NEWMethodology v3.3 is open for public comment.Read the draft →
About Press Ratings Partners Compare Watchlist Advertise
Developers · API & data access

The ratings, machine-readable.

Every public score, tier, watchlist action, and methodology version — over a versioned REST API and bulk exports. The same data the site renders, nothing more: paid access never buys different numbers, and corrections propagate to every consumer within one release cycle. Full reference: developer docs →

Endpoints
14
REST v1 · JSON · versioned
Uptime · 90 d
99.97%
status.onyx.dev · public
P95 latency
84 ms
edge-cached reads
Datasets
6
ratings · history · watchlist · apps · providers · methodology
01 · Endpoints

What you can pull.

Everything below is read-only. There is no write API — scores are produced by the desk, not by callers. Internal fields (reviewer identity mid-case, embargoed actions) are never exposed at any tier.
MethodEndpointReturnsMin. plan
GET/v1/projectsPaginated directory — rank, score, tier, category, chains, TVL, entity status, last-review dateFree
GET/v1/projects/{slug}Full rating object — 14 sub-criteria with points, audits, treasury addresses, review recordFree
GET/v1/projects/{slug}/historyScore time series with the methodology version each point was scored underPro
GET/v1/watchlistAll public cases — action type, before/after score, key facts, evidence links, case IDFree
GET/v1/appsApp Store directory — review status, permissions, on-chain usage, version historyFree
GET/v1/providersMarketplace providers — service lines, published pricing, response recordFree
GET/v1/methodology/{version}The full framework as config — criteria, weights, tier thresholds, changelog diffFree
GET/v1/exports/dailyBulk snapshot — gzipped JSONL of the entire public dataset, signed checksumPro
WS/v1/streamWebhook + websocket feed — score changes, new cases, tier moves, corrections, as they publishEnterprise
02 · Example

One call, the whole rating.

Responses carry X-Onyx-Methodology and X-Onyx-Signature headers — every payload is signed, so you can prove a score said what it said on a given day.
Request
# API key in header · never in the URL
curl https://api.onyx.dev/v1/projects/uniswap \
  -H "Authorization: Bearer onyx_pk_····" \
  -H "Accept: application/json"
Response · 200 · 61 ms
{
  "slug": "uniswap",
  "score": 94,
  "tier": "certified",
  "methodology": "v3.2",
  "last_review": "2026-06-14",
  "criteria": { "security": 28, "transparency": 24,  },
  "watchlist": null,
  "audits": [ { "firm": "Trail of Bits",  } ],
  "entity": { "status": "verified", "jurisdiction": "US" }
}
03 · Plans

Pricing that can't touch the numbers.

API revenue is subject to the same independence cap as advertising. A rated project buying Enterprise access gets faster data about itself — not better data. Same firewall, same disclosure register.
Free
$0 / month
For hobby projects, research, and journalism.
  • 1,000 requests / day
  • All public directory + detail endpoints
  • Attribution required — "Data: Onyx" with a link
  • No history, bulk exports, or streaming
Pro
$149 / month
For dashboards, wallets, and analytics products.
  • 100,000 requests / day
  • Score history + daily bulk exports
  • Signed responses with checksum manifest
  • Email support · 2 business days
Enterprise
Custom
For exchanges, custodians, and institutional risk desks.
  • Unmetered reads · dedicated edge
  • Websocket stream + webhooks with SLA
  • Redistribution license · named support
  • Listed in the public sponsor registry
04 · Data guarantees

What the data promises.

Versioned, not revised
Every score is stamped with the methodology version it was produced under. When the framework changes, history is re-labeled — never silently re-scored. v3.2 numbers stay v3.2 numbers.
Corrections propagate
When the corrections log gains an entry, the API emits a correction event and bulk exports regenerate. Consumers are never left serving numbers we've retracted.
Signed payloads
Every response carries an Ed25519 signature over the body and date. Anyone can verify — after the fact — that a score they displayed is one we actually published.
05 · Fair use

Four rules.

Violations are handled the way everything else here is: documented, in public, in the disclosure register.
R·1
Attribute the data
Scores shown to end users must say "Data: Onyx" and link to the project page. The rating means nothing detached from the methodology behind it.
R·2
Don't imply endorsement
A score is an assessment, not a partnership. "Rated 94 by Onyx" is fine; "Onyx-approved" and seal look-alikes are not. Credibility badge artwork may not be reproduced from API data.
R·3
Don't resell raw feeds
Build products on the data; don't retail the data itself. Redistribution is Enterprise-only, licensed, and named in the sponsor registry.
R·4
Show the whole picture
If you display a project's score while it has an open watchlist case, you must surface the case too. Cherry-picking the number and hiding the warning gets a key revoked.
All systems operational v1 · current · no breaking changes since 2025-11 Last incident · 41 d ago · 12 min · post-mortem published Developer docs → · status.onyx.dev · changelog