> For the complete documentation index, see [llms.txt](https://www.bokk.ltd/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.bokk.ltd/readme/v3/3.-real-time-transaction-risk-alert-api.md).

# 3. Real-Time Transaction Risk Alert API

#### Description

Supports risk screening for recent real-time transactions (within the last 24 hours).

This endpoint is used when you act as the fund recipient and perform a risk screening after an on-chain transaction has occurred, with a focus on the risk associated with the source of funds.

The interface applies the strategies configured in the rule engine.

***

### 1. Endpoint URL

```
GET /openapi/v3/risk/rule/tx/screening
```

***

### 2. Request Parameters

<table><thead><tr><th width="187">Parameter</th><th>Type</th><th>Required</th><th>Description</th></tr></thead><tbody><tr><td>apikey</td><td>string</td><td>true</td><td>API key</td></tr><tr><td>tx</td><td>string</td><td>true</td><td>Transaction hash</td></tr><tr><td>chain</td><td>string</td><td>true</td><td>Main chain name</td></tr><tr><td>to_address</td><td>string</td><td>true</td><td>Token receiving address</td></tr><tr><td>coin</td><td>string</td><td>true</td><td>Token name</td></tr><tr><td>app_id</td><td>string</td><td>true</td><td>Application ID</td></tr></tbody></table>

***

### 3. Response Parameters

```json
{
  "code": 200,
  "message": "success",
  "data": {
    "unique_id": "2541......c245",
    "risk_level": "severe",
    "risk_types": [
      "Blackmail Scam"
    ],
    "risk_tags": [
      "phishing",
      "Blackmail Scam"
    ],
    "risk_code": 4444,
    "risk_detail": {
      "private_data": {
        "hit_private_whitelist": false,
        "hit_private_blacklist": false,
        "private_blacklist_name": "Private blacklist name"
      },
      "hit_blacklist_address": true,
      "tx_blacklist_address": [
        {
          "blacklist_address": "0xE0......D015",
          "risk_types": "Blackmail Scam",
          "risk_tags": [
            "phishing"
          ]
        }
      ],
      "hit_direct_risk_review": false,
      "hit_indirect_risk_review": true,
      "hit_aml_review": true
    }
  }
}
```

***

## Response Field Description

<table><thead><tr><th width="130.2890625">Field</th><th width="123.52734375">Type</th><th>Description</th></tr></thead><tbody><tr><td>code</td><td>int</td><td>Business status code. <code>200</code> indicates success; other values indicate failure (refer to actual error codes returned).</td></tr><tr><td>message</td><td>string</td><td>Response status message, e.g., <code>success</code>.</td></tr><tr><td>data</td><td>object</td><td>Response data object.</td></tr></tbody></table>

***

## `data` Field Description

<table><thead><tr><th width="129.4609375">Field</th><th width="127.66796875">Type</th><th>Description</th></tr></thead><tbody><tr><td>unique_id</td><td>string</td><td>Unique request ID (used for tracking and troubleshooting).</td></tr><tr><td>risk_level</td><td>string</td><td>Risk level: <code>severe</code>, <code>high</code>, <code>medium</code>, <code>low</code>, <code>none</code> (no risk hit or unknown).</td></tr><tr><td>risk_types</td><td>string[]</td><td>Risk type array (high-level categories), e.g., <code>["Blackmail Scam"]</code>.</td></tr><tr><td>risk_tags</td><td>string[]</td><td>Risk tag array (more granular labels), e.g., <code>["phishing","Blackmail Scam"]</code>.</td></tr><tr><td>risk_code</td><td>int</td><td>Risk code: <code>0</code> (no risk detected), <code>-1</code> (not found), <code>4444</code> (blacklist hit). For other codes, refer to the <em>Risk Code Specification</em>.</td></tr><tr><td>risk_detail</td><td>object</td><td>Detailed risk information (strategy hits, blacklist matches, etc.).</td></tr></tbody></table>

***

## `risk_detail` Field Description

<table><thead><tr><th width="206.28515625">Field</th><th width="115.10546875">Type</th><th>Description</th></tr></thead><tbody><tr><td>private_data</td><td>object</td><td>Private list hit information.</td></tr><tr><td>hit_blacklist_address</td><td>boolean</td><td>Whether the transaction includes a blacklist address (from or to).</td></tr><tr><td>tx_blacklist_address</td><td>array</td><td>List of blacklist addresses matched in the transaction (may contain multiple entries).</td></tr><tr><td>hit_direct_risk_review</td><td>boolean</td><td>Whether direct risk review rules were triggered.</td></tr><tr><td>hit_indirect_risk_review</td><td>boolean</td><td>Whether indirect risk review rules were triggered.</td></tr><tr><td>hit_aml_review</td><td>boolean</td><td>Whether AML review rules were triggered.</td></tr></tbody></table>

***

## `private_data` Field Description

<table><thead><tr><th width="208.44921875">Field</th><th width="115.88671875">Type</th><th>Description</th></tr></thead><tbody><tr><td>hit_private_whitelist</td><td>boolean</td><td>Whether the address hits the private whitelist. <code>true</code> indicates a match.</td></tr><tr><td>hit_private_blacklist</td><td>boolean</td><td>Whether the address hits the private blacklist. <code>true</code> indicates a match.</td></tr><tr><td>private_blacklist_name</td><td>string</td><td>Name of the matched private blacklist (may be empty or not returned if no match).</td></tr></tbody></table>

***

## `tx_blacklist_address` Element Description

<table><thead><tr><th width="208.22265625">Field</th><th width="115.4375">Type</th><th>Description</th></tr></thead><tbody><tr><td>blacklist_address</td><td>string</td><td>The matched blacklist address.</td></tr><tr><td>risk_types</td><td>string</td><td>Risk type associated with the address.</td></tr><tr><td>risk_tags</td><td>string[]</td><td>Risk tag array associated with the address.</td></tr></tbody></table>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://www.bokk.ltd/readme/v3/3.-real-time-transaction-risk-alert-api.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.