: '2015-05-13T10:36:21.000Z' analysed_by: type: object description: the actor who requested the analysis properties: id: type: string description: the actor id format: UUIDv4 example: b7535048-76f8-4f60-bdd3-9d659298f9e7 analysed_at: description: ISO date time with time zone (UTC) of when this analysis was completed type: string format: date-time example: '2015-05-13T10:36:21.000Z' cluster_entities: type: array items: $ref: '#/components/schemas/WalletAssertedLabel' description: An Elliptic-created, wallet asserted label to be attached to a cluster asset_tier: type: string description: The asset tier enum: - full - sanctions example: full process_status: description: the process status ('running','complete','error') type: string example: running enum: - running - complete - error process_status_id: type: integer description: 'The screening process status. - A 1 number means the process status is running. - A 2 number means the process status is completed. - A 3 indicates the process status has an error. ' enum: - 1 - 2 - 3 example: 2 team_id: description: UUIDv4 identifier of the team the user belongs to type: string format: UUIDv4 example: e333694b-c7c7-4a36-bf35-ed2615865242 triggered_rules: type: array items: description: risk rules which triggered against either source or destination of funds type: object properties: rule_id: type: string format: UUIDv4 example: e333694b-c7c7-4a36-bf35-ed2615865242 rule_name: type: string example: Illict deposits risk_score: type: number format: float nullable: true minimum: 0 maximum: 10 example: 9 risk_score: type: number format: float description: the overall risk score we will show to the user nullable: true error: type: object nullable: true description: Property containing information about a failed screening, null unless process_status = 'error' properties: message: type: string description: error message example: something went wrong workflow_status: $ref: '#/components/schemas/WalletAnalysisResponse/properties/workflow_status' workflow_status_id: $ref: '#/components/schemas/WalletAnalysisResponse/properties/workflow_status_id' assigned_team_user_id: type: string format: UUIDv4 description: id of the team user assigned to this analysis example: b7535048-76f8-4f60-bdd3-9d659298f9e7 changes: type: object description: Changes compared to previous screening of analysis properties: risk_score_change: type: number format: float description: 'Change in risk score compared to previous screening of analysis. - A positive number means the risk score has increased compared to the previous screening. - A negative number means the risk score has decreased compared to the previous screening. - A 0 indicates no change in risk score compared to the previous screening. ' example: 0.1 screening_source: description: Indicates whether the screening was done via the Synchronous endpoint, Asynchronous endpoint, as part of the Automatic Rescreening feature or as a fallback system rescreening in case of error type: string example: sync enum: - sync - async - system_rescreen - automatic_rescreen - continuous_monitoring required: - id - type - subject - customer - blockchain_info - created_at - updated_at - analysed_at - cluster_entities - process_status - team_id - triggered_rules - workflow_status additionalProperties: false required: - page - per_page - total_pages - total_items - items additionalProperties: false '400': $ref: '#/components/responses/400' '401': $ref: '#/components/responses/401' '403': $ref: '#/components/responses/403' '404': $ref: '#/components/responses/404' '500': $ref: '#/components/responses/500' /wallet/{wallet_analysis_id}: get: tags: - Wallet Analyses summary: Get an analysis by ID description: Given an ID, return a single wallet analysis parameters: - name: wallet_analysis_id description: id of the wallet analysis to retrieve in: path required: true schema: type: string format: UUIDv4 - name: includeScreenings description: toggle whether to include the screening history in: query required: false schema: type: boolean - name: previousScreenings description: Number of previous screenings to include in the response, where the default is 10 in: query required: false schema: type: string enum: - default - '20' - '50' - '100' - all responses: '200': description: Successful wallet analysis response content: application/json: schema: $ref: '#/components/schemas/WalletAnalysisResponse' '400': $ref: '#/components/responses/400' '401': $ref: '#/components/responses/401' '403': $ref: '#/components/responses/403' '404': $ref: '#/components/responses/404' '500': $ref: '#/components/responses/500' /wallet/{wallet_analysis_id}/screenings/{screening_id}: get: tags: - Wallet Analyses summary: Get a screening of the wallet by ID description: Given a screening ID, return the screening of the wallet parameters: - name: wallet_analysis_id description: id of the wallet analysis to retrieve in: path required: true schema: type: string format: UUIDv4 - name: screening_id description: id of the screening to retrieve in: path required: true schema: type: string responses: '200': description: Successful wallet analysis response content: application/json: schema: $ref: '#/components/schemas/WalletAnalysisResponse' '400': $ref: '#/components/responses/400' '401': $ref: '#/components/responses/401' '403': $ref: '#/components/responses/403' '404': $ref: '#/components/responses/404' '500': $ref: '#/components/responses/500' components: schemas: HolisticWalletAnalysisRequest: type: object title: Holistic Wallet Analysis Request properties: subject: title: WalletAnalysisSubject type: object properties: asset: type: string description: For holistic screening this should be set to holistic enum: - holistic example: holistic blockchain: type: string description: For holistic screening this should be set to holistic enum: - holistic example: holistic type: type: string description: the type of subject enum: - address example: address hash: type: string description: the address hash example: '0x8589427373d6d84e98730d7795d8f6f8731fda16' required: - asset - blockchain - type - hash type: $ref: '#/components/schemas/WalletAnalysisType' customer_reference: type: string description: a reference for the customer. Will create a new customer if one with a matching reference does not exist required: - subject - type WalletAnalysisResponse: title: WalletAnalysisResponse type: object description: 'Response for Wallet Analysis. Represents the full result of a holistic wallet analysis, including metadata, risk scores, and contributing entities. ' properties: id: type: string format: uuid description: Unique identifier of the wallet analysis example: b7535048-76f8-4f60-bdd3-9d659298f9e7 type: $ref: '#/components/schemas/WalletAnalysisType' subject: allOf: - $ref: '#/components/schemas/WalletAnalysisSubject' - type: object customer: type: object description: The customer that submitted the request properties: id: type: string format: uuid description: The UUIDv4 of the customer this analysis is associated with example: b7535048-76f8-4f60-bdd3-9d659298f9e7 nullable: true reference: type: string description: The string reference that has been given to this customer. Can be empty example: foobar blockchain_info: description: The relevant blockchain data related to the subject's hash type: object properties: cluster: type: object properties: inflow_value: type: object description: Value of cluster's inflowing funds properties: usd: type: number nullable: true description: 'Transaction amount expressed in US dollars of the blockchain it has occurred in the most precise unit possible, e.g. satoshis for bitcoin ' example: 38383838 outflow_value: type: object description: Value of cluster's outflowing funds properties: usd: type: number nullable: true created_at: description: ISO datetime (UTC) when the analysis was first analysed type: string format: date-time example: '2015-05-13T10:36:21.000Z' updated_at: description: ISO datetime (UTC) when the wallet analysis was last updated type: string format: date-time example: '2015-05-13T10:36:21.000Z' analysed_at: description: ISO datetime (UTC) when this analysis was completed type: string format: date-time example: '2015-05-13T10:36:21.000Z' analysed_by: description: The actor who executed the analysis type: object nullable: true properties: id: type: string format: UUIDv4 description: Team User's UUIDv4 (unique for team & user) example: 17535048-76f8-4f60-bdd3-9d659298f9e5 email: type: string description: the email address of the User example: foo_bar@elliptic.co first_name: type: string description: the first name of the User example: Foo last_name: type: string description: the last name of the User example: Bar type: type: string description: Type of actor (e.g. user, system, api_key). Only present for analysed_by. example: api_key asset_tier: type: string enum: - full - sanctions description: The asset tier example: full cluster_entities: type: array description: An Elliptic-created, wallet asserted label to be attached to a cluster items: $ref: '#/components/schemas/WalletAssertedLabel' team_id: description: UUIDv4 identifier of the team the user belongs to type: string format: uuid example: e333694b-c7c7-4a36-bf35-ed2615865242 risk_score: type: number nullable: true format: float description: 'The risk score calculated as an aggregation from all the rules. If null is returned, no risk rules have been triggered. If 0 is returned, risk rules were triggered and the calculated score was 0. ' example: 9.038007 risk_score_detail: type: object description: Details on the risk scores of the source and destination of funds properties: source: type: number format: float nullable: true example: 6 destination: type: number format: float nullable: true example: 6 error: type: object nullable: true description: Property containing information about a failed screening, null unless process_status = 'error' properties: message: type: string description: Error message example: something went wrong evaluation_detail: type: object description: Details of risk rule evaluations for both source and destination of funds properties: source: type: array items: $ref: '#/components/schemas/EvaluationDetail' destination: type: array items: $ref: '#/components/schemas/EvaluationDetail' contributions: type: object description: Array of contributions for the analysis subject retrieved properties: source: type: array items: $ref: '#/components/schemas/Contribution' destination: type: array items: $ref: '#/components/schemas/Contribution' detected_behaviors: type: array description: 'Array of detected behaviors for the analysis subject retrieved from the graph server ' items: title: DetectedBehavior type: object properties: behavior_type: type: string description: Type of the Behavioral pattern detected of potential suspicious activity example: Peeling Chain length: type: number description: Length associated with the Behavior detected example: 7 usd_value: type: number format: float description: aggregated value (sum) associated with the behavior detected example: 10500 required: - behavior_type - length - usd_value changes: type: object description: Changes compared to previous screening of analysis properties: risk_score_change: type: number format: float description: 'Change in risk score compared to previous screening of analysis. - A positive number means the risk score has increased. - A negative number means it has decreased. - Zero means it remained unchanged. ' example: 0.1 workflow_status: title: WorkflowStatus description: The status of the analysis. "archived" is deprecated and you should use "closed" instead. type: string enum: - active - archived - escalated - closed example: active workflow_status_id: title: WorkflowStatusId description: 'A number representation of the status of an analysis. "archived" is deprecated and you should use "closed" instead. - 1 = active - 2 = archived (deprecated) - 3 = escalated - 4 = closed ' type: integer enum: - 1 - 2 - 3 - 4 example: 1 assigned_team_user: $ref: '#/components/schemas/WalletAnalysisResponse/properties/analysed_by' description: The team user assigned to this analysis process_status: type: string enum: - running - complete - error example: running description: The process status ('running','complete','error') process_status_id: type: integer enum: - 1 - 2 - 3 example: 2 description: 'The screening process status. - 1 = running - 2 = completed - 3 = error ' triggered_rules: type: array description: Deprecated. This property is retained for backward compatibility and is always an empty array in this response. To see the set of rules that were triggered, use `evaluation_detail` instead. deprecated: true items: {} example: [] screening_id: type: string format: uuid description: The identifier of the specific screening in the analysis example: d1afc6f3-6431-4566-8260-8e6db0b4ecf2 screening_source: type: string enum: - sync - async - system_rescreen - automatic_rescreen - continuous_monitoring example: sync description: 'Indicates whether the screening was done via the Synchronous endpoint, Asynchronous endpoint, system rescreen, automatic rescreen, or continuous monitoring. ' required: - id - type - subject - customer - blockchain_info - created_at - updated_at - analysed_at - cluster_entities - process_status - team_id - workflow_status additionalProperties: false AnalysisSubject: title: AnalysisSubject type: object properties: asset: type: string description: the asset involved in the event. example: holistic blockchain: type: string description: The blockchain the asset/address belongs to (optional) example: holistic type: type: string description: the type of subject. Currently, only 'transaction' is supported example: transaction hash: type: string description: the transaction hash example: '0x4672bad527107471cb5067a887f4656d585a8a31' output_type: type: string enum: - address - indices description: which output type you are using to specify the output(s) you wish to analyse (BTC/LTC/BCH only) output_address: type: string description: the address hash when using output_type address example: 1MdYC22Gmjp2ejVPCxyYjFyWbQCYTGhGq8 output_indices: type: array items: type: number description: the indices of outputs to be analysed when using output_type indices example: - 1 log_index: type: number description: the log index of an ERC20 transacation example: 10 required: - asset - type - hash BadRequestError: type: object properties: name: type: string example: BadRequestError message: type: string example: Invalid id parameter ForbiddenError: type: object properties: name: type: string example: ForbiddenError message: type: string example: You do not have enough privilege to access this path. NotFoundError: type: object properties: name: type: string example: NotFoundError message: type: string example: Entity not found. UTXOBasedWalletAnalysisRequest: type: object title: BCH/BTC(Lightning)/ZEC/ZEN Analysis Request properties: subject: title: WalletAnalysisSubject type: object properties: asset: type: string description: the asset (either BCH, BTC (Lightning), ZEN or ZEC) involved in the event enum: - BCH - BTC - ZEN - ZEC example: BCH blockchain: type: string description: the blockchain (either bitcoin_cash, lightning, horizen or zcash) of the asset submitted enum: - bitcoin_cash - lightning - horizen - zcash example: bitcoin_cash type: type: string description: the type of subject enum: - address example: address hash: type: string description: the address hash example: 18u9Ncc5UBNKGGmThxTjfuFHN69w8Yh8Lg required: - asset - blockchain - type - hash type: $ref: '#/components/schemas/WalletAnalysisType' customer_reference: type: string description: a reference for the customer. Will create a new customer if one with a matching reference does not exist required: - subject - type WalletAssertedLabel: title: WalletAssertedLabel type: object description: An Elliptic-created, wallet asserted label to be attached to a cluster properties: name: description: 'A real-world description of the labelled cluster, derived from the assertions associated to this label. ' type: string nullable: true example: Mt.Gox category: description: 'A categorical description of the real-world entity controlling the labelled cluster ' type: string nullable: true example: Exchange category_id: description: UUID identifier of the category type: string format: uuid example: 00000000-0000-4000-8000-500000000001 entity_id: description: UUIDv4 identifier of the entity type: string format: uuid example: 00000000-0000-4000-8000-800000000001 actor_id: description: Internal numeric ID of the actor type: integer example: -4 is_primary_entity: description: 'A flag that shows if the entity is primary or not. Only one in the whole array of labels ' type: boolean example: true is_vasp: description: 'True if this entity is a Virtual Asset Service Provider, false if not, null if unknown ' type: boolean nullable: true example: true is_after_sanction_date: description: 'True if the entity’s activity or transaction occurred after the date it was officially sanctioned, enabling accurate time-bound sanction screening ' type: boolean nullable: true example: true required: - name - category - is_primary_entity UnauthorizedError: type: string example: Unauthorized WalletAnalysisType: title: WalletAnalysisType description: The type of analysis. Currently it is wallet_exposure type: string enum: - wallet_exposure example: wallet_exposure WalletRequestBatch: description: the analyses to request type: array minItems: 1 maxItems: 100 items: anyOf: - $ref: '#/components/schemas/HolisticWalletAnalysisRequest' - $ref: '#/components/schemas/UTXOBasedWalletAnalysisRequest' NotInBlockchain: type: object properties: name: type: string example: NotInBlockchain message: type: string example: The submitted ${type} with hash ${hash} has not yet been processed into the Elliptic tool or does not exist on the blockchain. Contribution: title: Contribution type: object description: A single contribution entry associated with an entity (holistic — only USD values included) properties: entities: type: array description: Entities (labels) associated with this contribution items: type: object properties: name: type: string description: Name of the entity example: BTC-e category: type: string description: Category of the entity example: Exchange category_id: type: string format: uuid description: UUID of category example: 0a52f7a2-5da8-4256-b230-df0da6f8449b entity_id: type: string format: uuid description: UUID of entity example: 09d2c6ba-a32e-4207-bf72-233b38d644c4 actor_id: type: integer description: Internal actor ID or numeric identifier that related to the identified entity example: 54 is_primary_entity: type: boolean description: Whether this is the primary entity in the group (one per list) example: true is_vasp: type: boolean nullable: true description: True if VASP (Virtual Asset Service Provider), false if not, null if unknown example: true contribution_percentage: type: number format: float description: Percentage of value contributed by this entity example: 62.98592267836703 contribution_value: type: object description: Value contributed by this entry properties: usd: type: number format: float example: 395.47601131293095 counterparty_percentage: type: number format: float description: The percentage of the total contribution that is attributed to labelled entities that are one hop away from the screened_address. example: 0 counterparty_value: type: object description: Value from counterparties (1-hop entities) properties: usd: type: number description: The contribution between the screened_address and labelled entities that are one hop away, expressed in US dollars. format: float example: 0 indirect_percentage: type: number format: float description: The percentage of the total contribution that is attributed to labelled entities that are more than one hop away from the screened_address. example: 62.98592267836703 indirect_value: type: object description: USD value from indirect flow properties: usd: type: number description: The contribution between the screened_address and labelled entities that are more than one hop away, expressed in US dollars. format: float example: 395.47601131293095 is_screened_address: type: boolean description: A boolean displaying whether the input address of a deposit or the output address of a withdrawal that is screened belongs to a labelled entity for transaction monitoring or the address that is screened belongs to a labelled entity for wallet screening example: false min_number_of_hops: type: integer format: int64 description: Minimum number of hops between the subject and the labelled entity example: 2 required: - entities - contribution_percentage - contribution_value WalletAnalysisSubject: title: WalletAnalysisSubject type: object description: Information describing the subject of the analysis properties: asset: type: string description: The asset involved in the event example: holistic type: type: string description: The type of subject. Currently, only 'address' is supported example: address hash: type: string description: The address hash when using type 'address' example: 1MdYC22Gmjp2ejVPCxyYjFyWbQCYTGhGq8 blockchain: type: string description: The blockchain the asset/address belongs to (optional) example: holistic required: - asset - type - hash MatchedElement: title: MatchedElement type: object description: 'Entity or group of entities identified as contributing to the risk rule. Note: In holistic responses, values are expressed in USD only. ' properties: category: type: string description: category of the risk rule's subject that has been triggered by one or more elements. The name can change so advisable to use identifier for matching purposes example: Dark Market category_id: type: string format: uuid description: UUID identifying the entity's category example: 0a52f7a2-5da8-4256-b230-df0da6f8449b contribution_percentage: type: number format: float description: Aggregated percentage of value attributed to this matched category contribution_value: type: object description: Aggregated USD value attributed to this matched entity category properties: usd: type: number format: float example: 383.83838 counterparty_percentage: type: number format: float description: Percentage of contribution from one-hop counterparties counterparty_value: type: object description: Value from one-hop counterparties (USD only) properties: usd: type: number format: float example: 383.83838 indirect_percentage: type: number format: float description: Percentage of contribution from indirect (multi-hop) relationships indirect_value: type: object description: Value from indirect (multi-hop) sources (USD only) properties: usd: type: number format: float example: 383.83838 contributions: type: array description: Array of contributing entities that led to the match items: type: object required: - entity - entity_id properties: contribution_percentage: type: number format: float description: Percentage of this contribution counterparty_percentage: type: number format: float description: One-hop contribution percentage indirect_percentage: type: number format: float description: Multi-hop contribution percentage entity: type: string description: Name of the contributing entity example: AlphaBay entity_id: type: string format: uuid description: ID of the entity; use with entity_details to look up extended entity data example: 0a52f7a2-5da8-4256-b230-df0da6f8449b risk_triggers: type: object description: Metadata indicating why the entity was considered risky properties: name: type: string description: Trigger entity name example: Binance category: type: string description: Trigger category example: Dark Markets is_sanctioned: type: boolean description: Indicates if a sanction-based risk was involved example: true country: type: array description: List of country codes associated with the risk trigger items: type: string example: MM contribution_value: type: object description: Contribution amount from this entity (USD only) properties: usd: type: number format: float example: 383.83838 counterparty_value: type: object description: Counterparty contribution value (USD only) properties: usd: type: number format: float example: 383.83838 indirect_value: type: object description: Indirect (multi-hop) value (USD only) properties: usd: type: number format: float example: 383.83838 is_screened_address: type: boolean description: Flag indicating whether address was directly screened example: false min_number_of_hops: type: integer format: int64 description: Shortest path in hops to the entity example: 1 required: - category - contribution_percentage - contribution_value - contributions EvaluationDetail: title: EvaluationDetail type: object description: 'Details of a single risk rule evaluation. Note: if matched_behaviors is present, matched_elements will be empty, and vice versa— rules cannot match both entities and behaviors simultaneously. ' properties: rule_id: type: string format: uuid description: The Id of the rule that triggered example: b7535048-76f8-4f60-bdd3-9d659298f9e7 rule_name: type: string description: The name of the triggered rule example: Illict risk_score: type: number format: float description: The risk score calculated for this rule evaluation example: 9.038007 matched_elements: type: array description: Array of entities matched by this rule items: $ref: '#/components/schemas/MatchedElement' matched_behaviors: type: array description: Array of behaviors matched by this rule (mutually exclusive with matched_elements) items: title: MatchedBehavior type: object properties: behavior_type: type: string description: Type of the Behavioral pattern detected of potential suspicious activity example: Peeling Chain length: type: number description: Length associated with the Behavior detected example: 7 usd_value: type: number format: float description: aggregated value (sum) associated with the behavior detected example: 10500 required: - behavior_type - length - usd_value rule_history_id: type: string format: uuid description: The unique identifier that links all versions of a risk rule example: b7535048-76f8-4f60-bdd3-9d659298f9e7 mc_analysis_id: type: string format: uuid description: Id of the analysis performed example: b7535048-76f8-4f60-bdd3-9d659298f9e7 rule_type: type: string description: Type of the rule evaluated enum: - exposure - behavior example: exposure required: - rule_id - risk_score additionalProperties: false Error: type: object properties: name: type: string example: GenericErrorName message: type: string example: Something bad happened. WalletRequestSingle: oneOf: - $ref: '#/components/schemas/HolisticWalletAnalysisRequest' - $ref: '#/components/schemas/UTXOBasedWalletAnalysisRequest' responses: TooManyRequestsError: description: Too Many Requests — Rate limit exceeded content: application/json: schema: type: object description: Returned when a client exceeds the allowed rate limit (HTTP 429) properties: name: type: string example: TooManyRequestsError message: type: string example: Too many requests – please try again later '401': description: Not authenticated content: application/json: schema: $ref: '#/components/schemas/UnauthorizedError' 400Post: description: Bad Request content: application/json: schema: type: object properties: name: type: string example: BadRequestError message: type: string example: subject.asset and subject.blockchain combination not recognised '403': description: Not authorized content: application/json: schema: $ref: '#/components/schemas/ForbiddenError' '500': description: Server Error content: application/json: schema: $ref: '#/components/schemas/Error' NotInBlockchain: description: Requested subject not found on the blockchain content: application/json: schema: $ref: '#/components/schemas/NotInBlockchain' '404': description: Resource item not found content: application/json: schema: $ref: '#/components/schemas/NotFoundError' '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/BadRequestError' securitySchemes: oauth2: type: oauth2 flows: authorizationCode: authorizationUrl: https://login.elliptic.co/authorize tokenUrl: https://login.elliptic.co/oauth/token scopes: openid: '' profile: '' apiKey: description: API Key type: apiKey in: header name: x-access-key signature: description: (Request Time, HTTP Method, Lowercase Path, Request Payload) signed with API Secret type: apiKey in: header name: x-access-sign timestamp: type: apiKey in: header name: x-access-timestamp x-readme: oauth-options: usePkce: true x-tagGroups: - name: Navigator tags: - Transaction Analyses - name: Lens tags: - Wallet Analyses - name: Workflow Management tags: - Customers - Transaction Workflow - name: Account Management tags: - Users - name: Asset Information tags: - Assets table