Introduction
Noytrix API is a crypto risk intelligence layer for wallets, exchanges, Telegram bots, browser extensions, dashboards and internal security tools. It helps detect scam links, risky wallet flows, suspicious contracts, token risks and phishing patterns before users interact with dangerous infrastructure.
Quickstart
curl -X POST https://api.noytrixapp.com/v1/scan \
-H "Content-Type: application/json" \
-H "x-api-key: YOUR_API_KEY" \
-d '{"input":"https://example.com","lang":"en"}'
Authentication
Every request must include your private API key. Never expose this key in frontend code.
x-api-key: YOUR_API_KEY
or
Authorization: Bearer YOUR_API_KEY
Endpoints
GET /v1/me
POST /v1/scan
/v1/me checks key status, plan and usage. /v1/scan scans URLs, domains, wallets, contracts, tokens and text.
Request schema
{
"input": "https://example.com",
"lang": "en"
}
- input — URL, domain, wallet, contract, token, ticker, text or transaction data.
- lang — response language: en, ru or uk.
Response schema
{
"ok": true,
"kind": "url",
"score": 30,
"level": "suspicious",
"verdict_en": "Suspicious",
"sources": [],
"evidence": [],
"what_can_happen": "The interaction may be risky.",
"worst_case": "A malicious flow may lead to fund loss.",
"api": {
"version": "v1",
"plan": "starter",
"usage": {
"month": "2026-05",
"used": 1,
"limit": 10000,
"left": 9999
}
}
}
Verdict levels
- safe — no strong risk detected.
- suspicious — warning signals exist.
- danger — high-risk behavior detected.
- critical — confirmed or severe scam risk.
Source statuses
- clean — source did not detect risk.
- malicious — source confirmed danger.
- no_data — no final result available.
- invalid_key — provider key not configured.
- timeout — source did not respond in time.
- error — source returned an error.
Error codes
{
"ok": false,
"error": "invalid_api_key",
"message": "Invalid API key."
}
- missing_api_key — API key header is missing.
- invalid_api_key — key does not exist.
- api_key_inactive — key was disabled.
- api_key_expired — key expired.
- monthly_limit_exceeded — monthly quota reached.
- rate_limit_exceeded — too many requests per minute.
- missing_input — request body has no input.
Rate limits
Starter: 10,000 requests / month · 60 requests / minute
Growth: 100,000 requests / month · 180 requests / minute
Scale: 500,000 requests / month · 600 requests / minute
Every successful response includes current usage inside api.usage.
SDK examples
// JavaScript
const res = await fetch("https://api.noytrixapp.com/v1/scan", {
method: "POST",
headers: {
"Content-Type": "application/json",
"x-api-key": process.env.NOYTRIX_API_KEY
},
body: JSON.stringify({ input: "https://example.com", lang: "en" })
});
const data = await res.json();
# Python
import os, requests
res = requests.post(
"https://api.noytrixapp.com/v1/scan",
headers={"x-api-key": os.getenv("NOYTRIX_API_KEY")},
json={"input": "https://example.com", "lang": "en"}
)
data = res.json()
Security best practices
- Store API keys only on your backend or server environment.
- Do not expose API keys inside browser apps, mobile bundles or public repositories.
- Use your own backend as a proxy if you need to call Noytrix from a frontend product.
- Rotate compromised keys immediately.
- Use usage monitoring to detect unexpected request spikes.