# API documentation Source: https://docs.trmlabs.com/api-reference Access documentation for the API products linked to your account, or browse public Sanctions and Chainabuse documentation. ## Your API documentation ## Search and assistant answers The AI assistant answers based on the documentation you have access to, including documentation for the API products linked to your account. ## Public documentation These documentation sets are available without logging in: Request access to the free Sanctions and Beacon Network API. Read the public Chainabuse API documentation. # Contribute Reports Source: https://docs.trmlabs.com/api/chainabuse/reports/contribute-reports /specs/chainabuse-openapi.yaml post /reports/batch # Get Reports Source: https://docs.trmlabs.com/api/chainabuse/reports/get-reports /specs/chainabuse-openapi.yaml get /reports # Get Single Report Source: https://docs.trmlabs.com/api/chainabuse/reports/get-single-report /specs/chainabuse-openapi.yaml get /reports/{reportId} # Check a Sanctioned Address Source: https://docs.trmlabs.com/api/chainabuse/sanctions/check-a-sanctioned-address /specs/chainabuse-openapi.yaml get /sanctioned-addresses/{address} # Alert the space Source: https://docs.trmlabs.com/guides/chainabuse/alerting-the-space-1 ### Need Web3 users lack a go-to place to alert the crypto space on scams to (A) stop scammers from harming additional victims and (B) facilitate stolen funds recovery. ### How Chainabuse API helps Partners alert the space in real-time Chainabuse **Post Report API** allows users to report scams across different blockchains while having a concrete impact. This reported information is leveraged in real-time to alert Chainabuse's Partners: * Law Enforcement Agencies * Leading crypto organizations, such as wallets, exchanges, and other institutions seeking to protect their users and community * Trusted investigative partners that can assist victims * Any web3 user who wishes to leverage Chainabuse to verify addresses and domains What is more, this information is leveraged to help link multiple reports of the same scam together and increase chances that funds can be recovered. 1. User reports malicious addresses and/or domains in bulk using the Post Report API. 2. Chainabuse will return immediate risk indicators to any user who leverages the Chainabuse API to verify those addresses or domains before signing a transaction. 3. Chainabuse will return reports immediately to any Law Enforcement Partner investigating a linked case. 4. If those scams target a Chainabuse Partner's community, the Partner will be alerted in real-time. 5. In addition, Chainabuse is a member of the Beacon Network, the first public-private communication network to accelerate the recovery of stolen crypto funds. ### Additionnal information Please reach out to [hello@chainabuse.com](mailto:hello@chainabuse.com) for any additional information. # Contact Source: https://docs.trmlabs.com/guides/chainabuse/contact ### Email If you have questions or feedback about using the Chainabuse API, please contact us at **[support@chainabuse.com](mailto:support@chainabuse.com)**. Please note that Chainabuse Partners have access to a dedicated support address as they join. Please include any relevant screenshots and API response codes if you encounter an API error. This ensures our team can help as quickly as possible! # Error handling Source: https://docs.trmlabs.com/guides/chainabuse/error-handling Chainabuse uses conventional HTTP response codes to indicate the success or failure of an API request. In general: Codes in the 2xx range indicate success. Codes in the 4xx range indicate an error that failed given the information provided (e.g., a required parameter was omitted, etc.). Codes in the 5xx range indicate an error with Chainabuse's servers (these are rare). The Chainabuse API uses the following error codes:
Error code Meaning
400 Bad Request -- Your request is invalid.
401 Unauthorized -- Your API key is wrong.
404 Not Found -- The specified resource could not be found.
405 Method Not Allowed -- You tried to access an object with an invalid method.
406 Not Acceptable -- You requested a format that isn't JSON.
429 Too Many Requests -- You have exceeded your rate limit. See below for details on handling rate limits.
500 Internal Server Error -- We had a problem with our server. Try again later.
503 Service Unavailable -- We're temporarily offline for maintenance. Please try again later.
# API construction Source: https://docs.trmlabs.com/guides/chainabuse/error-handling-1 The Chainabuse API is organized around [REST](https://en.wikipedia.org/wiki/Representational_state_transfer). Our API has predictable resource-oriented URLs, accepts form-encoded request bodies, returns JSON-encoded responses, and uses standard HTTP response codes, authentication, and verbs. You can view code examples in our Recipe section. # Screening addresses Source: https://docs.trmlabs.com/guides/chainabuse/get-reports-parameters The\*\* **Get Reports API** allows users to screen addresses and URLs to verify whether they have been reported as linked to malicious activity on Chainabuse. *** # Submit one or more crypto addresses to be screened through the Get Reports API If the address has been reported, Chainabuse returns the relevant report(s) and specific additional risk indicators and indicators of compromises they contain - more on the indicators in the response example below. ## Authentication API key to authorize requests. Enter your organization's API key in both the Username and Password fields below to authorize. HTTP Authorization Scheme: basic ## Request REQUEST BODY SCHEMA: application/JSON
Query parameters Type Description
address mandatory (for this use case) Crypto address to be used as a filter to retrieve reports
trusted optional * True: reported by a trusted contributor, based on how this Partner does detect and verifies information * False: the reporter is not registered as a trusted contributor. Please note this does not mean their report cannot be trusted. It means we can now testify it.
checked optional * True: report checked by our team of moderators including blockchain intelligence experts * False: report could not be verified by our team of moderators.
chain optional Blockchain as an optional filter
category optional Scam category as an optional filter
orderByDirection optional If several reports are pulled out, option to order them by the latest/oldest report.
orderByField optional Ordering reports by date if several reports are pulled out
before optional Threshold date as an optional filter
since optional Start date to use as an optional filter
page optional The maximum number of pages of reports to pull out. The maximum number of reports per page is 50. If page =1, you will pull out a maximum of 50 reports
perPage optional Number of reports to display per page. The maximum number of reports per page is 50. If page =1, you will pull out a maximum of 50 reports.
## Retrieved information List of relevant reports including the screened address(es) and: ### For each report: * Reported scammer's address(es) * Reported scammer's domain,(s), if included * Scam category * Reported date * Report ID * Description * Confidence score ### If reported * Scammer's information - such as Twitter handle, email, or other IOC. * Reported loss. * Token ID (NEW!) The victim's personal information (such as email) and other information is never made available for security and privacy purposes. # Authentication Source: https://docs.trmlabs.com/guides/chainabuse/getting-started The Chainabuse API uses Basic Authentication to authenticate requests. ### Generate your API key You can generate your API key by **logging in and navigating your profile (top right of the navigation bar) > View Profile > Settings > API key.** ### Authenticate Once you have your API key, enter your organization's API key in both the Username and Password fields to authorize under the **API section** right here: [https://docs.chainabuse.com/reference/reports-1](https://docs.chainabuse.com/reference/reports-1) **HTTP Authorization Scheme**: `basic` # Request limits and rate Source: https://docs.trmlabs.com/guides/chainabuse/getting-started-2-1 This page will help you get started with chainabuse. You'll be up and running in a jiffy! ### Request limits - for every user * Every Chainabuse user can generate a standard API Key with a usage limit of 10 calls per month (1 call= maximum of 50 reports) to help users stay safe and enable them to check blockchain addresses and domains before signing a potentially dangerous transaction. Users can also use the Search bar on the Chainabuse platform to check whether crypto addresses and websites have been reported. * Law Enforcement has access to specific API filters and can retrieve data (such as victim's location, evidence, scammer's IP addresses, social media handles, private reports not visible on the website and much more) only available to Law Enforcement. Please reach out here: [https://www.chainabuse.com/partner-contact](https://www.chainabuse.com/partner-contact) to request access * Partners have access to premium access. Please reach out here: [https://www.chainabuse.com/partner-contact](https://www.chainabuse.com/partner-contact) to request access. ### Accessing more API calls - Partner Access. Please reach out here: [https://www.chainabuse.com/partner-contact](https://www.chainabuse.com/partner-contact) to request access. Please use your professional email for security reasons. * Speed limit: max 5,000 calls/ hour. * Response time: P50 75ms, P95 607ms. * Looking to access a Sanctions API? [Request access to TRM's free Sanctions and Beacon Network API](/guides/sanctions/introduction). # Enhance protection Source: https://docs.trmlabs.com/guides/chainabuse/informing-product ### Need Teams working on security and safety features or simply offering products to their customers need access to a reliable database of malicious crypto addresses and URLs in order to, for example, enhance their detection capabilities. ### How Chainabuse API supports product safety teams Chainabuse Get Report API supports security teams in detecting risks and threats. 1. Users leverage Chainabuse Get Report API to check specific addresses and domains reported as malicious. 2. Chainabuse returns immediate associated reports, including their full description and any additional information, such as scammer Indicator of Compromise, scam category, and the amount lost. 3. Teams can use this intelligence to build their security features. Chainabuse can provide specific access to the API to allow users to retrieve reports without having to screen specific URLs/ domains - for example, to retrieve reports during a date range upon request. ### Additionnal information Please contact [hello@chainabuse.com](mailto:hello@chainabuse.com) for any additional information, including detailed information on our database. # Law Enforcement Partners Source: https://docs.trmlabs.com/guides/chainabuse/law-enforcement-partners Chainabuse Law Enforcement Partners have a dedicated API access to: * Support local victims at scale: search one of the largest fraud and scam victim reporting databases using filters to identify relevant local victim reports. * Identify reports linked to your investigation. * Understand trends of threats in your jurisdiction. * And much more Reach out here [https://www.chainabuse.com/partner-contact](https://www.chainabuse.com/partner-contact) to request it. *** Moreover, Law Enforcement agencies have access to specialized tools within the Chainabuse Pro software, provided by [TRM Labs](https://www.trmlabs.com/), which enable them to assist a large number of victims effectively and securely. Access **enriched** reports data and: * Generate quality local leads faster. * Accelerate ongoing investigations: find reports linked to current investigations and contact opt-in victims to learn more and reach the prosecutorial threshold. * Identify cases with higher impact potential: find high-seizure potential cases involving known entities and numerous linked victim reports to uncover isolated incidents that are part of a major case. * Identify perpetrators within your jurisdiction. For more information, kindly complete the brief form available [here](https://www.chainabuse.com/partner-contact), and we will get back to you as soon as possible. # Offer instant scam support Source: https://docs.trmlabs.com/guides/chainabuse/offering-scam-support ### Need Victims of malicious crypto activity lack a go-to place to get immediate, honest support on their case, including advice on what to do immediately, support to contact law enforcement, and options on what to do next, including recovering funds. ### How Chainabuse helps Partners offer instant scam support to their users seamlessly within their product 1. User of a Chainabuse's Partner wants to report a scam. They visit Partner's Support Page and click on "Report a Scam" 2. User can learn more about Chainabuse before deciding whether they want to self-report 3. User click on "Report a scam" and can immediately report a scam on Chainabuse. User enters their case details and opts-in to receive immediate advice. As an option, user can share their contact details with Law Enforcement. 4. User receives immediate advice based on their case, including advice on what to do immediately to protect themselves from further harm, including asset recovery scammers, personalized support to contact LE, optional investigative support when relevant. 5. User can access additional personalized information based on their case - preventive education, safety practices, and recovery insights on Chainabuse's Safety Support Center. ### Additionnal information Please reach out to [hello@chainabuse.com](mailto:hello@chainabuse.com) for any additional information, including sanitized examples of how Partners allow users to report scams seamlessly on Chainabuse. # Reporting Source: https://docs.trmlabs.com/guides/chainabuse/post-reports-parameters The **reports/batch/POST Reports API** empowers Partners to report malicious addresses and/or domains programmatically in bulk to alert the space. # Mandatory body parameters ### if reporting an address * Address * Scam Category * Description * Chain ### if reporting a domain * URL * Scam Category * Description # Optional fields input * Reported loss * Evidence such as screenshots * Compromise indicators such as IP address * Token ID (NEW!) * Scammer's known contact information, such as Twitter handle or email. * Reporter agrees to be contacted by Law Enforcement * Reporter agrees to be contacted by Chainabuse - e..g., if a group action is to take place on this case or our investigative partner wants to take on the case # Bring safety to users Source: https://docs.trmlabs.com/guides/chainabuse/protecting-users ### Need Web 3 users often do not have time or resources to check addresses or URLs before signing a transaction. This presents a risk of exposure to numerous hacks, thefts, fraud, and blackmail scams. In the meantime, to protect their users, organizations need to access a comprehensive database of malicious blockchain addresses and URLs in real time across chains. ### How Chainabuse API supports wallets, payment providers, block explorers, and other B2C partners to bring safety to their users. Chainabuse Get Report API helps wallets and payment providers screen **addresses and URLs** to verify whether they have been reported as malicious to either alert their users before they sign a dangerous transaction or pre-block the transaction. A user is about to sign a transaction. 1. Before the user signs the transaction, the wallet or payment provider performs a test: it screens the URL and the address the user is about to transact with, consuming Chainabuse's direct **Get Report Screening API** 2. The provider can filter the information they receive based on the confidence score, e.g., only retrieve reports that Chainabuse's blockchain intelligence expert team has verified. 3. Suppose the URL and address have been reported as linked to malicious activity. In that case, Chainabuse will immediately return reports and specific risk indicators and indicators of compromises they contain. 4. The wallet or payment provider can 1. Pre-block the transaction, with the option to explain to their users why it was pre-blocked, leveraging the information from Chainabuse. 2. Alert their users, with the option to give users details on why they are being alerted, displaying information shared by Chainabuse (such as type of scams, number of reports, and the amount already lost), and letting them decide if they want to proceed. ### Additionnal information Please reach out to [hello@chainabuse.com](mailto:hello@chainabuse.com) for any additional information, including: * Sanitized examples of how our Partners leverage Chainabuse's API to protect their users in real-time * Which information they choose to display to their users - non-prescriptive, Chainabuse only provides those examples to help Partners. # Protecting users information Source: https://docs.trmlabs.com/guides/chainabuse/protecting-users-information Users publish reports with the username of their choice or choose to report as a guest. In addition: * All the **information shared by users within reports focuses exclusively on the scammer’s information**\*\* - such as the scammer’s wallet address, domain, and email. It does not include information about the victim. * Users report information about their cases voluntarily. * Chainabuse never publishes users’ information or shares it as part of its API. Chainabuse does not collect users’ personal information. The only exception to that is: * If the user voluntarily uses the email of their choice to log in. * If the user opts in to be contacted by Law Enforcement, they will be asked to provide their name, location, and email voluntarily. * If the user opt-ins to receive support on their case, they will be asked to share their email so Chainabuse can contact them to provide support. * Chainabuse does not share nor sell any user personal information with third parties without prior explicit consent from the user. Chainabuse may use aggregated and anonymized user information to understand how the platform is used and improve the user experience and effectiveness. You can find our privacy terms here: [https://www.trmlabs.com/policies/privacy-policy](https://www.trmlabs.com/policies/privacy-policy). # Malicious activity - 'Scam' Categories Source: https://docs.trmlabs.com/guides/chainabuse/scam-categories Chainabuse collects information across 16 self-reported categories of malicious crypto activity. You can find their full description on this page: [https://www.chainabuse.com/glossary](https://www.chainabuse.com/glossary). * Blackmail - Sextortion * Blackmail - Ransomware * Other blackmail * Fraud - NFT Airdrop scam * Fraud - Donation Impersonation scams * Fraud - Impersonation scams * Fraud - Other Phishing scams * Fraud - Romance scams * Fraud - Pig Butchering scam * Investment scams - Fake Project scam * Investment scams - Fake Returns scam * Investment scams - Rul Pull scam * Other Fraud scams * Hacks - Sim Swap * Hacks - Contract Exploits * Other Hacks # Screening domains Source: https://docs.trmlabs.com/guides/chainabuse/screening-domains The\*\* **Get Reports API** allows users to screen addresses and URLs to verify whether they have been reported as linked to malicious activity on Chainabuse. *** # Submit one or more crypto URL(s) to be screened through the Get Reports API If the domain has been reported, Chainabuse returns the relevant report(s) and specific additional risk indicators and indicators of compromises they contain - more on the indicators in the response example below. ## Authentication API key to authorize requests. Enter your organization's API key in both the Username and Password fields below to authorize. HTTP Authorization Scheme: basic ## Request REQUEST BODY SCHEMA: application/JSON
Query parameters Type Description
address mandatory (for this use case) Entering a URL to be screened
Trusted contributor optional * True: reported by a trusted contributor, based on how this Partner does detect and verifies information * False: the reporter is not registered as a trusted contributor. Please note this does not mean their report cannot be trusted. It means we can now testify it.
Checked optional * True: report checked by our team of moderators, including blockchain intelligence experts * False: report could not be verified by our team of moderators.
chain optional You can leave it empty when screening a domain
category optional Scam category as an optional filter
orderByDirection optional If several reports are pulled out, option to order them by the latest/oldest report.
orderByField optional Ordering reports by date if several reports are pulled out
before optional Threshold date as an optional filter
since optional Start date to use as an optional filter
page optional The maximum number of pages of reports to pull out. The maximum number of reports per page is 50. If page =1, you will pull out a maximum of 50 reports
perPage optional Number of reports to display per page. The maximum number of reports per page is 50. If page =1, you will pull out a maximum of 50 reports.
## Retrieved information List of relevant reports, including the screened URL(s) and: ### For each report: * Reported scammer's URL(s) * Reported scammer's addresse(s), if included * Scam category * Reported date * Report ID * Description * Confidence score ### If reported * Scammer's information - such as Twitter handle, email, or other IOC. * Reported loss. * Token ID (NEW!) The victim's personal information (such as email) is never made available for security and privacy purposes. # Looking up one specific report Source: https://docs.trmlabs.com/guides/chainabuse/searching-for-scam-reports The **Get Reports ID API** allows users to retrieve a specific report using its ID. ## Authentication API key to authorize requests. Enter your organization's API key in both the Username and Password fields below to authorize. HTTP Authorization Scheme: basic ## Request REQUEST BODY SCHEMA: application/JSON
Query parameters Type Description
Id mandatory ReportID
## Retrieved information ### Report, including: * Reported scammer's URL(s), if reported * Reported scammer's addresse(s), if reported * Scam category * Reported date * Report ID * Description * Confidence score ### If reported * Scammer's information - such as Twitter handle, email, or other ICO * Reported loss The victim's information (such as email) is never made available. # Source of information Source: https://docs.trmlabs.com/guides/chainabuse/source-of-information ## Chainabuse Trusted Network Chainabuse powers the largest trust Network worldwide as we enable our pre-vetted Partners: * Trust and safety detection solutions powered by security experts * Leading Investigators as well as victims of scams, to report the following information voluntarily and in a structured, actionable way: * Domains/URLs/ websites associated with malicious crypto activity * Crypto addresses associated with scams - contracts or wallet address * IP addresses, social media handles associated, and other Indicators of Compromise associated with scammers. Chainabuse does verify the reported information to assess a confidence score for each report. This confidence score can be used as a filter when using the API - you can decide only to use reports with a certain confidence score. For more information, please check the section "Accuracy of information." For more information, please reach out to **[hello@chainabuse.com](mailto:hello@chainabuse.com)**. # Supported Blockchain list Source: https://docs.trmlabs.com/guides/chainabuse/supported-blockchain-list See below for the list of the blockchains supported by Chainabuse for both screening and reporting/ contributing. If you do not see your blockchain here, please email us at [support@chainabuse.com](mailto:support@chainabuse.com) with a request.
Blockchain Chainabuse Identifier
Bitcoin `BTC`
Binance Smart Chain `BINANCE`
Cardano `CARDANO`
Ethereum `ETH`
Hedera `HBAR`
Litecoin `LITECOIN`
Polygon `POLYGON`
Solana `SOL`
Tron `TRON`
Avalanche `AVAX`
MultiversX `MultiversX`
Arbitrum `Arbitrum`
# Spam detection and reports acuracy Source: https://docs.trmlabs.com/guides/chainabuse/verifying-the-accuracy-of-reported-information ## Parameters to filter information Chainabuse Blockchain intelligence team prevents reporting of spam, reviews every report against spam, and attributes a confidence score to every report. **1/ Spam prevention** Chainabuse maintains a 'SAFELIST' of blockchain addresses and URLs that users may confuse with scams but are not scams and cannot be reported as such. **2/ Spam detection** Chainabuse Blockchain intelligence team reviews reports against spam to ensure our platform remains a safe place for every user. Spam is removed. Users deliberately trying to post spam are banned. **3/ Confidence score** When verifying reports, Chainabuse Blockchain intelligence team attributes a confidence score to every report. This score can be leveraged as a filter or simply retrieved when using our API. **’ Trusted Contributor’ Badge/score** The blue ‘Trusted Contributor’ badge means that this report was filed by a pre-vetted partner from the Web3 Security Network, who can attest to the information provided on the report. **’ Checked Report’ Badge/score** The green ‘Checked by Chainabuse’ badge indicates that our team of moderators, including blockchain intelligence experts specializing in identifying crypto crime, checked the report, using specific criteria based on the type of scam and the blockchain and have enough evidence (including evidence which is not shared publicly for security reasons) to believe it is accurate. Please note that there can be no guarantee that the information is 100% accurate. **’Unverified Report’ Badge** The “Not Verified Report” Badge means that this report has not been shared by a Trusted Contributor and could not be verified by our blockchain intelligence experts. It does not mean it is spam, else it would have been removed, but we recommend that you use it with caution. When using the API, you can filter reports using badges, e.g., only see reports shared by Trusted Contributors and that have been verified by our team of blockchain intelligence experts. \*\***4/ Additional verifications** Chainabuse allows users to flag potential spam or false reports. Flagged reports are reviewed by the Global Investigations team of TRM, composed of former agents from the FBI, U.S. Secret Service, IRS-CI, and others who specialize in identifying crypto crime removed if deemed to be spam reports. # Chainabuse Public API (v1.2) Source: https://docs.trmlabs.com/guides/chainabuse/welcome-to-chainabuse-api Email: [hello@chainabuse.com](mailto:hello@chainabuse.com) | License: Proprietary API. # Welcome to the Chainabuse API **Overview**\ Chainabuse is on a mission to make web3 safer for all. We power the largest multi-chain, reliable, real-time database of malicious crypto activity worldwide across 16 categories of malicious crypto activity. Those specific scams and their associated information can be hard to detect simply using AI/ML and are better identified when reported by victims and expert investigators. Our API enables you to check whether URLs or addresses have been reported as malicious in real-time. This can be used, for example, to enhance safety. **Can all the information from Chainabuse be retrieved using our API?** Please note that for security reasons, not all reported information is made available through our API (such as evidence, geolocation, and contact information). This information is only made available to our pre-vetted Partners -pending on the user's opt-in- through Chainabuse Pro. Chainabuse Pro is a gated software module that helps investigators accelerate triaging and investigation of cases and enhances fraud detection by leveraging Chainabuse's enriched data. For more information on Chainabuse Pro, please contact [hello@chainabuse.com](mailto:hello@chainabuse.com). **Chainabuse Data sources:** Chainabuse empowers victims worldwide to report crypto crimes and opt-in to receive free instant-advice support on their case. The more victims report, the more Chainabuse can help link multiple reports of the same scam and increase the chances that funds can be recovered. What is more, our network of security partners: top investigators, and security providers also report malicious activity, including scammer's IOCs. **Data reliability:** Chainabuse does have a spam detection system and provides a confidence score to reports. When you leverage the API, you can filter the information based on whether it has been verified. You can find information about our spam detection system [here](https://docs.chainabuse.com/docs/verifying-the-accuracy-of-reported-information). **Using the Chainabuse API, you can:** 1. Verify whether crypto addresses - contracts or wallets - and URLs have been reported as malicious. * If that is the case, you will see the number of times the blockchain address or URL has been reported, including the report's public information - scammer's information, public description of the case, the amount lost, and more - as well as the confidence score of the report. 2. Report URLs, blockchain addresses, and token IDs linked to malicious activity to make the space safer. Chainabuse provides the following API endpoint categories to its customers:
API Category Description
**Get Report** Screening Enables Partners to continuously check whether specific blockchain addresses (contracts or wallets), token IDs, or URLs have been reported as malicious.
**Post Report** Reporting Allows users to create reports in batch to report addresses and/or domains that are malicious.
**Get Report ID** Looking up Enables users to access a specific scam report using its ID number.
# Connect Your AI Agent to TRM API Docs Source: https://docs.trmlabs.com/guides/resources/how-to Give Claude, Cursor, Codex, VS Code, and other MCP clients authenticated access to current TRM API documentation and implementation workflows. TRM API Docs is agent-ready. Connect the authenticated TRM API Docs MCP server once, then ask your coding agent to find current API contracts, answer implementation questions, and help build TRM API integrations in your workspace. The TRM API Docs MCP server also exposes a Compliance API integration skill that helps your agent build multi-step workflows, such as withdrawal flows and webhook integrations. The connection gives your agent two complementary sources of TRM guidance: | Capability | What your agent receives | How it helps | | - | - | - | | **Search with your agent** | Search and full-page access to the API reference and implementation guides available to your TRM Docs account | Grounds answers and generated code in current request schemas, responses, authentication, errors, and operational guidance | | **Build integrations faster** | Skills are exposed as MCP resources, including common Compliance API scenarios | Helps the agent combine individual APIs into complete workflows such as deposits and withdrawals | ## How it works Add the authenticated TRM API Docs MCP server to Claude, Cursor, Codex, VS Code, or another compatible agent. Your agent opens the TRM API Docs sign-in page in a browser. Sign in, then follow the redirect back to your agent. For your prompt, the agent reads a matching skill resource and retrieves the minimum current API pages and guides. Your coding agent uses the retrieved contracts and skill instructions to generate or modify code, add tests, and report assumptions or missing choices. ## Connect your agent Use the authenticated MCP endpoint: ```text theme={null} https://docs.trmlabs.com/authed/mcp ``` Choose your client and complete the one-time setup. Authentication is client-specific. Follow the authentication step in your client tab below to open the TRM API Docs sign-in flow in your browser. Add TRM API Docs at user scope so it is available across projects: ```bash theme={null} claude mcp add --transport http --scope user trm-api-docs https://docs.trmlabs.com/authed/mcp ``` To authenticate from within Claude Code, start Claude Code and enter: ```text theme={null} /mcp ``` Select `trm-api-docs`, then select **Authenticate**. Alternatively, trigger authentication directly from your terminal: ```bash theme={null} claude mcp login trm-api-docs ``` Either method opens the TRM API Docs sign-in flow in your browser. `claude mcp login` must run in an interactive terminal. In a non-interactive or CI shell it fails with `stdin isn't a terminal` — authenticate once interactively (or use `/mcp` inside Claude Code), then reuse the stored credentials. Confirm that the server is configured: ```bash theme={null} claude mcp get trm-api-docs ``` See the [Claude Code MCP documentation](https://docs.anthropic.com/en/docs/claude-code/mcp) for client-specific options. For an individual Claude account: 1. Open **Customize → Connectors**. 2. Select **Add custom connector**. 3. Enter `TRM API Docs` as the name and `https://docs.trmlabs.com/authed/mcp` as the URL. 4. Add the connector, then select **Connect** to open the TRM API Docs sign-in flow in your browser. 5. After signing in, enable **TRM API Docs** for your conversation from the connectors menu. On Claude Team and Enterprise plans, an Owner or Primary Owner must first add the custom connector under **Organization settings → Connectors**. Each user then connects their own TRM API Docs account. See [Claude custom connectors](https://support.claude.com/en/articles/11175166-get-started-with-custom-connectors-using-remote-mcp) for plan-specific instructions. Add the server to your global `~/.cursor/mcp.json` file: ```json theme={null} { "mcpServers": { "trm-api-docs": { "url": "https://docs.trmlabs.com/authed/mcp" } } } ``` Save the file. Then trigger authentication using either option: * **Cursor IDE:** Open Cursor's MCP settings, find `trm-api-docs`, and select **Connect**. * **Cursor Agent CLI:** Run: ```bash theme={null} cursor-agent mcp login trm-api-docs ``` Either action opens the TRM API Docs sign-in flow in your browser. Use `.cursor/mcp.json` instead if you want the configuration to apply only to one project. See the [Cursor MCP documentation](https://docs.cursor.com/context/model-context-protocol) for configuration and authentication details. Add and authenticate the server from the command line: ```bash theme={null} codex mcp add trm-api-docs --url https://docs.trmlabs.com/authed/mcp codex mcp login trm-api-docs ``` The login command opens the TRM API Docs sign-in flow in your browser. Confirm that the server is configured: ```bash theme={null} codex mcp get trm-api-docs ``` Restart Codex after authentication. The Codex app, CLI, and IDE extension share MCP configuration on the same host. See the [Codex MCP documentation](https://developers.openai.com/codex/mcp/) for UI and `config.toml` alternatives. Add the server to `.vscode/mcp.json`: ```json theme={null} { "servers": { "trm-api-docs": { "type": "http", "url": "https://docs.trmlabs.com/authed/mcp" } } } ``` In the command palette, run **MCP: List Servers**, select `trm-api-docs`, and start the server. Starting it opens the TRM API Docs sign-in flow in your browser. To make the server available across workspaces, use **MCP: Add Server** and select your user profile instead. VS Code users can run **MCP: Browse Resources** to view TRM skills exposed by the server. See the [VS Code MCP documentation](https://code.visualstudio.com/docs/agent-customization/mcp-servers) for configuration and resource-management options. Add a remote Streamable HTTP server named `trm-api-docs` with this URL: ```text theme={null} https://docs.trmlabs.com/authed/mcp ``` Save the configuration, then use your client's **Connect** or **Authenticate** action to open the TRM API Docs sign-in flow. Your client must support OAuth for remote MCP servers. Consult its documentation for the exact action and resource support. After you sign in, the browser redirects you to your client, and the server returns only the content available to your TRM Docs user groups. ## Verify the connection Start a new agent conversation and ask: > Use `trm-api-docs`, not model memory. Find and read the Compliance API authentication guide (`/guides/public/Authentication`). Return its title and URL and confirm it lists both API Key and OAuth2 (Recommended). Then list the TRM MCP resources available in this session. A successful connection should show that your agent: 1. Uses the documentation search capability to find the relevant page. 2. Retrieves the full page through the TRM API Docs filesystem capability. 3. Cites or links to the TRM API Docs page it used. 4. Lists any TRM workflow skills available to your account when the client supports MCP resources. ## Start building with TRM You can use the connection for a focused API question, a single implementation, or a complete workflow. Connecting the MCP uses browser sign-in and grants your agent access to TRM **documentation** only. The integration code your agent writes authenticates to the TRM **API** separately — with your own API key or OAuth client. Generate one at [my.trmlabs.com → Settings → API Tokens](https://my.trmlabs.com/settings/api-key) and keep it in an environment variable or secret manager, never in the prompt or the code. ### Answer an API question > Using `trm-api-docs`, find and read the current documentation for the Wallet Screening endpoint that submits one or more addresses for screening. Explain the request, response, authentication, errors, and operational constraints. Cite every TRM API Docs page you use. ### Integrate with a TRM API > Using `trm-api-docs`, implement a Wallet Screening client in this repository for one address and chain. Read the current endpoint, authentication, and error-handling documentation before editing code. Follow the repository's existing conventions, add tests, and report the documentation pages and assumptions used. ### Build a common compliance workflow > Using `trm-api-docs`, discover and read the TRM Compliance API integration skill. Help me implement a withdrawal workflow. Ask for any choices that materially change the implementation before editing code. AI-generated code can be incomplete or incorrect. Review the retrieved documentation, generated code, tests, authentication, and customer-specific compliance decisions before using an implementation in production. ## Troubleshooting ### The browser does not open Confirm that your client supports OAuth for remote HTTP MCP servers. Remove and re-add the server, or use the client's manual authentication command. ### Authentication succeeds but protected pages are missing Open the page directly in TRM API Docs with the same account. If you cannot access it there, request the appropriate API documentation permission and authenticate again. ### Tools work in the session but the server is not listed in `/mcp` The server can be authenticated and its tools usable in the current session yet not appear in the persisted `/mcp` list. Reload the client, or remove and re-add the server, to persist it. This is a display or persistence quirk, not an authentication failure. ### API documentation tools are available but a skill is not used Ask the agent to list MCP resources and explicitly read the matching skill before using search tools. Some clients expose resources without automatically selecting them. ### Results appear stale after an API documentation update Start a fresh agent session and reconnect the MCP server. Clients can cache resource lists or conversation context. # Free Sanctions and Beacon Network address screening Source: https://docs.trmlabs.com/guides/sanctions/introduction The TRM Sanctions and Beacon Network API is free to use, allowing you to screen cryptocurrency addresses for sanctions and tagged beacon address exposure. Fill out the contact information below, and we’ll send you the API documentation and instructions to get started. # TRM Labs Documentation Source: https://docs.trmlabs.com/index
## TRM Labs Documentation

Learn how to investigate, monitor, and detect crypto fraud and financial crime with TRM's blockchain intelligence platform.

Public docs, no login required: Sanctions API · Chainabuse API

TRM Labs Docs

Get Started

New to TRM Labs? Start here to learn the fundamentals and integrate with our platform.

Connect your AI agent to current MCP TRM API documentation and start building. Step-by-step tutorials and conceptual guides for using the TRM Labs platform effectively. Complete API documentation with endpoints, parameters, authentication, and code examples.

Explore by Product

Documentation organized by TRM's core product areas.

Screen wallet addresses against known risk indicators and entities in real-time. Monitor on-chain transactions for suspicious activity and compliance violations. Get blockchain intelligence at scale.

Documentation by Industry

Find guides tailored to your organization's needs.

Compliance and risk management for traditional financial institutions. AML/CFT compliance for exchanges, custodians, and DeFi protocols. Fraud prevention and compliance for payment and lending platforms. Investigation tools and techniques for crypto-related cases.

Need more help?

Explore additional resources or reach out to our support team.