Skip to main content
GET
Get a project's security state
One route returns what Trustblock holds for a project: its published audits, the findings that still stand, recorded incidents and a flag that restates them.
1

Get your API key

Sign in at app.trustblock.run with a developer account and open Dashboard in the header. It shows your API key, your usage, your last accepted and last refused call (and why it was refused), and a button to rotate the key. Sign in
2

Send it as a bearer token

Identify the project with exactly one of domain, slug, or the pair chain and address.Authorization: Bearer <key> is the header to use. Calls that send the key in the older x-trustblock-api-key header are accepted too, on this route and on /v1/key; new integrations should not use it.
3

Check your key (no credit used)

A 200 means the key works; the answer names the account, the header that carried the key and the credits left this month. The dashboard’s Test my key button makes the same call.

Reading the response

  • activeIssues lists every finding from the audits whose findings still stand, fixed ones included. Read status on each item. An audit’s findings are dropped only when the same security firm audited the same contracts again.
  • A finding the client acknowledged without fixing keeps status: not_fixed and carries isAcknowledged: true.
  • isDeemedDangerous is true when an audit whose findings still stand reports an open critical finding, or the project has a recorded incident not marked fixed. It restates the data; it is not a judgement about the project. Acknowledged findings do not set it, and High findings do not set it.
  • isAIScan is true when the most recent audit is an automated scan.

Credits and errors

The card routes answer a missing project differently: see Explorer cards.

Rotating your key

On the dashboard, Rotate key replaces your key at once. The new key is shown so you can copy it, your remaining credits move to it, and the old key stops working on this route immediately (the explorer card routes may accept it for up to 5 minutes). You can rotate once a minute.

Authorizations

Authorization
string
header
required

Authorization: Bearer <key>.

For the project and card routes, the key is an API key belonging to an onboarded integrator or to an active audit provider. The publishing routes accept only an audit provider's credential. Sending no Authorization header produces 401; sending one that is not recognised produces 403.

Query Parameters

domain
string

The project's domain, for example example.com.

slug
string

The project's Trustblock slug.

chain
enum<string>

Chain of a contract belonging to the project. Must be sent with address. The chains Trustblock records contracts on.

Available options:
ethereum,
polygon,
avalanche,
bnbchain,
arbitrum,
optimism,
fantom,
zksync,
base,
polygonZkEvm,
scroll,
blast,
starknet,
solana,
stellar,
sui,
tron,
injective,
ton,
plume,
peaq,
lukso,
mina,
astar,
vana,
fiveire,
zircuit,
cosmoshub,
osmosis,
neutron,
terra,
sei,
juno,
stargaze,
dymension,
archway,
noble,
stride,
persistence,
xrpl,
sonic,
linea,
monad,
mantle,
megaeth,
gnosis,
plasma,
berachain,
celo,
hyperevm,
unichain,
seievm,
robinhood,
arc,
taiko,
fraxtal,
abstract,
worldchain,
apechain,
xdc,
katana,
stable,
opbnb,
bttc,
memecore
address
string

Address of a contract belonging to the project. Must be sent with chain.

Response

The project's security state.

name
string
required
domain
string
required
url
string
required

The project's page on Trustblock.

audits
object[]
required

Every published audit of the project, most recently conducted first.

activeIssues
object[]
required

Every issue from every audit whose findings still stand, resolved ones included - read status on each item. The name is a misnomer and predates this document; it has never filtered by status.

An earlier audit's findings are dropped only when the same provider audited the same contracts again: a re-audit supersedes its own earlier report. A different provider's findings, and findings on contracts a later audit did not cover, remain listed.

This previously covered the most recent audit only, which meant a finding disappeared as soon as any newer audit was published, whoever wrote it and whatever it covered.

activeRekts
object[]
required
isDeemedDangerous
boolean
required

True when any audit whose findings still stand reports an unresolved critical issue, or the project has an unresolved recorded incident. It is a restatement of the data below it, not a judgement about the project.

It tests Critical only. An unresolved High finding does not set it, and activeHighIssuesNumber on the card routes is published so a caller can apply its own threshold. Whether High should set this flag is an open product question, not an oversight: the great majority of unresolved High findings on this platform are advisories the client read and accepted.

It excludes acknowledged findings. A Critical finding with isAcknowledged: true does not set it: the client read the finding and accepted the risk, and this flag describes unresolved findings nobody has accepted. Such a finding is still listed in activeIssues, as not_fixed. Acknowledgement is recorded for findings ingested from 2026-09 onward.

isAIScan
boolean
required

True when the most recent audit is an automated scan rather than a human review.

extra
object
required

Present on every response, including errors.