Skip to main content
Qustody RBAC is built on users, roles, and role assignments. See User roles for the conceptual model and the default 5-role / 12-resource / 6-action matrix.

​
Users

​
Create user

POST /v1/users

curl -X POST https://api.qustody.io/v1/users \
  -H "Authorization: Bearer $QUSTODY_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "email": "alice@example.com",
    "name": "Alice Doe",
    "external_id": "okta:00u..."
  }'
Response 201 
{
  "id": "usr_01HXYZ...",
  "email": "alice@example.com",
  "name": "Alice Doe",
  "status": "active",
  "created_at": "2026-04-27T10:15:00Z"
}

​
List users

GET /v1/users?status=active&page=1&per_page=50

​
Get user

GET /v1/users/{id}

​
Update user

PUT /v1/users/{id}
Updatable fields: name, status (active, suspended).

​
Role assignments

​
Assign role to user

POST /v1/users/{id}/roles

curl -X POST https://api.qustody.io/v1/users/usr_01HXYZ/roles \
  -H "Authorization: Bearer $QUSTODY_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"role_id": "role_approver"}'

​
Revoke role from user

DELETE /v1/users/{id}/roles/{roleId}

​
Roles

Roles are read-only via the API in the current release. The five system roles are seeded automatically.

​
List roles

GET /v1/roles

{
  "roles": [
    {"id": "role_admin", "name": "admin", "description": "Full access"},
    {"id": "role_operator", "name": "operator", "description": "Submit and manage transactions"},
    {"id": "role_viewer", "name": "viewer", "description": "Read-only access"},
    {"id": "role_approver", "name": "approver", "description": "Approve/reject transactions"},
    {"id": "role_compliance_officer", "name": "compliance_officer", "description": "Compliance and audit"}
  ]
}

​
Get role

GET /v1/roles/{id}
Returns the role’s full permission matrix as (resource, action) pairs.

​
Required permissions

EndpointPermission
POST /v1/usersusers:create
GET /v1/users*users:read
PUT /v1/users/{id}users:update
POST /v1/users/{id}/rolesusers:update + roles:read
DELETE /v1/users/{id}/roles/{roleId}users:update
GET /v1/roles*roles:read