Policies

Policies enforce constraints on transactions before they leave Qustody. Each policy is attached to a vault and consists of one or more rules. See Policies concepts for the full rule reference. All endpoints require an authenticated principal with the policies:create, policies:read, policies:update, or policies:delete permission as appropriate.

Create policy

POST /v1/policies

curl -X POST https://api.qustody.io/v1/policies \
  -H "Authorization: Bearer $QUSTODY_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "vault_id": "vault_01HXYZ...",
    "name": "treasury-default",
    "rules": [
      {"type": "MAX_AMOUNT", "value": "100000000000000000000"},
      {"type": "REQUIRE_APPROVAL", "value": "2"},
      {"type": "WHITELIST_ADDRESS", "addresses": ["0xabc..."]}
    ]
  }'

Response 201

{
  "id": "pol_01HXYZ...",
  "vault_id": "vault_01HXYZ...",
  "name": "treasury-default",
  "rules": [...],
  "created_at": "2026-04-27T10:15:00Z"
}

List policies

GET /v1/policies?vault_id={id}&page=1&per_page=50

Returns the policies visible to the caller’s tenant. Filterable by vault_id.

Get policy

GET /v1/policies/{id}

Update policy

PUT /v1/policies/{id}

Replaces the rule set in full. Existing transactions in flight are not re-evaluated; future submissions use the new policy.

Delete policy

DELETE /v1/policies/{id}

A vault without a policy accepts any transaction subject to RBAC. Production deployments should keep at least one policy attached.

Errors

Code	Type	When
1100	`VALIDATION`	Invalid rule shape or unknown `type`
1200	`POLICY_DENIED`	Returned by the transaction endpoint, not here
1400	`VAULT_NOT_FOUND`	`vault_id` does not exist in tenant

See the full error catalog.

Vault and wallet lifecycle Users and roles

Overview

Health

Tenants

Vaults

Wallets

Transactions

Assets

Tokens

Webhooks

Administration

Create policy

List policies

Get policy

Update policy

Delete policy

Errors

​Create policy

​List policies

​Get policy

​Update policy

​Delete policy

​Errors

Create policy

List policies

Get policy

Update policy

Delete policy

Errors