Accept your organization's private invitation link and create your password.
An owner or administrator opens Access & API and chooses a permission preset, then generates an expiring key with the required scopes. Save the one-time value in your server's secret store.
Call the API over HTTPS from your backend. Keep API keys out of browser code and query strings.
Base URL: . The organization is determined by the key; no tenant selector is accepted.
Collection is synchronous and can take tens of seconds. Allow a 120-second client timeout. If a POST times out, inspect recent analyses before submitting another collection; POST /analyses has no idempotency key.
Python example (standard library)JavaScript example (server-side fetch)
02 / EVIDENCE
What the data describes
Source-reported, bounded public-chain samples with anchors, retrieval times and coverage. Exact amounts are decimal strings in base units; parse them as integers with arbitrary precision.
Red: structural deviation within the sampled asset cohort. Blue: completeness of block anchors, transaction references, amounts and timestamps. Red can be null when the sample is insufficient.
Scores are descriptive and private. Graph connections do not establish identity, ownership or continuity of value. Bitcoin inputs and outputs are separate observations; summing both is not transfer volume.
Reference search covers indexed retained analyses. The response reports indexed versus retained counts. Opening an older analysis indexes it.
03 / OPERATIONS
Limits and lifecycle
120 authenticated API requests/minute per user or key.
6 analysis collections/minute and 100/day per organization; 1–8 pages; up to 1,200 references and 4,000 records.
Official enrichment: 3 refreshes/minute and 24/day per organization. Batch reference research: 20 requests/minute, up to 25 references and 5 saved runs per reference.
60 Graphus gateway reads/minute per organization; 30 overview and 30 science reads/minute per organization.
Latest 50 analyses, 100 investigations, 50 evidence snapshots per investigation, 100 watched references and latest 500 observation matches per organization.
Each evidence snapshot retains up to 100 incident records and reports truncation; it survives analysis retention.
Watchlists evaluate on collection or explicit evaluation. No background chain scan, email transport or webhooks are deployed.
Scopes, pagination and errors
All scopes listed for an operation are required. Keys expire and can be revoked immediately; their creator must retain an owner/admin membership. Browser viewers cannot create analyses, investigations or watch entries.
Paginated endpoints return items and next_cursor. Send the cursor unchanged with the same filters. limit is 1–50 (default 25). New records created during pagination appear after restarting the list. Concurrent deletion and retention may remove records.
Failures return {"error":"machine_readable_code"}. Every API response carries X-Request-Id and X-Porb-Api-Version. HTTP 401 means authentication failed; 403 means missing permission; 404 includes resources belonging to other organizations. On 429 respect Retry-After. Retry GET after transient 502/503 with bounded backoff; do not blindly retry writes.
Private responses use Cache-Control: no-store, private. Partner credentials are intended for server integrations. Browser cross-origin calls are not enabled.
Evidence digest verification: compute SHA-256 of UTF-8 JSON.stringify(snapshot) in the returned property order; compare the lowercase hexadecimal value to digest. This verifies the preserved packet, not independent verification of the source chain.
Research and enrichment APIs
GET /v1/capabilities reports limits and the permissions of your key. POST /v1/references/batch searches up to 25 references without collecting new data. Saved analyses expose /profile, /ml and /neighbors?reference=....
Use POST /v1/analyses/{id}/enrichment to compare saved references with the official OFAC identifier snapshot. The read endpoint preserves the source version and flags expired evidence. This evidence does not alter Red/Blue scores. Source freshness is six hours; refreshing requires the Research · collect and enrich preset.
Read-only keys can use the batch endpoint: its POST body contains search parameters and does not modify observations. Every required scope is documented below. A no-match result does not establish sanctions clearance; potential exact matches require review.
Research API examples (read-only key)
The address below is an illustrative input. Replace it with a public reference from your saved observations.
Official evidence examples (collection/enrichment key)
Set PORB_ANALYSIS_ID to a saved analysis ID. POST explicitly refreshes the report; GET reads it without contacting the source.