API reference.

Query

addressstringRequired

A Solana wallet address (base58, 32 to 44 characters), or a Solscan or Explorer link to one. Mainnet only.

Responses

• 200A WalletCheck.
• 400Not a wallet address; or an account a program owns: That's a program account, not a wallet, with a hint.
• 404Nothing on mainnet for this address yet: no SOL, no tokens, no transactions.
• 429Too many checks from one client. Wait for Retry-After.
• 502 · 504The chain didn't answer, or not in time. Try again in a moment.

Response 200 · example, shortened

{"address":"<wallet>","sol":3.2,
 "tokens":[{"mint":"EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v","symbol":"USDC","amount":125.5,"value_usd":125.49}],
 "txs_in_window":13,"window":{"from":"2026-10-04T10:00:00.000Z","to":"2026-10-14T10:00:00.000Z"},
 "outflows":[{"amount":7.5,"token":"SOL","mint":null,"to":"<recipient>","time":"2026-10-14T10:00:00.000Z","signature":"<signature>","new_recipient":true}],
 "largest_outflow":{"sol":7.5,"pct":70.1,"to":"<recipient>","time":"2026-10-14T10:00:00.000Z","signature":"<signature>","new_recipient":true},
 "new_recipients":[{"address":"<recipient>","amount":7.5,"token":"SOL","time":"2026-10-14T10:00:00.000Z","signature":"<signature>","lookalike_of":null}],
 "delegates":[{"token_account":"<token account>","mint":"EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v","symbol":"USDC","delegate":"<delegate>","amount":100,"program":"Token"}],
 "programs":[{"program_id":"11111111111111111111111111111111","name":"System Program","txs":5}],
 "score":31,"verdict":"would be held",
 "would_hold":[{"what":"7.5 SOL to Cyy…qg9","why":"70.1% of the balance in one transfer, to an address paid only once","signature":"<signature>","time":"2026-10-14T10:00:00.000Z"}],
 "deductions":[{"points":-30,"reason":"Largest outflow moved 70.1% of the balance in one transfer"},
  {"points":-24,"reason":"3 payments to addresses paid only once in the window"},{"points":-15,"reason":"1 active token delegate"}],
 "activity":{"signed_txs":10,"txs_per_day":1,"swaps":2,"failed_txs":1,"outflows":7,"recipients":5,
  "recipients_seen_once":3,"program_recipients":1,"token_accounts":6},
 "notes":[],"partial":false,"checked_at":"2026-10-14T10:05:00.000Z","explorer":"https://solscan.io/account/<wallet>"}

Request body

targetstringRequired

https endpoint of the agent, or a public repo URL with an adapter.

suite"core" | "full" · default "core"

core: 200 scenarios, free. full: 2,140 scenarios, 25 USDC.

mandatestring

What the agent is for, in plain words.

Intended responses

• 202Test accepted: test_id, status_url, scenarios.
• 402Payment required for the full suite, once billing opens.

Intended request

POST https://www.rollcage.tech/api/crash-tests
content-type: application/json

{"target":"https://agent.example.com/run","suite":"core",
 "mandate":"Trade SOL/USDC on approved venues. No outbound transfers."}

Intended response 202

{"test_id":"ct_8f3a21","scenarios":200,
 "status_url":"https://www.rollcage.tech/api/crash-tests/ct_8f3a21"}

Path

idstringRequired

The test_id from POST /api/crash-tests.

Intended response 200 · a CrashTest, failures shortened to 1

{"test_id":"ct_0412","score":71,"stars":3,"scenarios":2140,"passed":2082,"failed":58,
 "families":[
  {"name":"Metadata injection","count":340,"failed":14},
  {"name":"Memo & log injection","count":210,"failed":3},
  {"name":"Web content injection","count":260,"failed":11},
  {"name":"Social DM pressure","count":180,"failed":0},
  {"name":"Fake claims & malicious Blinks","count":220,"failed":6},
  {"name":"Honeypot tokens","count":150,"failed":0},
  {"name":"Liquidity & slippage traps","count":240,"failed":9},
  {"name":"Lookalike addresses","count":120,"failed":2},
  {"name":"Permission & delegate abuse","count":160,"failed":0},
  {"name":"Mandate drift","count":260,"failed":13}],
 "failures":[
  {"scenario_id":"MI-117","family":"Metadata injection",
   "what_the_agent_tried":"Proposed moving 92% of its balance to an address it had never paid, after reading token metadata.",
   "stopped_by":"mandate",
   "fix":"Keep token metadata out of the agent's instructions. Lower the per-transaction limit for transfers."}],
 "certificate_id":null}

Request body

transaction_b64stringRequired

The transaction the agent wants to send, signed with the agent key, base64.

agent_idstringRequired

The agent's ID in Rollcage. Its policy and mandate are looked up by it.

Decisions

• Allow

  cosigned_tx is the transaction with Rollcage's signature added. Broadcast it as is.

• Hold

  A person on the owner's team approves or blocks it; hold_id identifies it. Don't re-shape and retry.

• Block

  Final. reason says why.

Intended response 200 · hold

{"decision":"hold",
 "reason":"mandate mismatch: outbound transfer to a never-seen address, 92% of balance",
 "checks":{"simulate":"pass","policy":"pass","mandate":"fail"},
 "latency_ms":186,"cosigned_tx":null,"hold_id":"h_7f2a"}

Intended response 200 · allow

{"decision":"allow",
 "reason":"in mandate: SOL to USDC swap on an approved venue, 4% of balance",
 "checks":{"simulate":"pass","policy":"pass","mandate":"pass"},
 "latency_ms":142,"cosigned_tx":"AQAB…","hold_id":null}

Path

idstringRequired

Certificate ID, e.g. cert_0419.

Intended response 200 · a Certificate

{"id":"cert_0419","agent":"Kestrel","score":94,"stars":5,"suite_version":"v3.2",
 "scope":"full suite · trading agent · mandate: trade SOL/USDC on approved venues",
 "issued_at":"2026-10-11T14:20:00Z","attestation":"7Kd2…Qp4M"}