> ## Documentation Index
> Fetch the complete documentation index at: https://docs.quantumapi.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Compliance and allowlist

> Manage permissioned-transfer rules and allowlists on regulated QRC tokens.

Regulated QRC standards (notably `QRC-1400` and `QRC-3643`) expose policy-controlled, permissioned transfer rules. Qustody surfaces these as a `complianceConfig` document and an `allowlist` collection per token. Updates flow through the standard approval and signing pipeline.

## `GET /v1/tokens/{tokenId}/compliance`

Fetch the current compliance configuration.

```json theme={null}
{
  "tokenId": "token_abc123",
  "config": {
    "permissionedTransfers": true,
    "jurisdictionFlags": ["US-Reg-D-506(c)"],
    "investorEligibilityProvider": "external-kyc-provider-id",
    "transferRestrictions": {
      "minHoldingPeriodSeconds": 31536000,
      "maxHoldersPerJurisdiction": { "US": 99 }
    }
  },
  "updatedAt": "2026-04-27T10:00:00Z"
}
```

## `PATCH /v1/tokens/{tokenId}/compliance`

Update the compliance configuration. Privileged.

| Aspect               | Detail                                                              |
| -------------------- | ------------------------------------------------------------------- |
| Required permissions | `tokens:compliance:update` plus on-chain `COMPLIANCE_OPERATOR` role |
| Idempotency          | `Idempotency-Key` header **required**                               |
| Approval policy      | **Required**                                                        |
| Blockchain effect    | Contract call(s) to the compliance module                           |
| Webhook events       | `token.compliance_updated`, `token.operation_failed`                |

## `POST /v1/tokens/{tokenId}/allowlist`

Add an address to the token's allowlist.

\| Required permissions  | `tokens:allowlist:write` plus on-chain `COMPLIANCE_OPERATOR` role |
\| Idempotency           | `Idempotency-Key` header recommended              |
\| Approval policy       | **Required**                                      |
\| Webhook events        | `token.allowlist_added`, `token.operation_failed` |

### Request body

```json theme={null}
{
  "address": "0x9a8e5e21f0c27d2c5c14b6e9bd8e4a0f9c9b4d12",
  "identityRef": "kyc_subject_001",
  "expiresAt": "2027-04-27T00:00:00Z",
  "idempotencyKey": "allowlist-add-2026-04-27-001"
}
```

## `DELETE /v1/tokens/{tokenId}/allowlist/{address}`

Remove an address from the allowlist. Webhook events: `token.allowlist_removed`, `token.operation_failed`.

### Errors

| Code | Type                                  | Meaning                                                    |
| ---: | ------------------------------------- | ---------------------------------------------------------- |
| 1703 | `TOKEN_NOT_DEPLOYED`                  | Token has no on-chain `contractAddress`.                   |
| 1704 | `TOKEN_OPERATION_NOT_ALLOWED`         | Standard or template does not support compliance controls. |
| 1708 | `TOKEN_ROLE_REQUIRED`                 | Caller lacks the `COMPLIANCE_OPERATOR` role.               |
| 1714 | `TOKEN_COMPLIANCE_RESTRICTION_FAILED` | The compliance module rejected the change.                 |
| 1200 | `POLICY_DENIED`                       | Approval policy denied the operation.                      |
| 1201 | `APPROVAL_REQUIRED`                   | Approval is required and was not yet granted.              |
| 1601 | `IDEMPOTENCY_CONFLICT`                | Same `Idempotency-Key` reused with different body.         |

## Wording and scope

We say:

* "compliance-aware"
* "permissioned transfer rules"
* "policy-controlled"
* "an integration point for identity and compliance systems"

We do not say:

* "automatically legally compliant"
* "fully compliant securities issuance"
* "guaranteed regulatory approval"

## Related

* [Token standards reference](/reference/token-standards)
* [Manage a regulated token (guide)](/guides/manage-a-regulated-token)
* [Security model](/qustody/token-management/security-model)