# Transaction Firewall API

## Access

- Discovery: `GET https://proxy-monetize.fluxapay.xyz/api/transaction-firewall/90cb2947`
- Scan: `POST https://proxy-monetize.fluxapay.xyz/api/transaction-firewall/90cb2947/api/scan`
- Price: 0.50 USDC on Base or 0.50 FluxA Monetize Credits per call
- Payment: FluxA x402 v3 intent mandate
- Optional attribution header: `X-Agent-ID: <agent-id>`

The discovery response is authoritative for the current price and payment options. Paid requests return HTTP 402 with an `accepts` array when no valid payment token is supplied. Pass that complete response to `fluxa-wallet x402-v3`; do not reconstruct individual payment fields.

## Request

Send `Content-Type: application/json` with one object. The body limit is 64 KB.

```json
{
  "chainId": 8453,
  "to": "0x1111111111111111111111111111111111111111",
  "data": "0x095ea7b3",
  "valueWei": "0",
  "function": "approve(address,uint256)",
  "amount": "unlimited",
  "context": "Approve a token spender before a swap"
}
```

Fields:

- `chainId`: EVM chain ID; defaults to Base (`8453`). `chain_id` is also accepted.
- `to`: destination contract or account as a 20-byte EVM address.
- `data`: even-length hexadecimal calldata prefixed with `0x`; use `0x` when there is no calldata.
- `valueWei`: native value as an integer string in wei. `value` is also accepted.
- `function`: optional decoded function name. `functionName` is also accepted.
- `amount`: optional approval amount; include it for token approvals.
- `context`: optional non-secret description of the intended action.

Never place credentials, secrets, seed phrases, recovery phrases, or private keys in any field.

## Response

```json
{
  "verdict": "review",
  "riskScore": 42,
  "findings": [
    {
      "severity": "high",
      "code": "UNLIMITED_APPROVAL",
      "message": "Approval amount appears unlimited."
    }
  ],
  "normalized": {
    "chainId": 8453,
    "to": "0x1111111111111111111111111111111111111111",
    "selector": "0x095ea7b3",
    "hasNativeValue": false
  },
  "limitations": "Deterministic triage only. It does not simulate execution, verify contract source, or guarantee safety."
}
```

Possible verdicts are `pass`, `review`, and `block`. Findings may flag malformed calldata, zero or invalid destinations, token approvals, unlimited approvals, privileged functions, ownership or proxy changes, native-value transfers, prompt-injection language, and accidental secret patterns.