Developer API

1. 1. Sign in on the site (a message signature) and create your key on the dashboard. It is shown once.
2. 2. Top up credits on the credits screen (coming soon). Every call is paid from them, in dollars.
3. 3. Send { input } to POST /api/v1/check with the key as a Bearer token.

curl -s https://sentinellayer.tech/api/v1/check \
  -H "Authorization: Bearer $SENTINELLAYER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"input": "<base64 transaction, address or mint>"}'

Every request carries Authorization: Bearer sentinel_.... Keys start with sentinel_, are stored only as a hash and are shown once when created. There is one key per wallet: rotating issues a new key and the old one stops at once; revoking stops it without a replacement.

Any signed-in wallet can create a key. Calls are paid from that wallet's credits; when they run short, calls answer 402 no_credits and usage still answers so you can see why. Keep the key on your server. Never ship it to a browser or an app bundle.

Prices are in dollars, paid from credits you top up with $SENTINEL. Credits are stored in dollars, so they do not change when the token price moves. A malformed input is refused before anything is charged, and a call that cannot run is refunded. The operators can change prices; the live list is on the pricing page and in GET /api/v1/usage.

Throttle: 5 requests a second per key, burst 10. Every paid call carries these headers:

Your custom rules from the dashboard run after the built-in checks on every API call, exactly as on the site.

curl -s https://sentinellayer.tech/api/v1/check \
  -H "Authorization: Bearer $SENTINELLAYER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"input": "<unsigned base64 transaction>", "signer": "<wallet that would sign>"}'

The same verdict as the coin page on the site (RUG, RUG LIKELY, INSIDER RING, BUNDLED, LINKED HOLDERS, DUMP RISK, DEAD, No red flags found), cut to the depth you pay for. Every flag cites on-chain evidence with a Solscan link.

withheld says what the chosen depth left out, so you can decide whether a deeper call is worth it.

curl -s "https://sentinellayer.tech/api/v1/coin/<mint>?depth=full" \
  -H "Authorization: Bearer $SENTINELLAYER_API_KEY"

Free to call. Credits left in dollars, this month's call count and the price of each call.

curl -s https://sentinellayer.tech/api/v1/usage \
  -H "Authorization: Bearer $SENTINELLAYER_API_KEY"

{
  "period": "2026-10",
  "calls": 1832,
  "balanceUsd": 41.5,
  "prices": { "check": 0.1, "coinBasic": 0.1, "coinTier1": 0.5, "coinTier2": 1, "coinTier3": 2 }
}

The verdict field is always one of safe, warn or block. On the site the same three read as No red flags found, Flagged and Denied. No red flags found means none of the checks found a problem, never a guarantee: show your users that wording, not the raw value.

Never show a verdict without its reasons. A warn for an unverified program is a different conversation from a warn for a first-time recipient; the reason codes let you branch on that.

Every error is JSON with a stable error code and a plain message:

{
  "error": "no_credits",
  "message": "This call costs $0.50 and the key's wallet has $0.20 in credits. Top up at /credits.",
  "priceUsd": 0.5,
  "balanceUsd": 0.2
}

@sentinellayer/sdk has no dependencies and uses the global fetch (Node 18+, Deno, Bun). It retries throttles and server errors with backoff, honors Retry-After, and throws SentinelLayerError with status, code and the error body.

import { SentinelLayer, SentinelLayerError } from "@sentinellayer/sdk";

const sl = new SentinelLayer({
  apiKey: process.env.SENTINELLAYER_API_KEY!, // server side only
  baseUrl: "https://sentinellayer.tech",
});

export async function guard(txBase64: string, signer: string) {
  try {
    const r = await sl.check(txBase64, { signer });
    if (r.verdict === "block") {
      throw new Error(r.reasons.map((x) => x.title).join("; "));
    }
    return r;
  } catch (e) {
    if (e instanceof SentinelLayerError && e.code === "no_credits") {
      // e.body.priceUsd and e.body.balanceUsd: top up credits on the site
    }
    throw e;
  }
}

const coin = await sl.scanCoin(mint); // the basic coin verdict
console.log(coin.line, coin.headline);

const u = await sl.usage(); // { period, calls, balanceUsd, prices }

Options: apiKey, baseUrl, timeoutMs (default 60 s), retries (default 2), fetch.

The full description is served at /api/v1/openapi.json (OpenAPI 3.1, public, CORS open), ready for code generators and API clients.