{"uid":"cap_6hytiVCMeooyyYJDsZCku","slug":"gnosis-safe-spending-authority-drift-detector-8cb9b25a","name":"Gnosis Safe Spending Authority Drift Detector","description":"Onchain- and crypto-market data for trading AI agents. Payment via x402 (USDC, exact scheme).","url":"https://api402x.com/safe-signer-drift?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["chain_id","address"],"properties":{"address":{"type":"string","description":"REQUIRED. The Safe proxy address (0x + 40 hex) on that chain."},"chain_id":{"type":"string","description":"REQUIRED. Numeric EVM chain id as a string, e.g. 1 (Ethereum), 8453 (Base), 42161 (Arbitrum), 10 (Optimism). A Safe proxy is often deployed at the same address on several chains but is a DIFFERENT Safe on each, so this is never guessed."},"lookback_blocks":{"type":"string","description":"Optional. How far back the baseline is read, in blocks. Defaults to roughly 30 days for the given chain."}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object","description":"Full JSON Schema for this response is at /openapi.json, and the free /preview sibling returns the same shape on live data. It is not inlined here because response headers have a hard 16 KB limit in common HTTP clients (Node's default) and this response is large. The example alongside is complete and real."}}}}},"responseSchema":{"type":"json","example":{"chain":"eip155:1","drift":{"status":"changed","guard_after":null,"guard_before":null,"owners_added":["0x7bd3ab8fa37d63c04a8d0bee3298088c0f366709","0x7d7e46bef5064cfae2ced5cc627141005d1cde76","0xfe89cc7abb2c4183683ab71653c4cdc9b02d44b7"],"version_after":"1.3.0","owners_removed":["0x0b8b1ed2594b36aedbf44dd17674f4686edfee6b","0x70b8769b09af7447886620c20854c8b9119b5fee","0xc02771315d0958f23a64140160e78ecb9bb8614e"],"version_before":"1.3.0","modules_enabled":[],"threshold_after":2,"modules_disabled":[],"threshold_before":3,"change_block_method":"binary_search_verified","changed_to_current_at":{"block_number":"25647884","block_timestamp":"2026-07-30T19:53:11.000Z"},"change_block_search_calls":20},"address":"0x91c32893216dE3eA0a55ABb9851f581d4503d39b","current":{"guard":{"note":null,"status":"none","address":null},"nonce":"243","owners":["0x75d91395cd36f24f990bbde69993cb20b96ecfa6","0x7bd3ab8fa37d63c04a8d0bee3298088c0f366709","0x7d7e46bef5064cfae2ced5cc627141005d1cde76","0xfe89cc7abb2c4183683ab71653c4cdc9b02d44b7"],"modules":[],"version":"1.3.0","singleton":"0xd9db270c1b5e3bd161e8c8503c55ceabee709552","threshold":2,"owner_count":4,"block_number":"25744383","module_count":0,"block_timestamp":"2026-08-13T06:44:47.000Z"},"baseline":{"guard":{"note":null,"status":"none","address":null},"nonce":"235","owners":["0x0b8b1ed2594b36aedbf44dd17674f4686edfee6b","0x70b8769b09af7447886620c20854c8b9119b5fee","0x75d91395cd36f24f990bbde69993cb20b96ecfa6","0xc02771315d0958f23a64140160e78ecb9bb8614e"],"modules":[],"version":"1.3.0","singleton":"0xd9db270c1b5e3bd161e8c8503c55ceabee709552","threshold":3,"owner_count":4,"block_number":"25529179","module_count":0,"block_timestamp":"2026-07-14T06:46:23.000Z"},"chain_id":1,"fetched_at":"2026-08-13T06:44:52.937Z","discrepancy":null,"archive_proof":{"endpoint":"tenderly-mainnet","verified_at":"2026-08-13T06:44:53.713Z","canary_absent_block":"12504267","canary_present_block":"12504268"},"address_status":"safe","spending_authority":{"guard":{"note":null,"status":"none","address":null},"owners":["0x75d91395cd36f24f990bbde69993cb20b96ecfa6","0x7bd3ab8fa37d63c04a8d0bee3298088c0f366709","0x7d7e46bef5064cfae2ced5cc627141005d1cde76","0xfe89cc7abb2c4183683ab71653c4cdc9b02d44b7"],"threshold":2,"owner_count":4,"unilateral_modules":[],"threshold_is_bypassable_by_module":false},"onchain_verified_at":"2026-08-13T06:44:52.937Z"}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.005","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"down","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.005/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.005","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.005","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_blSHQDZu9QStUlEPQ0bll","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.005","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Reads a Gnosis Safe's current owner set, threshold, modules, and guard from chain, then compares against its state at an earlier block to detect and pinpoint any changes in spending authority.","exampleAgentPrompt":"Check if the Gnosis Safe at 0x91c32893216dE3eA0a55ABb9851f581d4503d39b on Ethereum mainnet (chain ID 1) has had any owner, threshold, or module changes in the last 30 days — I need to know if its spending authority has drifted.","exampleUseCases":[{"title":"Post-incident Safe signer audit","prompt":"I just noticed an unexpected transaction from our treasury Safe at 0x91c32893216dE3eA0a55ABb9851f581d4503d39b on Ethereum (chain 1) — can you check if any owners were added or removed or if the threshold changed in the last 30 days, and tell me exactly which block the change happened at?"},{"title":"DAO treasury security monitoring","prompt":"We manage a DAO treasury multisig at 0xAbCd1234...5678 on Arbitrum (chain 42161). Before we execute next month's budget, check whether any signers, modules, or the signing threshold have changed since the last governance vote — flag anything that looks like unauthorized drift."},{"title":"Due diligence on acquired protocol Safe","prompt":"We're acquiring a DeFi protocol and I need to verify the state of their Gnosis Safe at 0xfe89cc7abb2c4183683ab71653c4cdc9b02d44b7 on Base (chain 8453) — can you compare the current owners and threshold against where it was 60 days ago and tell me if any modules were enabled that could move funds without full signer approval?"}],"resultDescription":"Returns a JSON object with: the Safe's current full state (owners list, threshold, modules, guard, nonce, singleton version, block number/timestamp); the baseline state read from chain history at the lookback block; a drift summary indicating 'changed' or 'unchanged', listing added/removed owners, added/removed modules, before/after threshold, before/after guard, the block where the change occurred (found via binary search), the number of archive RPC calls used to find it, and an archive proof showing which endpoint was used and that it can read historical state. Also includes address_status confirming the address is a valid Safe proxy.","failureModes":["Invalid or non-Safe address returns address_status indicating it is not a recognized Safe proxy","Chain ID not supported returns an error listing supported chains","Public RPC without archive capability would fail — endpoint uses archive-capable nodes internally so this is handled, but an unsupported chain_id may surface RPC errors","lookback_blocks set beyond available chain history may return an error or fall back to genesis","Malformed address (not 0x + 40 hex) returns a validation error","Payment failure (x402) results in 402 response before any chain reads occur"],"whenToPreferThis":"Choose this endpoint when you need to detect whether a Gnosis Safe's spending authority has changed without maintaining your own historical baseline or running an indexer. It is especially valuable when historical RPC reads are required (archive nodes), since many public RPCs refuse or prune such requests. Prefer this over manual event log scraping when you need the exact block of change (binary-searched, not assumed), or when module changes — which can move funds with zero owner signatures — are a security concern. It requires no subscription, no prior state storage, and returns a definitive answer on the first call.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-13T02:28:18.169Z","isFirstParty":false,"canonicalSlug":"gnosis-safe-spending-authority-drift-detector-8cb9b25a"}