REST API
Audit contracts, verify reports, and query MCP tools. All responses are JSON. All errors follow a single shape.
Base URL
All endpoints are served from the production domain. There is no versioned base path for v1 routes; pagination and forward-compat versioning are handled per-endpoint.
Authentication
Three ways to authenticate. Most endpoints accept more than one.
Session
Logged-in users, web UIGitHub OAuth or Google OAuth via Auth.js. Session cookie is set automatically after sign-in.
Use for: Browser flows, the audit UI, reports history, admin pages.
API Key
Developers, integrations, CI/CDCreate a key in Settings. Send Authorization: Bearer wg_live_xxxxx on any API route. Keys are tied to your account and quota.
Use for: Developer integrations, CI pipelines, GitHub Actions, programmatic access. Quota and rate limits apply per key.
x402 Payment
AI agents, automated toolsSign a USDC transferWithAuthorization (EIP-3009) on Base and send the proof in the X-PAYMENT header.
Use for: Pay-per-request endpoints under /api/x402/*. No account required.
Service Token (internal)
Internal services onlySend Authorization: Bearer {GESTALT_SERVICE_TOKEN value}. This is a server-side environment variable, not available to external users. Bypasses user quotas.
Use for: Internal CI, server-to-server calls. Not for external developers. Use API keys instead.
Error Responses
Every error returns JSON in the same shape. HTTP status codes follow standard conventions.
{
"error": "Unauthorized",
"code": "UNAUTHORIZED",
"details": { /* optional, endpoint-specific */ }
}Rate Limits
Enforced on the x402 endpoints via Upstash sliding windows.
Free tier: 1 audit per month. Additional audits available at $29 each. See /pricing for current rates.
Each API key has configurable rate limits (default: 100 req/min, 2000 req/day). Fresh audit limits apply per key. Manage keys in Settings.
Service tokens bypass user-facing quotas. Internal only, not available to external developers.
Audit Endpoints
Every endpoint you can call. Follow the link for request and response shapes.
/api/auditStart an audit for a verified contract by chain id and address.
/api/audit/:idFetch a completed audit report.
/api/audit/:id/streamSSE stream of live audit progress and the final report.
/api/v1/audit/sourceSource-direct audit. Submit Solidity source instead of an address.
/api/x402/audit/standard$29 USDC pay-per-request full audit. No account required.
/api/verifyVerify the EIP-712 signature on a WalletGuard report.
/mcpMCP tool discovery and execution.