Introduction

Wallet Sleuth tracks Solana wallets and surfaces their on-chain activity on a tracking page. The embed API lets you drop that page onto any website as an iframe widget. Visitors see the live wallet table; authorized visitors can submit their own wallets to be reviewed by the page owner.

This is Wallet Sleuth's documentation: a user guide for the app, the methodology behind its numbers, and the developer reference for the embed API. It covers:

  • How to add the widget to a page
  • How to authenticate with a public API key
  • The four public HTTP endpoints
  • The trust + approval model that governs submissions

What you get

SurfacePurpose
Iframe widgetThe full tracking page view, loaded from /embed/tracking/{id}?key=.... Wallet table, token header, and an inline submission form.
GET /api/embed/tracking/{id}Machine-readable payload of the same data for custom UIs.
POST /api/embed/siws/nonce + POST /api/embed/submissionsSubmit a wallet from your own UI. Proves ownership via a Sign-In-With-Solana signature.
GET /api/embed/session/submissionsRead back submissions made by the current visitor session.

Start here

  • Guide — how to use Wallet Sleuth, from your first tracking page to audits and Scout.
  • Quickstart — drop the iframe onto a page in five minutes.
  • Authentication — public vs. secret keys, origin allowlisting.
  • Embed widget — widget mechanics, signing, what owners can configure.
  • API reference — endpoints, request/response shapes.
  • Concepts — how submissions get approved.
  • Errors and status codes — full error code table.
  • Methodology — how wallet relationships, risk scores, grades, taint and behavioral analytics are computed, and the data sources behind them.

Conventions

  • API base path: /api/embed/* on the Wallet Sleuth host.
  • All public endpoints accept a Bearer API key in the Authorization header.
  • All public endpoints support CORS preflight (OPTIONS) and return Access-Control-Allow-Credentials: true when the request Origin is allowlisted on the key.
  • Request and response bodies are JSON. Errors always include an error field with a short code; see Errors and status codes.