POST /apiv2/aml
Submit an address for AML (Anti-Money Laundering) screening. Returns risk score, risk level, and detailed exposure analysis.
Endpoint URL
POST https://netts.io/apiv2/amlRequest Headers
| Header | Required | Description |
|---|---|---|
| Content-Type | Yes | application/json |
| X-API-KEY | Yes | Your API key from Netts dashboard |
Request Body
{
"address": "YOUR_ADDRESS_HERE",
"network": "trx",
"provider": "elliptic",
"wait": true
}Parameters
| Parameter | Type | Required | Description |
|---|---|---|---|
| address | string | Yes | Blockchain address to check (10-100 characters) |
| network | string | Yes | Blockchain network identifier (see Supported Networks below) |
| provider | string | No | AML provider: elliptic (default) or bitok |
| wait | boolean | No | If true, wait for result synchronously (up to 15 seconds). If false or omitted, return immediately with pending status and client_order_id — use it to poll result via GET /apiv2/aml/{order_id} |
| response_format | string | No | Response detail level: rate (score only), full (default, complete data) |
| report_language | string | No | Language for report: en (default) |
Providers
| Provider | Score Range | Description |
|---|---|---|
elliptic | 0 — 10 | Elliptic risk score. 0 = no risk, 10 = maximum risk. null = no triggers detected |
bitok | 0 — 1.0 | BitOK percentage score. 0.0 = 0% risk, 1.0 = 100% risk |
Example Requests
cURL (synchronous)
curl -X POST https://netts.io/apiv2/aml \
-H "Content-Type: application/json" \
-H "X-API-KEY: your_api_key" \
-d '{
"address": "YOUR_ADDRESS_HERE",
"network": "trx",
"provider": "elliptic",
"wait": true
}'cURL (asynchronous)
curl -X POST https://netts.io/apiv2/aml \
-H "Content-Type: application/json" \
-H "X-API-KEY: your_api_key" \
-d '{
"address": "YOUR_ADDRESS_HERE",
"network": "trx",
"provider": "bitok"
}'Python
import requests
url = "https://netts.io/apiv2/aml"
headers = {
"Content-Type": "application/json",
"X-API-KEY": "your_api_key",
}
payload = {
"address": "YOUR_ADDRESS_HERE",
"network": "trx",
"provider": "elliptic",
"wait": True
}
response = requests.post(url, headers=headers, json=payload)
data = response.json()
if response.status_code == 200:
result = data.get("data", {})
print(f"Order ID: {result.get('client_order_id')}")
print(f"Status: {result.get('status')}")
print(f"Risk Score: {result.get('risk_score')}")
print(f"Risk Level: {result.get('risk_level')}")
print(f"Sanctioned: {result.get('is_sanctioned')}")
else:
print(f"Error: {data}")Response
Success — Pending (200 OK)
When wait is not set or check is still processing:
{
"success": true,
"data": {
"client_order_id": "A4C666ABE24BD4A",
"status": "pending",
"address": "T...example...",
"provider": "elliptic",
"price_usdt": 0.98,
"price_trx": 4.136286,
"currency": "TRX",
"message": "AML check order accepted. Use GET /apiv2/aml/A4C666ABE24BD4A to check status."
},
"timestamp": "2026-03-10 09:56:31"
}Success — Elliptic Completed (200 OK)
Full Elliptic response with all data structures:
{
"success": true,
"data": {
"client_order_id": "A019540900E55CA",
"status": "completed",
"address": "T...example...",
"provider": "elliptic",
"report_language": "en",
"risk_score": 0.802904,
"risk_level": "low",
"is_sanctioned": true,
"created_at": "2026-03-10 15:56:28",
"completed_at": "2026-03-10 15:56:28",
"result": {
"risk_score": 0.802904473154148,
"risk_score_detail": {
"source": 0.233206,
"destination": 0.802904
},
"contributions": {
"source": [
{
"entities": [
{
"name": "Capitalist",
"is_vasp": true,
"actor_id": 53979,
"category": "Payment Services Provider",
"entity_id": "b73a9c87-...",
"category_id": "54f55bfe-...",
"is_primary_entity": true
}
],
"indirect_value": { "usd": 40194.03 },
"contribution_value": { "usd": 40194.03 },
"counterparty_value": { "usd": 0 },
"min_number_of_hops": 2,
"indirect_percentage": 31.57,
"is_screened_address": false,
"contribution_percentage": 31.57,
"counterparty_percentage": 0
},
{
"entities": [
{
"name": "KuCoin",
"is_vasp": true,
"actor_id": 11620,
"category": "Exchange",
"entity_id": "e54292da-...",
"category_id": "0a52f7a2-...",
"is_primary_entity": true
}
],
"indirect_value": { "usd": 28436.45 },
"contribution_value": { "usd": 29434.17 },
"counterparty_value": { "usd": 997.72 },
"min_number_of_hops": 1,
"indirect_percentage": 22.34,
"is_screened_address": false,
"contribution_percentage": 23.12,
"counterparty_percentage": 0.78
}
],
"destination": [
{
"entities": [
{
"name": "Bybit",
"is_vasp": true,
"actor_id": 23354,
"category": "Exchange",
"entity_id": "bddde8b7-...",
"category_id": "0a52f7a2-...",
"is_primary_entity": true
}
],
"indirect_value": { "usd": 26333.43 },
"contribution_value": { "usd": 27458.30 },
"counterparty_value": { "usd": 1124.86 },
"min_number_of_hops": 1,
"indirect_percentage": 20.69,
"is_screened_address": false,
"contribution_percentage": 21.57,
"counterparty_percentage": 0.88
}
]
},
"cluster_entities": [
{
"name": "Unknown",
"is_vasp": null,
"actor_id": -4,
"category": "Unknown",
"entity_id": "00000000-...",
"category_id": "00000000-...",
"is_primary_entity": true,
"is_after_sanction_date": false
}
],
"evaluation_detail": {
"source": [
{
"rule_id": "6c2dcb03-...",
"rule_name": "Obfuscating & Misc.",
"rule_type": "exposure",
"risk_score": 0.2332,
"matched_elements": [
{
"category": "Coin Swap Service",
"category_id": "ff85b715-...",
"contributions": [
{
"entity": "FixedFloat",
"risk_triggers": {
"category": "Coin Swap Service",
"category_id": "ff85b715-..."
},
"indirect_value": { "usd": 2891.09, "native": 0, "native_major": 0 },
"contribution_value": { "usd": 2968.66, "native": 0, "native_major": 0 },
"counterparty_value": { "usd": 77.58, "native": 0, "native_major": 0 },
"min_number_of_hops": 1,
"indirect_percentage": 2.27,
"is_screened_address": false,
"contribution_percentage": 2.33,
"counterparty_percentage": 0.06
}
],
"indirect_value": { "usd": 2891.09, "native": 0, "native_major": 0 },
"contribution_value": { "usd": 2968.66, "native": 0, "native_major": 0 },
"counterparty_value": { "usd": 0, "native": 0, "native_major": 0 },
"indirect_percentage": 100,
"contribution_percentage": 2.33,
"counterparty_percentage": 0
}
],
"matched_behaviors": []
},
{
"rule_id": "0a2b68fd-...",
"rule_name": "Illicit Activity",
"rule_type": "exposure",
"risk_score": 0.0026,
"matched_elements": [
{
"category": "Token Blacklisting",
"category_id": "94b50de8-...",
"contributions": [
{
"entity": "Tether USD",
"risk_triggers": {
"category": "Token Blacklisting",
"category_id": "94b50de8-..."
},
"contribution_value": { "usd": 1022.45, "native": 0, "native_major": 0 },
"min_number_of_hops": 3,
"contribution_percentage": 0.08
}
]
}
],
"matched_behaviors": []
},
{
"rule_id": "df59fab5-...",
"rule_name": "Sanctions",
"rule_type": "exposure",
"risk_score": 0.0024,
"matched_elements": [
{
"category": "Sanctioned Entity",
"category_id": "c1648b7a-...",
"contributions": [
{
"entity": "Garantex",
"risk_triggers": {
"category": "Sanctioned Entity",
"category_id": "c1648b7a-..."
},
"contribution_value": { "usd": 863.21, "native": 0, "native_major": 0 },
"min_number_of_hops": 3,
"contribution_percentage": 0.07
}
]
}
],
"matched_behaviors": []
}
],
"destination": []
},
"detected_behaviors": []
},
"address_users": [
{
"sources": ["api_1h_response"],
"user_id": 3162
}
]
},
"timestamp": "2026-03-10 15:56:28"
}Success — BitOK Completed (200 OK)
Full BitOK response with all data structures:
{
"success": true,
"data": {
"client_order_id": "A4448368195FE7E",
"status": "completed",
"address": "T...example...",
"provider": "bitok",
"report_language": "en",
"risk_score": 0.262292,
"risk_level": "low",
"is_sanctioned": false,
"created_at": "2026-03-10 16:44:25",
"completed_at": "2026-03-10 16:44:26",
"result": {
"risk_score": 0.262292,
"risk_level": "low",
"entity_name": null,
"entity_category": null,
"exposure": [
{ "value_share": 0.711, "entity_category": "exchange" },
{ "value_share": 0.1445, "entity_category": "dust" },
{ "value_share": 0.0845, "entity_category": "unnamed_service" },
{ "value_share": 0.0218, "entity_category": "high_risk_exchange" },
{ "value_share": 0.0113, "entity_category": "gambling" },
{ "value_share": 0.0081, "entity_category": "enforcement_action" },
{ "value_share": 0.0042, "entity_category": "custodial_wallet" },
{ "value_share": 0.0038, "entity_category": "bridge" },
{ "value_share": 0.0031, "entity_category": "other" },
{ "value_share": 0.0023, "entity_category": "dex" },
{ "value_share": 0.0017, "entity_category": "lending" },
{ "value_share": 0.0014, "entity_category": "payment_service_provider" },
{ "value_share": 0.0013, "entity_category": "sanctions" },
{ "value_share": 0.0005, "entity_category": "smart_contract" },
{ "value_share": 0.0003, "entity_category": "stolen_funds" },
{ "value_share": 0.0001, "entity_category": "p2p_exchange" },
{ "value_share": 0.0001, "entity_category": "high_risk_jurisdiction" },
{ "value_share": 0.0001, "entity_category": "terrorist_financing" },
{ "value_share": 0.0, "entity_category": "scam" },
{ "value_share": 0.0, "entity_category": "privacy_protocol" },
{ "value_share": 0.0, "entity_category": "atm" },
{ "value_share": 0.0, "entity_category": "mining_pool" },
{ "value_share": 0.0, "entity_category": "seized_funds" },
{ "value_share": 0.0, "entity_category": "ransomware" },
{ "value_share": 0.0, "entity_category": "token_contract" },
{ "value_share": 0.0, "entity_category": "iaas" },
{ "value_share": 0.0, "entity_category": "fraud_shop" },
{ "value_share": 0.0, "entity_category": "illegal_service" },
{ "value_share": 0.0, "entity_category": "darknet_market" }
],
"risks": [
{
"rule": {
"rule_type": "address_exposure",
"rule_sub_type": "single_address",
"entity_category": "high_risk_exchange",
"min_value_share": 0.01,
"min_value_in_fiat": null
},
"proximity": "indirect",
"risk_type": "address_exposure",
"risk_level": "low",
"detected_at": "2026-03-10T17:54:28.387498+03:00",
"occurred_at": "2026-03-10T17:53:56.444636+03:00",
"value_share": 0.0218,
"fiat_currency": "USD",
"value_in_fiat": null,
"entity_category": "high_risk_exchange"
},
{
"rule": {
"rule_type": "address_exposure",
"rule_sub_type": "single_address",
"entity_category": "gambling",
"min_value_share": 0.01,
"min_value_in_fiat": null
},
"proximity": "indirect",
"risk_type": "address_exposure",
"risk_level": "low",
"detected_at": "2026-03-10T17:54:28.387588+03:00",
"occurred_at": "2026-03-10T17:53:56.444636+03:00",
"value_share": 0.0113,
"fiat_currency": "USD",
"value_in_fiat": null,
"entity_category": "gambling"
},
{
"rule": {
"rule_type": "address_exposure",
"rule_sub_type": "all",
"entity_category": "sanctions",
"min_value_share": 0.001,
"min_value_in_fiat": null
},
"proximity": "indirect",
"risk_type": "address_exposure",
"risk_level": "low",
"detected_at": "2026-03-10T17:54:28.387630+03:00",
"occurred_at": "2026-03-10T17:53:56.444636+03:00",
"value_share": 0.0013,
"fiat_currency": "USD",
"value_in_fiat": null,
"entity_category": "sanctions"
}
]
},
"address_users": [
{
"sources": ["api_1h_response"],
"user_id": 3162
}
]
},
"timestamp": "2026-03-10 15:44:27"
}Response Fields
| Field | Type | Description |
|---|---|---|
| data.client_order_id | string | Unique order ID for status polling |
| data.status | string | pending, processing, completed, failed, skipped |
| data.risk_score | number | null | Risk score. Elliptic: 0-10, BitOK: 0-1.0. null = no triggers |
| data.risk_level | string | low, medium, or high |
| data.is_sanctioned | boolean | true if exposure to sanctioned entities detected |
| data.result | object | Full provider response (when response_format=full) |
| data.address_users | array | Known users of this address from Netts database |
Elliptic result Object
| Field | Type | Description |
|---|---|---|
| risk_score | number | Precise risk score (0-10) |
| risk_score_detail | object | Breakdown: source and destination scores |
| contributions | object | source and destination arrays of fund flow contributors |
| contributions[].entities | array | Known entities associated with the contribution |
| contributions[].entities[].name | string | Entity name (e.g. "Binance", "KuCoin") |
| contributions[].entities[].category | string | Entity type (e.g. "Exchange", "Payment Services Provider") |
| contributions[].entities[].is_vasp | boolean | null | Whether the entity is a Virtual Asset Service Provider |
| contributions[].contribution_value.usd | number | Total USD volume of the contribution |
| contributions[].contribution_percentage | number | Percentage of total funds from this entity |
| contributions[].indirect_value.usd | number | USD volume received indirectly (via intermediaries) |
| contributions[].indirect_percentage | number | Percentage of funds received indirectly |
| contributions[].counterparty_value.usd | number | USD volume as direct counterparty |
| contributions[].counterparty_percentage | number | Percentage as direct counterparty |
| contributions[].min_number_of_hops | number | Minimum transaction hops from the entity (0 = direct) |
| contributions[].is_screened_address | boolean | true if this is the screened address itself |
| cluster_entities | array | Known entities directly associated with the address cluster |
| cluster_entities[].name | string | Entity name |
| cluster_entities[].category | string | Entity category |
| cluster_entities[].is_vasp | boolean | null | VASP status |
| cluster_entities[].is_after_sanction_date | boolean | true if activity occurred after entity was sanctioned |
| evaluation_detail | object | source and destination arrays of triggered risk rules |
| evaluation_detail[].rule_name | string | Rule name (e.g. "Sanctions", "Illicit Activity", "Obfuscating & Misc.") |
| evaluation_detail[].rule_type | string | Rule type (e.g. "exposure") |
| evaluation_detail[].risk_score | number | Risk score contribution from this rule |
| evaluation_detail[].matched_elements | array | Categories and entities that triggered the rule |
| evaluation_detail[].matched_elements[].category | string | Risk category (e.g. "Sanctioned Entity", "Gambling", "Token Blacklisting") |
| evaluation_detail[].matched_elements[].contributions | array | Entities within the matched category |
| evaluation_detail[].matched_elements[].contributions[].entity | string | Entity name |
| evaluation_detail[].matched_elements[].contributions[].contribution_percentage | number | Exposure percentage |
| evaluation_detail[].matched_elements[].contributions[].min_number_of_hops | number | Transaction hops |
| evaluation_detail[].matched_behaviors | array | Detected behavioral patterns |
| detected_behaviors | array | Global behavioral patterns detected on the address |
BitOK result Object
| Field | Type | Description |
|---|---|---|
| risk_score | number | Risk score as decimal (0.0 - 1.0, where 1.0 = 100% risk) |
| risk_level | string | low, medium, or high |
| entity_name | string | null | Known entity name associated with the address |
| entity_category | string | null | Category of the known entity |
| exposure | array | Full breakdown of fund sources by category |
| exposure[].value_share | number | Fraction of total funds (0.0 - 1.0). Multiply by 100 for percentage |
| exposure[].entity_category | string | Category name (see BitOK Categories) |
| risks | array | Triggered risk rules |
| risks[].entity_category | string | Category that triggered the rule |
| risks[].risk_level | string | low, medium, high, or severe |
| risks[].proximity | string | direct or indirect — whether exposure is from direct interaction or through intermediaries |
| risks[].value_share | number | Fraction of total funds for this risk |
| risks[].risk_type | string | Type of risk check (e.g. "address_exposure") |
| risks[].rule | object | Rule definition that was triggered |
| risks[].rule.rule_type | string | Rule type (e.g. "address_exposure") |
| risks[].rule.rule_sub_type | string | single_address or all |
| risks[].rule.min_value_share | number | Minimum threshold that triggered the rule |
| risks[].detected_at | string | ISO 8601 timestamp when the risk was detected |
| risks[].occurred_at | string | ISO 8601 timestamp of the underlying transaction |
BitOK Exposure Categories
| Category | Description |
|---|---|
exchange | Centralized exchanges (Binance, Coinbase, etc.) |
high_risk_exchange | Exchanges with weak KYC/AML policies |
dex | Decentralized exchanges |
p2p_exchange | Peer-to-peer trading platforms |
gambling | Gambling and betting services |
sanctions | OFAC/EU sanctioned entities |
stolen_funds | Known stolen cryptocurrency |
ransomware | Ransomware-related addresses |
darknet_market | Darknet marketplace activity |
terrorist_financing | Terrorist financing related |
scam | Known scam addresses |
fraud_shop | Fraud-related services |
illegal_service | Other illegal services |
enforcement_action | Law enforcement related |
seized_funds | Funds seized by authorities |
high_risk_jurisdiction | High-risk geographic jurisdictions |
privacy_protocol | Mixers, tumblers, privacy coins |
bridge | Cross-chain bridge protocols |
lending | DeFi lending protocols |
smart_contract | Smart contract interactions |
token_contract | Token contract activity |
payment_service_provider | Payment processors |
custodial_wallet | Custodial wallet services |
mining_pool | Mining pool payouts |
atm | Crypto ATM transactions |
iaas | Infrastructure-as-a-Service |
dust | Dust transactions (very small amounts) |
unnamed_service | Unidentified services |
other | Uncategorized activity |
Key Differences: Elliptic vs BitOK
| Aspect | Elliptic | BitOK |
|---|---|---|
| Score range | 0 — 10 (float) | 0 — 1.0 (fraction, multiply by 100 for %) |
| Flow direction | Separate source (incoming) and destination (outgoing) analysis | Single combined exposure view |
| Entity detail | Named entities with actor IDs, UUIDs, VASP status | Category-level aggregation only |
| Hop tracing | min_number_of_hops per entity (0 = direct) | proximity: direct or indirect |
| Risk rules | evaluation_detail with named rules: "Sanctions", "Illicit Activity", "Obfuscating & Misc." | risks array with triggered rule objects and thresholds |
| Cluster info | cluster_entities — entities directly associated with the address | Not available |
| USD volumes | contribution_value.usd, indirect_value.usd, counterparty_value.usd per entity | Not available (percentages only) |
Risk Levels
Elliptic (0-10 scale):
| Range | Level | Description |
|---|---|---|
| 0 — 3 | low | Minimal risk. No significant exposure |
| 3 — 7 | medium | Moderate risk. Some risky categories detected |
| 7 — 10 | high | High risk. Sanctioned, illicit, or high-risk entities |
| null | - | No risk triggers detected |
BitOK (0-1.0 scale):
| Range | Level | Description |
|---|---|---|
| 0 — 0.3 | low | Low risk. Mostly clean exposure |
| 0.3 — 0.7 | medium | Medium risk. Notable high-risk exposure |
| 0.7 — 1.0 | high | High risk. Illicit, sanctioned, or darknet entities |
Error Responses
Authentication Error (401)
{
"detail": {
"code": -1,
"msg": "API key not provided"
}
}Validation Error (400)
{
"success": false,
"error": {
"code": 4001,
"msg": "Invalid or missing address"
}
}{
"success": false,
"error": {
"code": 4002,
"msg": "Invalid provider. Use: elliptic, bitok"
}
}Insufficient Balance (402)
{
"success": false,
"error": {
"code": 4020,
"message": "Insufficient balance"
},
"timestamp": "2026-03-10 10:00:00"
}Provider Unavailable (503)
{
"success": false,
"error": {
"code": 5030,
"message": "Provider elliptic not available"
},
"timestamp": "2026-03-10 10:00:00"
}Error Code Reference
| Code | Description | HTTP Status |
|---|---|---|
-1 | Authentication failed | 401 |
4001 | Invalid or missing address | 400 |
4002 | Invalid provider | 400 |
4020 | Insufficient balance | 402 |
5030 | Provider unavailable | 503 |
Rate Limits
The following rate limits apply to all AML endpoints (per IP address):
| Period | Limit | Description |
|---|---|---|
| 1 second | 2 requests | Maximum 2 requests per second |
| 1 minute | 30 requests | Maximum 30 requests per minute |
Rate Limit Exceeded (429)
{
"message": "API rate limit exceeded"
}Result Caching
If the same address + provider combination was checked within the last 60 seconds, the cached result is returned at no charge.
Supported Networks
The network parameter is required. Use the ticker from the table below.
Elliptic — Holistic Screening
Screening is performed for a specific address on a specific network. However, Elliptic traces all assets associated with that address — including tokens, cross-chain transfers, and interactions with known entities across other networks.
| Network | Ticker | Native Asset |
|---|---|---|
| Algorand | algo | ALGO |
| Aptos | apt | APT |
| Arbitrum | arb | ETH |
| Avalanche (C-Chain) | avax | AVAX |
| Base | base | ETH |
| Binance Chain | bnb | BNB |
| Binance Smart Chain | bsc | BNB |
| Bitcoin | btc | BTC |
| Bittensor | tao | TAO |
| Cardano | ada | ADA |
| Celo | celo | CELO |
| Cosmos | atom | ATOM |
| Crypto.com | cro | CRO |
| Dogecoin | doge | DOGE |
| dYdX | dydx | DYDX |
| Ethereum | eth | ETH |
| Ethereum Classic | etc | ETC |
| Fantom | ftm | FTM |
| Filecoin | fil | FIL |
| Flare | flr | FLR |
| Gnosis | gnosis | xDai |
| Hedera | hbar | HBAR |
| HyperEVM | hype | HYPE |
| Injective | inj | INJ |
| Internet Computer | icp | ICP |
| Linea | linea | LINEA |
| Litecoin | ltc | LTC |
| MobileCoin | mob | MOB |
| Near | near | NEAR |
| Optimism | op | ETH |
| Polkadot | dot | DOT |
| Polygon | matic | MATIC |
| Ripple | xrp | XRP |
| Sei | sei | SEI |
| Solana | sol | SOL |
| Starknet | strk | STRK |
| Stellar | xlm | XLM |
| Sui | sui | SUI |
| Tezos | xtz | XTZ |
| TON | ton | TON |
| Tron | trx | TRX |
| XDC | xdc | XDC |
| XLayer | okb | OKB |
| Zilliqa | zil | ZIL |
| zkSync | zksync | ETH |
Single Asset Screening
These networks support individual address/transaction screening:
| Network | Ticker | Native Asset |
|---|---|---|
| Bitcoin Cash | bch | BCH |
| Horizen | zen | ZEN |
| ZCash | zec | ZEC |
BitOK
BitOK supports 5 networks:
| Network | Ticker | Native Asset |
|---|---|---|
| Tron | trx | TRX |
| Ethereum | eth | ETH |
| Bitcoin | btc | BTC |
| Binance Smart Chain | bsc | BNB |
| Litecoin | ltc | LTC |
Provider & Network Compatibility
When using provider: "elliptic" — all networks from Holistic and Single Asset tables are available (47 networks). When using provider: "bitok" — only TRX, ETH, BTC, BSC, LTC are supported. If an unsupported network is passed, the API returns error code 4001.
Notes
- Pricing: Elliptic — $0.98 per check, BitOK — $0.50 per check. Prices shown in TRX at current rate
- Sync timeout:
wait: truewaits up to 15 seconds. If check takes longer, returnspendingstatus - Processing time: Most checks complete within a few seconds. However, some requests (especially for addresses with complex transaction history) may take up to 3 minutes to process. Use asynchronous mode (omit
waitor setwait: false) and poll via GET /apiv2/aml/{order_id} for such cases - Inactive addresses: Addresses with no blockchain activity return
skippedstatus at no charge