Sites API

Is this DeFi app audited, trusted, or flagged?

A DeFi app looked up by website: trusted-list membership, audits on file, and its contracts per chain with malicious flags for contract and creator. Unlisted is null, never clean.

GET/api/external/site-analysis/dapp-security/{host}

Get a free API key Try it in the API reference

What it returns

Looks up the DeFi app at one website in a curated registry: its name and canonical site, whether it is on a trusted list, the audit reports on file, and the contracts attributed to it on each EVM chain with their creator and whether the contract or the creator is flagged malicious. app is null when the registry does not list the app — that is never a clean answer: the registry is curated and dated, and measured on 20 well-known DeFi apps it listed 13. A record is returned only when its own site shares the asked host's registrable domain, so a page on a shared host (e.g. a subdomain of a free hosting service) never inherits another app's record. Accepts a bare hostname or a full URL; the host a browser would open is looked up (case, port, path, credentials and a trailing dot are dropped). Has no chain parameter: the registry is keyed by website.

Chains

This endpoint is not tied to a chain: it takes no chain in its request.

Request

Send your key in the x-dex-data-key header. Replace each <placeholder> with a real value.

curl -H "x-dex-data-key: $DEXDATA_API_KEY" \
  "https://api.dexdata.io/api/external/site-analysis/dapp-security/<host>"

Parameters
Parameter	Description
`host` path · string · required	A website's hostname — e.g. "example.com" — OR a full URL, e.g. "https://example.com/path". A full URL has its host extracted before the lookup runs; scheme, path, query and port otherwise change nothing about the answer (measured). Case-insensitive.

Response fields

A JSON response. Every field is always present; null means the value could not be established, never zero.

Response fields of Is this DeFi app audited, trusted, or flagged?
Field	Type	Description
`host`	string	The host that was looked up, as a browser would open it — lowercased, without port, path or trailing dot.
`app`	object \| null	The registry's record for the app at this host; null when it is not listed, which is not a safety claim.
`app.name`	string \| null	The app's name as the registry holds it.
`app.website`	string	The app's canonical URL as the registry holds it.
`app.trustList`	boolean \| null	true when the app is on the registry's curated trusted list; null otherwise — never false. An unlisted app is not an untrusted one.
`app.audits`	object[] \| null	Audit reports on file. Empty means none on file, NOT unaudited: a widely audited derivatives app measured with none. null when the registry gave no audit list at all.
`app.audits[].firm`	string \| null	The auditor.
`app.audits[].date`	string \| null	The report date, YYYY-MM-DD.
`app.audits[].reportUrl`	string \| null	Where the report is published.
`app.flagged`	boolean \| null	true when any listed contract or its creator is flagged malicious; null otherwise — never false. Measured: 0 of 241 contracts carried a flag.
`app.contracts`	object[] \| null	The contracts the registry attributes to the app, chain by chain. The list can be old and incomplete. null when the registry gave no contract list at all.
`app.contracts[].chainId`	integer	The standard EVM chain id, e.g. 1, 56, 137.
`app.contracts[].chain`	string \| null	The chain code this API uses (ETH, BNB, BASE, …); null for a chain it does not serve.
`app.contracts[].address`	string	The contract address, lowercased.
`app.contracts[].creator`	string \| null	The address that deployed it, lowercased.
`app.contracts[].openSource`	boolean \| null	Whether its source code is verified. false is a real answer, distinct from null.
`app.contracts[].deployedAt`	integer \| null	When it was deployed, unix seconds.
`app.contracts[].maliciousContract`	boolean \| null	true when the contract is flagged malicious; null otherwise — never false.
`app.contracts[].maliciousCreator`	boolean \| null	true when its creator is flagged malicious; null otherwise — never false.
`app.contracts[].maliciousBehavior`	string[] \| null	What the contract was flagged for, possibly empty; null when the registry gave no list.
`app.contracts[].creatorMaliciousBehavior`	string[] \| null	What the creator was flagged for, possibly empty; null when the registry gave no list.

Start building with DexData today

Sign in, create a key and make your first call in a minute. Free credits every month, and you only pay for calls that succeed.

Get a free API key