> ## Documentation Index > Fetch the complete documentation index at: https://docs.dexploit.dev/llms.txt > Use this file to discover all available pages before exploring further. # On-chain audit flags > On-chain authority + LP-burn rug-check signals for a token. Cheaper than `/tokens/{mint}` when you only need audit flags. **Public — no API key required.** This is one of three intentionally keyless endpoints (along with [/api/v1/stats](#tag/stats-trends/get/api/v1/stats) and [/api/v1/protocols](#tag/stats-trends/get/api/v1/protocols)). **Served by a separate service (CT106) at the root path** — `https://api.dexploit.dev/tokens/{mint}/audit`, *not* under `/api/v1`. **Response semantics:** - Valid base58 mint, **indexed** → `200` with `indexed: true` and populated flags. - Valid base58 mint, **not yet indexed** → `200` with the unindexed sentinel: `indexed: false`, all flags `null`, and `top10_pct: {value: null, status: "no_holder_data", computed_at: null}`. It does **not** 404. - **Malformed** (non-base58) mint → `400`. ## OpenAPI ````yaml /api-reference/openapi.json get /tokens/{mint}/audit openapi: 3.1.0 info: title: Dexploit API version: 1.0.0 description: Real-time and historical Solana DEX swap and OHLCV data. servers: - url: https://api.dexploit.dev description: Production security: - ApiKeyHeader: [] - BearerAuth: [] - ApiKeyQuery: [] paths: /tokens/{mint}/audit: get: tags: - Tokens summary: On-chain audit flags description: >- On-chain authority + LP-burn rug-check signals for a token. Cheaper than `/tokens/{mint}` when you only need audit flags. **Public — no API key required.** This is one of three intentionally keyless endpoints (along with [/api/v1/stats](#tag/stats-trends/get/api/v1/stats) and [/api/v1/protocols](#tag/stats-trends/get/api/v1/protocols)). **Served by a separate service (CT106) at the root path** — `https://api.dexploit.dev/tokens/{mint}/audit`, *not* under `/api/v1`. **Response semantics:** - Valid base58 mint, **indexed** → `200` with `indexed: true` and populated flags. - Valid base58 mint, **not yet indexed** → `200` with the unindexed sentinel: `indexed: false`, all flags `null`, and `top10_pct: {value: null, status: "no_holder_data", computed_at: null}`. It does **not** 404. - **Malformed** (non-base58) mint → `400`. operationId: getTokenAudit parameters: - name: mint in: path required: true schema: type: string responses: '200': description: >- Audit flags. `indexed: false` (with all-null flags) is the sentinel for a valid-but-unindexed mint — not an error. content: application/json: schema: $ref: '#/components/schemas/TokenAudit' examples: indexed: summary: Indexed mint value: mint: DMcu8numYJ9eExLoG3MUvhByPwSMLttUy2S53auk7MfE indexed: true mint_revoked: true freeze_revoked: true lp_burnt: false top10_pct: value: 0.184 status: ready computed_at: 1749312000000 computed_at: 1749312000 unindexed: summary: Valid but not yet indexed (sentinel) value: mint: So11111111111111111111111111111111111111112 indexed: false mint_revoked: null freeze_revoked: null lp_burnt: null top10_pct: value: null status: no_holder_data computed_at: null computed_at: null '400': description: Malformed (non-base58) mint. content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' security: [] components: schemas: TokenAudit: type: object description: >- On-chain authority and LP-burn checks for a token, served by a dedicated service (CT106) at the **root** path `/tokens/{mint}/audit` (not under `/api/v1`). A valid base58 mint that has not been indexed yet still returns **HTTP 200** with `indexed: false` and every flag/value `null` (the unindexed sentinel) — it does not 404. A malformed (non-base58) mint returns **HTTP 400**. required: - mint - indexed properties: mint: type: string indexed: type: boolean description: >- `false` when the mint is valid but not yet indexed — in that case `mint_revoked`, `freeze_revoked`, `lp_burnt`, and `computed_at` are all `null` and `top10_pct.status` is `no_holder_data`. `true` once audit data has been computed. lp_burnt: type: - boolean - 'null' description: >- True if the dominant LP token is burnt/locked. `null` when not indexed/computed. This is the boolean roll-up; see `lock` for the structured signal. lock: type: - object - 'null' description: >- Structured LP-lock signal. `null` when there is no structured signal yet (same meaning as a `null` `lp_burnt`). When present it distinguishes *how* the LP is secured and how confident we are. properties: secured_pct: type: - number - 'null' description: >- Fraction of LP secured, `0..1`. Precise when measured by the polling detector; `null` when only the real-time firehose event path observed the lock (a binary on-chain burn/lock event — exact share not measured). Never fabricated. mechanism: type: - string - 'null' enum: - burned - locked - partial - unsecured - null description: >- `burned` = LP sent to the incinerator (irreversible). `locked` = LP/position held by a locker program (Streamflow / Jupiter Lock / Raydium Burn&Earn / UNCX). `partial` / `unsecured` are graded readings from the detector. Bonding-curve venues (PumpFun, Meteora DBC) have no fungible LP to burn, so `lock` stays `null` there. verified: type: - boolean - 'null' description: >- `true` for direct on-chain observations (firehose LP burn/lock events; Raydium AMM/CPMM verified layouts). `false` for asserted layouts (Meteora DAMM v2, Raydium CLMM position scans). mint_revoked: type: - boolean - 'null' description: '`null` when not indexed/computed.' freeze_revoked: type: - boolean - 'null' description: '`null` when not indexed/computed.' top10_pct: $ref: '#/components/schemas/Top10Pct' computed_at: type: - integer - 'null' description: Unix epoch seconds. `null` when not indexed/computed. ErrorEnvelope: type: object required: - success - error properties: success: type: boolean enum: - false error: type: object required: - code - message properties: code: type: string example: INVALID_PARAM message: type: string example: >- use pair_address; see /api/v1/pairs?token_address=X to discover pools Top10Pct: type: object description: >- Top 10 holders' share of supply, with explicit status. Always present (even when the value isn't computable yet). properties: value: type: - number - 'null' description: >- Top-10 (pool-excluded) sum divided by total supply. `null` when `status` is not `ready`. status: type: string description: >- Snake-case status of the top-10 computation. `value`/`computed_at` are non-null only when `ready`. enum: - ready - no_holder_data - no_pool_data - computing computed_at: type: - integer - 'null' description: Unix epoch milliseconds. `null` unless `status` is `ready`. securitySchemes: ApiKeyHeader: type: apiKey in: header name: X-API-Key description: >- Preferred for swaps-api endpoints (`/swaps/*`, `/stats/*`, `/trending`, `/pool-events`). BearerAuth: type: http scheme: bearer description: >- Required by the OHLCV endpoints (`/api/v1/*`) and accepted by every other endpoint. Send `Authorization: Bearer ohlcv_live_sk_`. ApiKeyQuery: type: apiKey in: query name: api_key description: >- Browser-friendly alternative to the Bearer header — accepted by every endpoint and required for WebSocket from the browser. ````