NFTs API
Can this NFT collection's owner abuse its holders, and is it flagged malicious?
An NFT contract's owner privileges (minting, burning, self-destruct, transfers without approval), whether it is a proxy or flagged malicious, and copies carrying its name.
/api/external/nft-analysis/nft-security/{chain}/{address}What it returns
An NFT collection contract's owner privileges — minting outside the public mint, burning holders' tokens, destroying the contract, moving tokens without approval — each as absent, renounced (the function exists but its owner is a burn address) or present with who holds it; whether the contract is a proxy (its code can be replaced), restricts which marketplaces holders may approve, publishes its source, and is flagged malicious; and other contracts carrying the same name, which is how copies of a collection are spotted. flaggedMalicious: false means not flagged, not proven safe. When complete is false the scan of the contract was not finished and some fields may still be null: ask again a minute later.
Chains
- Ethereum ETH
Request
Send your key in the x-dex-data-key header. Replace each <placeholder> with a real value.
curl -H "x-dex-data-key: $DEXDATA_API_KEY" \ "https://api.dexdata.io/api/external/nft-analysis/nft-security/ETH/<address>"
| Parameter | Description |
|---|---|
chainpath · string · required | The chain the address lives on. ETH is served; SOL, BNB, BASE, STABLE, RHC and ARC return 400. CELO, ARB, OP and SCROLL return 400 here. |
addresspath · string · required | The address being asked about — it may or may not turn out to be a contract; the response says which. |
Response fields
A JSON response. Every field is always present; null means the value could not be established, never zero.
| Field | Type | Description |
|---|---|---|
contract | string | The collection contract, lowercase. |
complete | boolean | false when the scan of the contract was not finished and some fields may still be null. |
name | string | null | The collection's name. |
symbol | string | null | The collection's symbol. |
standard | string | null | The token standard. |
creator | string | null | The address that deployed the contract, lowercase. |
verified | boolean | null | Whether the collection is verified. |
openSource | boolean | null | Whether the contract's source code is published. |
proxy | boolean | null | Whether the contract is a proxy, so its code can be replaced. |
restrictedApproval | boolean | null | Whether the contract limits which operators a holder may approve, e.g. to one marketplace. |
flaggedMalicious | boolean | null | Whether the contract is flagged malicious. false is "not flagged", not "safe". |
trustListed | boolean | null | Whether the collection is on a list of trusted collections. |
privilegedMinting | object | null | Whether the owner can mint tokens outside the public mint. null when the source could not read it. |
privilegedMinting.status | string | absent: the contract has no such function. renounced: it has one, but its owner is a burn address, so nobody can call it. present: it has one and someone can call it. |
privilegedMinting.owner | string | null | The address holding the privilege, lowercase, when the source names one. |
privilegedMinting.ownerType | string | null | What holds it, e.g. contract, multi-address (several addresses), blackhole. |
privilegedBurn | object | null | Whether the owner can burn holders' tokens. null when the source could not read it. |
privilegedBurn.status | string | absent: the contract has no such function. renounced: it has one, but its owner is a burn address, so nobody can call it. present: it has one and someone can call it. |
privilegedBurn.owner | string | null | The address holding the privilege, lowercase, when the source names one. |
privilegedBurn.ownerType | string | null | What holds it, e.g. contract, multi-address (several addresses), blackhole. |
selfDestruct | object | null | Whether the owner can destroy the contract. null when the source could not read it. |
selfDestruct.status | string | absent: the contract has no such function. renounced: it has one, but its owner is a burn address, so nobody can call it. present: it has one and someone can call it. |
selfDestruct.owner | string | null | The address holding the privilege, lowercase, when the source names one. |
selfDestruct.ownerType | string | null | What holds it, e.g. contract, multi-address (several addresses), blackhole. |
transferWithoutApproval | object | null | Whether the owner can move holders' tokens without their approval. null when the source could not read it. |
transferWithoutApproval.status | string | absent: the contract has no such function. renounced: it has one, but its owner is a burn address, so nobody can call it. present: it has one and someone can call it. |
transferWithoutApproval.owner | string | null | The address holding the privilege, lowercase, when the source names one. |
transferWithoutApproval.ownerType | string | null | What holds it, e.g. contract, multi-address (several addresses), blackhole. |
holders | number | null | Distinct holding addresses. |
items | number | null | Tokens in the collection. |
lookalikes | object[] | null | Other contracts with the same name — possible copies. null when the source did not say. |
lookalikes[].contract | string | The other contract, lowercase. |
lookalikes[].name | string | null | Its name. |
lookalikes[].symbol | string | null | Its symbol. |
lookalikes[].holders | number | null | Its distinct holders. |
Start building with DexData today
Sign in, create a key and make your first call in a minute. Free credits every month, and you only pay for calls that succeed.
Get a free API key