Intelligence API

Triport's security and compliance intelligence layer over REST: address labels, AML risk scores, token approval risk, fund-flow graphs, funder risk, contract creation, contract inspection, calldata decode and read-only transaction simulation. 18 methods (19 endpoints: address labels come in a single and a batch form), released on 2026-11-06 for Business and Enterprise plans, Ethereum first.

Method / Endpoint: https://triport.io/v1/intelligence/… (REST, JSON)
Network: Ethereum; address labels also on Solana and Avalanche C-Chain; search, selector lookup and calldata decode are chainless
Authentication: x-token header (recommended) or Authorization: Bearer; see Authentication
Required scope: intelligence:read
Tier / rate limit: Business — 30 rps (intelligence, burst ×2); Enterprise — 150 rps

What it is for

The Intelligence API answers the questions you ask about an address or a transaction before you act on it: who is this, is it risky, where did its money come from, what will this call do. It sits next to the JSON-RPC endpoints and uses the same API key.

Task	Methods
AML and compliance screening of deposits and withdrawals	Address risk score, Funder risk
Wallet and counterparty labeling	Address labels, Address labels (batch), Implementation labels
Approval checks before a user signs `approve` or `permit`	Token approval risk
Investigations and source-of-funds review	Fund flow graph
Who deployed a contract, and when	Contract creation and deployer
Contract inspection	Contract verification metadata, Storage variable list, Function signature lookup, Function selector lookup
Calldata decoding	Calldata decode
Pre-trade checks	Transaction simulation
Discovery	Search, Token markets
Freshness and fee context	Latest block, Conservative block, Base fee estimate

Every route, with its released chains, is in the method reference. Runnable examples in curl, JavaScript and Python are in code examples.

Access and limits

Plans. Business and Enterprise. The Intelligence API is included in the plan price; there is no separate fee, no credits and no per-call weight. Trial, Basic and Pro keys get 403 tier_insufficient.
Scope. The key needs intelligence:read. A key created with the default scope (*, all networks) already has it; a key restricted to a list of scopes needs intelligence:read added.
Rate limit. One per-second category, intelligence: 30 requests per second on Business and 150 on Enterprise, with a burst of 2× the sustained rate. Over the limit you get 429 rate_limited with Retry-After; see rate limits and tiers.
Batches. Address labels (batch) and Implementation labels take 1–200 addresses; Token approval risk takes 1–50 spenders. Each address or spender counts as one request against the per-second limit, duplicates included.
Cache. Answers are cached for a period that depends on the method (long for labels and risk, seconds for blocks and fees, none for simulation). meta.cached and meta.expiresAt tell you what you got. Send "fresh": true (GET: ?fresh=1) to ask for a new lookup; it still counts against the rate limit.
Timeouts. A cached answer is quick. An uncached lookup can take several seconds, and an uncached fund flow graph for a busy address can take tens of seconds. Set a client timeout of at least 60 seconds and do not retry in a tight loop.
Request rules. POST bodies are strict JSON objects up to 256 KiB: unknown fields, duplicate keys, null values and query parameters fail with 400 invalid_request. GET routes take path parameters and only fresh=0|1. There is no pagination: bounded answers (graphs, search) say so in their own fields.

Chains

Ethereum is released for every chain-specific method. Address labels and Address labels (batch) also accept solana and avalanche. Search, Function selector lookup and Calldata decode take no chain. Any other chain answers 422 with state unsupported. More chains are coming; releases are announced in the changelog.

Chain ids are case-sensitive. Aliases: ethereum → eth, sol → solana, avax → avalanche. EVM addresses are accepted in any letter case; Solana base58 addresses keep their case.

Response states

Every answer, success or failure, is the same envelope:

JSON

{ "state": "ok", "meta": { "cached": false, "complete": false, "observedAt": "…", "expiresAt": "…" }, "data": { }, "error": { "code": "…", "message": "…" } }

State	What it means	What it does not mean
`ok`	A valid answer. `meta.complete` still says whether coverage is complete.	That an address is safe.
`empty`	The lookup ran and found nothing (no label, no creation record).	That nothing exists. A missing label is not a clean address.
`partial`	Useful data with incomplete coverage; batch items carry their own states.	That the missing part is empty.
`stale`	Older data, clearly marked; it can come with an `error`.	Current data.
`unsupported`	This method does not support this chain or this contract (`422`).	An empty result.
`unavailable`	No answer could be produced right now (`503`, `504`) or the request was rejected.	That the address is clean.

Rules that matter for compliance work:

Missing risk is not zero risk. An unknown score is risk.value: null with level unknown. Never map it to 0 or to "low".
An empty graph is not proof of no transfers. Fund-flow graphs are bounded; read their coverage fields.
A simulation is not an execution. Transaction simulation returns a reference with outcome: unknown, not a receipt; nothing is signed or broadcast.
HTTP 200 can carry both data and error. A partial or stale answer is still useful; keep both.
Numbers are strings. Scores, block numbers, amounts and fees are strings. Parse them with arbitrary precision.

Errors

HTTP	`error.code`	Meaning
400	`invalid_request`	Malformed input or body.
401	`unauthorized`	Missing or invalid API key.
403	`scope_missing`, `tier_insufficient`	The key lacks `intelligence:read`, or the plan is below Business.
404	`not_found`	Unknown route.
405	`method_not_allowed`	Wrong HTTP method; `Allow` names the right one.
422	`unsupported`	Chain or contract not supported by this method, or a method that is not available yet.
429	`rate_limited`	Over the `intelligence` limit; `Retry-After` / `retryAfterSeconds` say when to retry.
502	`invalid_response`	The lookup returned an answer that failed validation; retry later.
503	`unavailable`	The lookup could not be completed now; retry later.
504	`timeout`	The lookup took too long.

Methods never retry on your behalf. Authentication and plan errors from the gateway may use the shared error envelope.

Not available yet

Five routes of the contract are not released: contract upgrades, private variable list, private variable query, variable change history and source code hash. They answer 422 unsupported on every chain; see the method reference.

Wallet identity: names, balances and activity of an EVM wallet in one call.
Wallet funded-by and wallet research: funding and activity evidence read from the chain.
Ethereum JSON-RPC: canonical chain head, receipts and finality, which the Intelligence API does not replace.
Intelligence API product page: use cases, plans and FAQ.

Terms on this page: JSON-RPC · Finality.

Intelligence API method reference

Every Intelligence API endpoint with its route and released chains: 19 released endpoints and 5 that are not available yet.

Intelligence API code examples

Copy-paste examples for the Intelligence API in curl, JavaScript (fetch) and Python (requests): screen a deposit address, label a batch, check a spender before approval, and handle every response state.

POST Address labels

Look up the attribution label of one address: exchange wallet, bridge, protocol contract, known scam and similar entity tags. Curated labels Triport already verifies are consulted first.

POST Address labels (batch)

Label 1–200 addresses of one chain in a single request. Results come back in input order; duplicates stay separate positions.

POST Address risk score

Get an AML risk assessment of an address: a risk score and level, plus risk labels and related transfer addresses when they are known. Built for deposit screening, withdrawal checks and compliance review queues.

GET Base fee estimate