Audit validator withdrawal credentials API
Compare caller-supplied Ethereum validator withdrawal credentials with expected types, withdrawal addresses, and ownership mappings. 0x00 is a BLS credential and the other 31 bytes are a hash fragment, not an address. 0x01 and 0x02 decode an execution address only when the next 11 bytes are zero. audit_status is valid, mismatched, warnings, invalid, or incomplete. risk_level is low, medium, high, or critical. A match is not proof of control and was not read from a beacon node.
The Audit validator withdrawal credentials operation is part of the Validator Slashing Protection API on BRAINIAC.software. Compare caller-supplied Ethereum validator withdrawal credentials with expected types, withdrawal addresses, and ownership mappings. 0x00 is a BLS credential and the other 31 bytes are a hash fragment, not an address. 0x01 and 0x02 decode an execution address only when the next 11 bytes are zero. audit_status is valid, mismatched, warnings, invalid, or incomplete. risk_level is low, medium, high, or critical. A match is not proof of control and was not read from a beacon node. It is exposed as POST /api/v1/staking-security/validator-withdrawal-credential-audit and priced at $0.05 USDC on Base. Payment uses the x402 exact scheme: an unpaid call returns HTTP 402 with payment requirements; after paying the exact USDC amount, retry the same request with a payment-signature header and Idempotency-Key. No account and no API key are required. Data sources for this product: Caller-supplied EIP-3076 slashing protection interchanges processed locally Caller-supplied validator deployment inventories processed locally Caller-supplied validator withdrawal credentials processed locally Limitations: An export is not a complete signing history and does not protect against a later signature. Confirmed conflicts use the phase 0 proposer and Casper FFG attester conditions on the supplied records. Records without signing_root are not treated as a confirmed slash when the slot or epochs match. No beacon node is queried, no signature is verified, and private keys are not accepted. Deployment activation is a caller-supplied assertion. It does not show that a validator process is running or stopped. An inactive standby covered by an exclusive failover rule is not reported as a concurrent deployment. Withdrawal credentials are decoded only for prefixes 0x00, 0x01, and 0x02. An execution address is reported only when the 11-byte padding is zero. A matching withdrawal address is not proof of control, and the credentials were not read from a beacon node. Outputs are compliance prechecks, drafts, or data lookups for human review. They are not official determinations, legal advice, identity confirmation, or certified filings. Related operations in this group include Audit validator slashing protection, Audit validator deployment conflicts. Open the group documentation for the full request schema, field notes, and response examples before integrating.
/api/v1/staking-security/validator-withdrawal-credential-auditExample request
curl -i -X POST "https://www.brainiac.software/api/v1/staking-security/validator-withdrawal-credential-audit" \
-H 'content-type: application/json' \
-H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
--data-binary @- <<'JSON'
{
"validators": [
{
"pubkey": "0xaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
"withdrawalCredentials": "0x0100000000000000000000001111111111111111111111111111111111111111"
},
{
"pubkey": "0xbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
"withdrawalCredentials": "0x0100000000000000000000001111111111111111111111111111111111111111"
}
],
"expected": [
{
"pubkey": "0xaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
"credentialType": "execution",
"address": "0x2222222222222222222222222222222222222222"
},
{
"pubkey": "0xbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
"credentialType": "execution",
"address": "0x1111111111111111111111111111111111111111"
},
{
"pubkey": "0xcccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
"credentialType": "execution",
"address": "0x2222222222222222222222222222222222222222"
}
],
"ownership": [
{
"address": "0x1111111111111111111111111111111111111111",
"operator": "treasury",
"beneficiary": "ops"
}
],
"network": "mainnet",
"policy": {
"duplicateDestinations": "prohibit",
"ownership": "require_listed",
"operators": [
"treasury"
]
}
}
JSONAn unpaid probe returns HTTP 402 with x402 payment requirements. After paying the exact USDC amount on Base, retry the identical request with a payment-signature header.
FAQ
- Do I need an API key? No. Pay the listed USDC amount with x402.
- What network? Base (eip155:8453), USDC.
- Is this an official determination? No. Results are for human review against the cited sources.
Related operations
- Audit validator slashing protection — $0.05 USDC
- Audit validator deployment conflicts — $0.05 USDC