API Reference

REST API over live XRPL mainnet data. Base URL https://api.rhyzlo.com. All responses are JSON in the shape { success, data } (errors: { error: { code, message } }).

Authentication

Data endpoints require a free API key. Send it in the X-API-Key header for 10,000 requests/day. The public embed endpoints (SVG badge and /tokens/:issuer/risk) are the exception — they stay keyless at 1,000/day per IP so you can embed them anywhere. Everything is free. Keys are created in the API Keys tab with your XRPL wallet — no account or email needed.

bashcurl "https://api.rhyzlo.com/api/v1/tokens/rsoLo2S1kiGeCcn6hCUXVrCpGMWLrRrLZz/risk?currency=USD" \
  -H "X-API-Key: rhy_your_key_here"

Every metered response includes X-Rhyzlo-Daily-Limit, X-Rhyzlo-Daily-Remaining, and X-Rhyzlo-Daily-Reset headers. Exceeding the limit returns 429 with a DAILY_LIMIT_EXCEEDED error code.

CORS is open on every data endpoint, so you can call the API with your key straight from browser apps — DEX frontends, wallet UIs, dashboards — on any domain, no server-side proxy needed. The X-Rhyzlo-* rate-limit headers are exposed to browser JavaScript.

REST endpoints

GET

/api/v1/tokens/:issuer/risk

Risk score

0–100 risk score for a token with every risk factor and trust signal broken down, plus data-completeness metadata. Lower is safer.

issuer (path) — Issuer address (r...)

currency (query) — 3-char code, 40-char hex IOU, or 64-char hex MPT

curl

curl "https://api.rhyzlo.com/api/v1/tokens/rsoLo2S1kiGeCcn6hCUXVrCpGMWLrRrLZz/risk?currency=USD" \
  -H "X-API-Key: rhy_your_key_here"

javascript

const res = await fetch(
  "https://api.rhyzlo.com/api/v1/tokens/rsoLo2S1kiGeCcn6hCUXVrCpGMWLrRrLZz/risk?currency=USD",
  { headers: { "X-API-Key": "rhy_your_key_here" } }
);
const { data } = await res.json();
console.log(data.score, data.level); // e.g. 33 "low"

GET

/api/v1/tokens/:issuer/:currency/trust

Token trust (risk + verified)

One call for DEXs and wallets: a token's risk score and whether it holds the Rhyzlo Verified badge, combined. Risk is non-blocking by default — on a cache miss it returns risk.status = pending and computes in the background, so sweeping many tokens never hangs. Pass ?wait=true to block on a cold compute.

issuer (path) — Issuer address (r...)

currency (path) — 3-char code, 40-char hex IOU, or 64-char hex MPT

wait (query) — true blocks until risk is computed; default returns cached score or a pending status

curl

curl "https://api.rhyzlo.com/api/v1/tokens/rsoLo2S1kiGeCcn6hCUXVrCpGMWLrRrLZz/USD/trust" \
  -H "X-API-Key: rhy_your_key_here"

javascript

const res = await fetch(
  "https://api.rhyzlo.com/api/v1/tokens/rsoLo2S1kiGeCcn6hCUXVrCpGMWLrRrLZz/USD/trust",
  { headers: { "X-API-Key": "rhy_your_key_here" } }
);
const { data } = await res.json();
// data.risk.score / data.risk.level   (data.risk.status: "ready" | "pending")
// data.certification.verified === true  ->  Rhyzlo Verified

GET

/api/v1/certifications/directory

Verified tokens

Every token currently holding the Rhyzlo Verified badge — issuer, currency, project name, and claim status. Poll this to surface verified status on your DEX or wallet; entries appear and disappear as daily re-checks issue and revoke badges.

limit (query) — Max entries (default 500, max 1000)

curl

curl "https://api.rhyzlo.com/api/v1/certifications/directory" \
  -H "X-API-Key: rhy_your_key_here"

javascript

const res = await fetch(
  "https://api.rhyzlo.com/api/v1/certifications/directory",
  { headers: { "X-API-Key": "rhy_your_key_here" } }
);
const { directory } = await res.json();
// [{ issuer, currency, projectName, tier: "verified", issuedAt, claimed }]
const verified = new Set(directory.map(t => `${t.issuer}:${t.currency}`));

GET

/api/v1/tokens/:issuer/:currency

Token info

Issuer account data, domain, transfer rate, token type (IOU vs MPT), and the XLS-70 credential summary.

issuer (path) — Issuer address

currency (path) — Currency code

curl

curl "https://api.rhyzlo.com/api/v1/tokens/rsoLo2S1kiGeCcn6hCUXVrCpGMWLrRrLZz/USD" \
  -H "X-API-Key: rhy_your_key_here"

GET

/api/v1/tokens/:issuer/:currency/holders

Top holders

Top-N holders with balances and wallet labels (exchanges, AMM pools, team wallets). Powers the concentration analysis in risk reports.

limit (query) — Number of holders (default 20)

curl

curl "https://api.rhyzlo.com/api/v1/tokens/rsoLo2S1kiGeCcn6hCUXVrCpGMWLrRrLZz/USD/holders?limit=20" \
  -H "X-API-Key: rhy_your_key_here"

GET

/api/v1/credentials/:address/summary

Credential summary

XLS-70 on-chain credential summary for an account: trusted/valid credential counts and types.

curl

curl "https://api.rhyzlo.com/api/v1/credentials/rsoLo2S1kiGeCcn6hCUXVrCpGMWLrRrLZz/summary" \
  -H "X-API-Key: rhy_your_key_here"

GET

/api/v1/transactions/:txHash

Transaction lookup

Transaction details by hash, including delivered_amount metadata for MPT payments.

curl

curl "https://api.rhyzlo.com/api/v1/transactions/TX_HASH_64_HEX" \
  -H "X-API-Key: rhy_your_key_here"

GET

/api/v1/escrows/:account

List escrows

All XLS-85 escrows (incoming and outgoing) for an account.

curl

curl "https://api.rhyzlo.com/api/v1/escrows/rsoLo2S1kiGeCcn6hCUXVrCpGMWLrRrLZz" \
  -H "X-API-Key: rhy_your_key_here"

GET

/api/v1/badge/:issuer

SVG risk badge

Dynamic shields.io-style SVG showing the live risk score. Open CORS — embed as an <img> anywhere. Cached 1 hour. No API key needed.

currency (query) — Optional currency code

curl

curl "https://api.rhyzlo.com/api/v1/badge/rsoLo2S1kiGeCcn6hCUXVrCpGMWLrRrLZz?currency=USD"

html

<img src="https://api.rhyzlo.com/api/v1/badge/rsoLo2S1kiGeCcn6hCUXVrCpGMWLrRrLZz?currency=USD"
     alt="Rhyzlo Risk Score" />

Rate limits

Tier	Daily limit	Price	API key	Attribution
Public embeds only	1,000 / day per IP	Free	Not required (badge + risk)	Required
API key	10,000 / day	Free	Yes (free, instant)	Required
Need more?	Custom	Free	hello@rhyzlo.com	Required

Embeds & integrations

Risk badge script

~4KB drop-in script that renders a live inline risk display with attribution. Dark/light themes, three sizes.

html<script src="https://rhyzlo.com/risk-badge.js"></script>
<div class="rhyzlo-risk-badge"
     data-issuer="rISSUER"
     data-currency="USD"
     data-theme="dark">
</div>

Trustline widget

Full trustline-creation flow (risk score + wallet signing) embedded on your site — see the widget page for setup.

All integrations must display “Risk Score by Rhyzlo” with a link to the full report — see the overview for the attribution snippet. Questions: hello@rhyzlo.com.