# Honeypot check API

> A token's risk checks, each saying how it was established. A check that could not be made says so: an absent answer is never a pass.

## Check one token

[The token](https://app.aurelia.build/docs/token) carries `security`, a block of checks. A request waits at most 1.5 s for a chain read. A slower one finishes in the background, and the block says so in `unknown`.

A token's security block:

```bash
curl -s -H 'Authorization: Bearer <key>' 'https://app.aurelia.build/api/tokens/evm:56/0xbb4cdb9cbd36b01bd1cbaebf2de08d9173bc095c'
```

## The honeypot signal

It counts the distinct wallets that bought and that sold in 24 hours, leaving out the creator and its pools' creators. It is `likely` when 10 or more bought and none sold, not once any sold, and `null` below 10 buyers. It reads what wallets actually did, so it is a signal and not a simulation.

## What else is checked

| Chains | Checks |
|---|---|
| EVM | Owner and whether it is renounced, proxies and upgradeability, mint, pause, blacklist and trading-toggle functions, taxes measured from indexed swaps, burned liquidity |
| Solana | Mint and freeze authorities, Token-2022 extensions, metadata mutability |
| All | The honeypot signal, the 10 largest holders' share, and other tokens using the same logo |

## Screen many tokens

[Token lists](https://app.aurelia.build/docs/tokens) carry the same checks as `flags` on each row, and a list never waits on the chain. `flags` is `null` until the token was checked: listing it queues a check, and flags older than an hour are checked again.

Flags for several tokens:

```bash
curl -s -H 'Authorization: Bearer <key>' 'https://app.aurelia.build/api/tokens?tokens=solana:So11111111111111111111111111111111111111112,evm:56:0xbb4cdb9cbd36b01bd1cbaebf2de08d9173bc095c'
```

Keep tokens with no flags raised:

```javascript
const res = await fetch("https://app.aurelia.build/api/tokens?tokens=<chain>:<address>,<chain>:<address>", {
  headers: { Authorization: "Bearer <key>" },
});
const { tokens } = await res.json();
// null means not checked yet, which is not the same as clean.
const clean = tokens.filter((t) => t && Array.isArray(t.flags) && t.flags.length === 0);
```

## What the flags name

`upgradeable`, `mintable`, `pausable`, `blacklist`, `trading_toggle`, `buy_tax`, `sell_tax`, `mint_authority`, `freeze_authority`, `transfer_fee`, `permanent_delegate`, `transfer_hook`, `non_transferable`, `default_frozen`, `mutable_metadata` and `honeypot`. See [security](https://app.aurelia.build/docs/security) for all of them and their rules.

> **Note:** These checks report what the chain and indexed swaps show. No flags is not a guarantee, and nothing here is financial advice.

## Related

- [Security reference](https://app.aurelia.build/docs/security).
- [Token holders API](https://app.aurelia.build/guides/token-holders-api): concentration.
- [Token screener API](https://app.aurelia.build/guides/token-screener-api).