Build an on-chain investigation

1Label the target

Start with the labels endpoint to attribute the target to an entity and category. This C3 call frames everything downstream.

curl https://api.1st-node.com/v1/intel/eth/0x9a..f2/labels \
  -H "Authorization: Bearer sk_live_..."

2Map counterparties

Pull the counterparty graph to see who the target transacts with and which of them are labeled entities. Persist the edge list.

curl https://api.1st-node.com/v1/intel/eth/0x9a..f2/graph \
  -H "Authorization: Bearer sk_live_..."

3Trace funds across hops

Run a multi-hop fund-flow trace. This is the heaviest primitive — C4-metered — because it walks paths across several hops. The response returns hop paths ending at labeled entities.

curl "https://api.1st-node.com/v1/intel/eth/0x9a..f2/flow?dir=out&hops=3" \
  -H "Authorization: Bearer sk_live_..."
> { "paths": [ { "hops": [
>   "0x9a..f2", "0x28..a1", "0x5c..09" ],
>   "terminal_entity": "Binance", "value_usd": 210000 } ] }

4Store the case and attach risk

Persist the label, graph and hop paths together as one case file, then attach a risk-score on the same key so the investigation carries an AML conclusion. Everything is reproducible from the stored data.