Compliance and allowlist

Regulated QRC standards (notably QRC-1400 and QRC-3643) expose policy-controlled, permissioned transfer rules. Qustody surfaces these as a complianceConfig document and an allowlist collection per token. Updates flow through the standard approval and signing pipeline.

`GET /v1/tokens/{tokenId}/compliance`

Fetch the current compliance configuration.

{
  "tokenId": "token_abc123",
  "config": {
    "permissionedTransfers": true,
    "jurisdictionFlags": ["US-Reg-D-506(c)"],
    "investorEligibilityProvider": "external-kyc-provider-id",
    "transferRestrictions": {
      "minHoldingPeriodSeconds": 31536000,
      "maxHoldersPerJurisdiction": { "US": 99 }
    }
  },
  "updatedAt": "2026-04-27T10:00:00Z"
}

`PATCH /v1/tokens/{tokenId}/compliance`

Update the compliance configuration. Privileged.

Aspect	Detail
Required permissions	`tokens:compliance:update` plus on-chain `COMPLIANCE_OPERATOR` role
Idempotency	`Idempotency-Key` header required
Approval policy	Required
Blockchain effect	Contract call(s) to the compliance module
Webhook events	`token.compliance_updated`, `token.operation_failed`

`POST /v1/tokens/{tokenId}/allowlist`

Request body

{
  "address": "0x9a8e5e21f0c27d2c5c14b6e9bd8e4a0f9c9b4d12",
  "identityRef": "kyc_subject_001",
  "expiresAt": "2027-04-27T00:00:00Z",
  "idempotencyKey": "allowlist-add-2026-04-27-001"
}

`DELETE /v1/tokens/{tokenId}/allowlist/{address}`

Remove an address from the allowlist. Webhook events: token.allowlist_removed, token.operation_failed.

Errors

Code	Type	Meaning
1703	`TOKEN_NOT_DEPLOYED`	Token has no on-chain `contractAddress`.
1704	`TOKEN_OPERATION_NOT_ALLOWED`	Standard or template does not support compliance controls.
1708	`TOKEN_ROLE_REQUIRED`	Caller lacks the `COMPLIANCE_OPERATOR` role.
1714	`TOKEN_COMPLIANCE_RESTRICTION_FAILED`	The compliance module rejected the change.
1200	`POLICY_DENIED`	Approval policy denied the operation.
1201	`APPROVAL_REQUIRED`	Approval is required and was not yet granted.
1601	`IDEMPOTENCY_CONFLICT`	Same `Idempotency-Key` reused with different body.

Wording and scope

We say:

“compliance-aware”
“permissioned transfer rules”
“policy-controlled”
“an integration point for identity and compliance systems”

We do not say:

“automatically legally compliant”
“fully compliant securities issuance”
“guaranteed regulatory approval”

Overview

Health

Tenants

Vaults

Wallets

Transactions

Assets

Tokens

Webhooks

Administration

Compliance and allowlist

`GET /v1/tokens/{tokenId}/compliance`

`PATCH /v1/tokens/{tokenId}/compliance`

`POST /v1/tokens/{tokenId}/allowlist`

Request body

`DELETE /v1/tokens/{tokenId}/allowlist/{address}`

Errors

Wording and scope

​GET /v1/tokens/{tokenId}/compliance

​PATCH /v1/tokens/{tokenId}/compliance

​POST /v1/tokens/{tokenId}/allowlist

​Request body

​DELETE /v1/tokens/{tokenId}/allowlist/{address}

​Errors

​Wording and scope

​Related

`GET /v1/tokens/{tokenId}/compliance`

`PATCH /v1/tokens/{tokenId}/compliance`

`POST /v1/tokens/{tokenId}/allowlist`

Request body

`DELETE /v1/tokens/{tokenId}/allowlist/{address}`

Errors

Wording and scope

Related