BitLab Web3 Security API

API Docs

One REST platform. BitLab Locker and Token Audit stay separate products. Aggregators consume a unified token profile with on-chain proof. The blockchain — not this website — is the authority for whether a lock exists. Same spec as locker.bbspectrum.com/#docs.

Production base: https://api.bbspectrum.com/v1

Architecture

Production: https://api.bbspectrum.com/v1. Do not scrape audit.bbspectrum.com or locker.bbspectrum.com. Aggregators should call this API and/or read the chain directly.

GET /v1/token/{chain}/{address}
GET /v1/aggregator/token/{chain}/{address}
GET /v1/audit/token/{chain}/{address}
GET /v1/audit/token/{chain}/{address}/score
GET /v1/locker/token/{chain}/{address}
GET /v1/locker/liquidity/{chain}/{address}
GET /v1/locker/owner/{chain}/{owner}
GET /v1/locker/{chain}/{lockId}
GET /v1/verify/lock/{chain}/{lockId}
GET /locks/{chain}/{id}

Chain slugs: solana, bsc, ethereum, polygon, cronos, base, arbitrum. Aliases like bnb, sol, matic are accepted.

Spec: OpenAPI JSON · Health

GET/v1/*

Usage guidelines

REST + JSON only. Version is in the path (/v1). Breaking changes ship as /v2.
Every success body is { data, meta }. meta.timestamp is ISO-8601 UTC.
Locker payloads include verification.on_chain, vault / lock account, and explorer URLs. Do not display a lock as verified unless on_chain is true.
Cache responses 15–60 seconds. Do not poll faster than 1 request/second/token on the public tier.
Public: 60 requests/minute/IP. Developer / Business keys (header X-API-Key) raise that quota. The public tier needs no key.
Attribution: “Data: BB Spectrum” with a link to the lock or audit URL we return.
Do not treat a website screenshot as source of truth. The chain is.
Audit scores are heuristics over public data — not legal advice, not a firm audit, and privileges can change after a scan.

GETX-API-Key

Authentication

Name	In	Required	Description
X-API-Key	header	no	Optional. Format bbs_… for paid tiers. Omit on the public tier.
Authorization	header	no	Optional Bearer alias for the same key.

Unauthenticated access is allowed with the public rate limit. Invalid keys return 401.

—application/json

Errors

{
  "error": { "code": "not_found", "message": "Lock not found on-chain" },
  "meta": { "timestamp": "2026-08-31T21:00:00Z", "version": "v1" }
}

Name	In	Required	Description
400 bad_request	—	—	Missing chain, address, or lock id
401 unauthorized	—	—	Bad API key
404 not_found	—	—	Unknown path or lock not on-chain
429 rate_limited	—	—	Slow down
502 upstream	—	—	RPC / indexer unavailable

GET/v1/token/{chain}/{address}

Unified token profile (centerpiece)

The aggregator-facing product. One call: identity, BitLab score, token lock, liquidity lock, proof. Use this first. Detailed locker/audit routes sit underneath.

Name	In	Required	Description
chain	path	yes	Network slug (solana, bsc, …)
address	path	yes	Token mint or ERC-20 / BEP-20 address

curl https://api.bbspectrum.com/v1/token/solana/6ENavE5QXLFrJLBLdgExqPWPRgMRfNJ13kEn8oBmCG8N

{
  "data": {
    "token": { "address": "6ENavE5…", "chain": "solana" },
    "security": { "score": 87, "risk_level": "LOW", "audit_status": "COMPLETED" },
    "token_lock": { "locked": true, "percentage": 25.4, "unlock_date": "2027-08-31T00:00:00.000Z", "locker": "BitLab Locker" },
    "liquidity_lock": { "locked": false, "percentage": 0, "locker": "BitLab Locker" },
    "verification": { "on_chain": true, "locker_verified": true, "audit_verified": true },
    "locks": [{ "lock_id": "sol:3", "on_chain_verified": true, "verification_url": "https://locker.bbspectrum.com/#l/sol/3" }]
  }
}

GET/v1/aggregator/token/{chain}/{address}

Aggregator payload (minimal)

Only the fields listing sites and scanners typically need. Start here if you do not want the full profile.

curl https://api.bbspectrum.com/v1/aggregator/token/solana/6ENavE5QXLFrJLBLdgExqPWPRgMRfNJ13kEn8oBmCG8N

{
  "data": {
    "token_address": "6ENavE5…",
    "chain": "solana",
    "bitguard": {
      "security_score": 87,
      "risk_level": "LOW",
      "token_locked": true,
      "token_locked_percent": 25.4,
      "liquidity_locked": false,
      "liquidity_locked_percent": 0,
      "locker": "BitLab Locker",
      "verified": true
    }
  }
}

GET/v1/audit/token/{chain}/{address}

Token security (detailed)

Matches BitLab Security Scanner on this app: mint/freeze authorities, holder and liquidity context, plus locker overlap. Full sealed PDFs stay on this site; this endpoint is the machine-readable layer aggregators should cache.

Supported today: Ethereum, BNB Chain, Base, Solana, plus locker chains Polygon and Cronos for lock overlay.

Name	In	Required	Description
chain	path	yes	solana · ethereum · bsc · base · polygon · cronos
address	path	yes	Token mint or contract

curl https://api.bbspectrum.com/v1/audit/token/solana/6ENavE5QXLFrJLBLdgExqPWPRgMRfNJ13kEn8oBmCG8N

{
  "data": {
    "risk_score": 70,
    "risk_level": "MEDIUM",
    "mintable": true,
    "freeze_authority": false,
    "honeypot": null,
    "liquidity_locked": false,
    "token_locked": true,
    "report_url": "https://audit.bbspectrum.com/?token=…",
    "notes": "Lightweight API scan. Full sealed PDF reports are produced by BitLab Security Scanner."
  }
}

GET/v1/audit/token/{chain}/{address}/score

BitLab score + findings

Score is never the only field. This returns risk_score, risk_level, and the findings that produced it (mint, freeze, token lock, LP lock).

curl https://api.bbspectrum.com/v1/audit/token/solana/6ENavE5QXLFrJLBLdgExqPWPRgMRfNJ13kEn8oBmCG8N/score

GET/v1/locker/token/{chain}/{address}

Token locks for a mint

Every BitLab token / vesting lock whose mint equals address. Amounts, unlock time, vesting model, vault, and lock-account PDA are included so a scanner can verify on Solscan / BscScan.

Name	In	Required	Description
chain	path	yes	solana, bsc, polygon, cronos, …
address	path	yes	Token mint

curl https://api.bbspectrum.com/v1/locker/token/solana/6ENavE5QXLFrJLBLdgExqPWPRgMRfNJ13kEn8oBmCG8N

GET/v1/locker/liquidity/{chain}/{address}

Liquidity locks

LP-token and position locks for a pair or LP mint. The pool stays in the DEX; BitLab locks the asset that controls the position (V2 LP token or CLMM/DLMM NFT).

Name	In	Required	Description
chain	path	yes	Network slug
address	path	yes	LP mint, pair, or position mint

curl https://api.bbspectrum.com/v1/locker/liquidity/bsc/0xPairOrLpMint

GET/v1/locker/owner/{chain}/{ownerAddress}

Locks by owner

All BitLab locks whose owner wallet equals ownerAddress.

curl https://api.bbspectrum.com/v1/locker/owner/solana/DajXsKvDP1AYu4vKwwgct6G8YhPYgNsX19a62ED8aVvJ

GET/v1/locker/{chain}/{lockId}

Single lock (on-chain proof)

Preferred lock lookup. Aliases: /v1/locker/lock/sol:3, /v1/verify/lock/solana/3, legacy /locks/sol/3. Every lock includes locker name + program/contract, vault, lock account, unlock time, and on_chain_verified.

Name	In	Required	Description
chain	path	yes	solana, bsc, polygon, cronos, …
lockId	path	yes	On-chain lock number (e.g. 3)

curl https://api.bbspectrum.com/v1/locker/solana/3

{
  "data": {
    "lock_id": "sol:3",
    "type": "vesting",
    "chain": "solana",
    "token_address": "6ENavE5QXLFrJLBLdgExqPWPRgMRfNJ13kEn8oBmCG8N",
    "locker": { "name": "BitLab Locker", "program_or_contract": "FgTanvmeJJwfw8wbDFf5LMz2Hhrqgz1XAKAZsqDWgeKJ" },
    "vault": "8Co4go9Kx2Hu56QDaZMvdiPTF4Si51APe4ZGJVeJtxcq",
    "lock_account": "BBkZNcYHPCdFBTd5h2Vfy6C4ZYKUDvGK6AD61M6y6gEF",
    "on_chain_verified": true,
    "verification_url": "https://locker.bbspectrum.com/#l/sol/3"
  }
}

GET/v1/verify/lock/{chain}/{lockId}

Verification API

Proof-only. Same payload as a single lock. If on_chain_verified is not true, do not display the lock as live.

curl https://api.bbspectrum.com/v1/verify/lock/solana/3

GET/locks/{chain}/{id}

Legacy Read API

Kept for backward compatibility. New integrations should use /v1/locker/{chain}/{lockId}.

GET /locks/solana/3

GETchain, not HTTP

On-chain events (indexable without the website)

Third parties can recognize a BitLab lock from the blockchain alone.

EVM — BitLabTokenLocker

LockCreated, LockExtended, OwnershipTransferStarted, OwnershipAccepted,
OwnershipRenounced, Withdrawn, VestingClaimed

BNB TokenLocker: 0xc829e04acAe9A9E36D44E01e0a7Af51393D148Ee
Polygon & Cronos TokenLocker: 0xc829e04acAe9A9E36D44E01e0a7Af51393D148Ee

Solana — BitLab Lock program

Program: FgTanvmeJJwfw8wbDFf5LMz2Hhrqgz1XAKAZsqDWgeKJ
Instructions: create_token_lock, withdraw, claim_vested, extend_unlock, …
PDA seeds: ["bitguard-lock", owner, mint, id u64-le]

Webhooks (LOCK_CREATED, LOCK_EXTENDED, LOCK_RELEASED, AUDIT_COMPLETED) are specified; poll /v1/token/… until they are live.