# Token security · Elysium API · Femtos

> Honeypot check: a buy, a transfer and a sell simulated on our node, taxes, owner powers, holders and LP, with a verdict.

- Base URL: `https://api.femtos.xyz/v1` (REST) · `wss://api.femtos.xyz/v1/ws` (WebSocket) · MCP: `https://api.femtos.xyz/mcp`
- Auth: `Authorization: Bearer $FEMTOS_KEY`. Free key: https://femtos.xyz/accounts/ (browser), or with
  no browser: `GET https://femtos.xyz/accounts/agent/challenge`, solve its proof of work, then `POST https://femtos.xyz/accounts/agent/signup`
  (https://femtos.xyz/agents.md#agent-onboarding)
- Decimals are exact strings, times Unix milliseconds, addresses lowercase `0x`
- Whole API in one file: https://femtos.xyz/agents.md · OpenAPI: https://api.femtos.xyz/v1/openapi.json · Index: https://femtos.xyz/llms.txt
- Page with live calls: https://femtos.xyz/elysium/token-security

## Token security — GET `/v1/tokens/{address}/security`

Honeypot check: a buy, a transfer and a sell simulated on our node, taxes, owner powers, holders and LP, with a verdict.

| Param | In | Example or values | Meaning |
|---|---|---|---|
| `address` | path | `<token>` | Token address |
| `layer` | query | `elysium` | EVM layer |

```bash
curl -H "Authorization: Bearer $FEMTOS_KEY" "https://api.femtos.xyz/v1/tokens/<token>/security?layer=elysium"
```

| Field | Type | Meaning |
|---|---|---|
| `verdict` | ok \| caution \| danger \| honeypot | honeypot: cannot sell, sell tax ≥ 90 % or transfers blocked; danger: a danger check; caution: a warn check |
| `reasons` | string[] | warn / danger findings, strongest first (at most 8) |
| `simulation` | object | {pool, amountIn, canBuy, canSell, canTransfer, buyTax, sellTax, transferTax, buyGas, sellGas, transferGas, revert, …} |
| `checks[]` | object | One per finding. id: can_buy, can_sell, can_transfer, buy_tax, sell_tax, transfer_tax, simulation, owner, ownership_reclaim, access_control, mintable, pausable, blacklist, whitelist, max_tx, max_wallet, trading_cooldown, trading_toggle, tax_modifiable, balance_modifiable, proxy, selfdestruct, external_call, verified_source, spam, top10_share, holders, creator_share, owner_share, liquidity_usd, lp_locked: {id, severity, value, message} |
| `holders` | object | {top10Share, top10EoaShare, totalHolders, creator, creatorShare, ownerShare} |
| `liquidity` | object | {usd, pools, mainPool} |
| `height` | int | Block the checks ran at |
| `asOf` | int | Unix ms of the report |
| `cached` | boolean | Served from the 60 s cache (ageMs old) |
| `billing` | heavy | heavy |

## Related (Holders & signals)

- [Holders](https://femtos.xyz/elysium/holders.md): Current balances of a token, largest first, with concentration.
- [Launch detail & signals](https://femtos.xyz/elysium/signals.md): Metrics, dev wallet, early buyers and risk signals of one launch.
- [Launch holders](https://femtos.xyz/elysium/launch-holders.md): Every holder of a launched token, tagged dev or early buyer, with concentration.

All Elysium endpoints: https://femtos.xyz/elysium.md