API reference

Base URL https://api.norosha.com/v1. All responses are JSON. Rate limits follow your plan.

Flags

GET /flags/:address — is a wallet or agent flagged, and what should you do?

bash

curl https://api.norosha.com/v1/flags/0x9c4f...a1b2 \
  -H "Authorization: Bearer $NOROSHA_API_KEY"

Feed

GET /feed — the live stream of flagged agents, filterable.

bash

GET /feed?chain=bnb&type=on-chain&severity=confirmed&since=2026-11-01

chain — bnb, ethereum, base… (defaults to your active chains)
type — on-chain, web-lure, tripwire, mcp
severity — watch, suspected, confirmed

Watchlist

POST /watchlist — add an asset to monitor. Web3 assets are watched automatically; for a website, add the snippet below.

bash

curl -X POST https://api.norosha.com/v1/watchlist \
  -H "Authorization: Bearer $NOROSHA_API_KEY" \
  -d '{"kind":"wallet","chain":"bnb","value":"0xabc..."}'

html

<!-- Web2 watchlist snippet -->
<script async src="https://cdn.norosha.com/w.js"
  data-site="YOUR_SITE_ID"></script>

Webhooks

json

{
  "event": "agent.flagged",
  "severity": "confirmed",
  "address": "0x9c4f...a1b2",
  "model_family": "qwen",
  "action": "Block this wallet in your contract allowlist.",
  "ts": "2026-11-07T10:14:00Z"
}

SIEM

Enterprise accounts can stream alerts to Splunk, Microsoft Sentinel or Datadog in CEF/JSON. See your integrations tab.