Enforcement API

Pre-seed status: this customer ingress is defined in code and App Hosting configuration. An authenticated request on the current serving build has not yet been verified. Contact SafeClick for provisioned access before treating it as live.

Create a Team API key in the console, keep it on your server, then evaluate the action immediately before signing, broadcast, or execution.

curl -X POST "https://safeclick.dev/api/rest/v1/scan/transaction" \
  -H "x-api-key: $SAFECLICK_API_KEY" \
  -H "Idempotency-Key: $SAFECLICK_REQUEST_ID" \
  -H "content-type: application/json" \
  -d '{
    "to": "0x52908400098527886E0F7030069857D2E4169EE7",
    "value": "1000",
    "network_key": "eip155:1"
  }'

{
  "scan_id": "6d5b6c44-37d3-4d31-b6e1-3902b5c81616",
  "status": "final",
  "action": "ALLOW",
  "validation_required": false,
  "risk_tier": "low",
  "reason_categories": ["policy_rule"],
  "coverage_status": "complete",
  "response_schema_version": "public-scan-v1"
}

const result = await response.json();

const mayExecute =
  result.status === "final" &&
  (result.action === "ALLOW" || result.action === "FINAL_ALLOW");

if (!mayExecute) {
  throw new Error("SafeClick did not allow execution");
}

await signOrExecute(transaction);

A scan submission returns HTTP 202 even when its decision is already final. Read status and action; do not infer state from the HTTP success code.

These routes reuse detector capabilities behind SafeClick and the included first-party tools. They share the Team API-key scope shown below, but they are not separate products or the canonical transaction-enforcement entry point.

Send the Team API key as x-api-key or Authorization: Bearer. Keep it in a server-side secret store. Browser bundles and public repositories must not contain it.

New keys start with scan.execute and scans.read. During pre-seed, additional control-plane scopes are provisioned with SafeClick; request the scope shown beside the route before integrating it.

Keys are scoped to one Team. The API derives the Organization from the verified credential; request bodies cannot select another tenant.

Real scans require an active Team access grant from SafeClick. Check its status at GET /v1/access-grant. Configuration and existing scan reads remain available without a grant.

Set SAFECLICK_REQUEST_ID to a unique ID for each logical scan. Keep the same Idempotency-Key and payload when retrying so a completed response is replayed without another scan or charge. A new key means new work.