Qustody docs
qustody.io EnQlave Open App
Getting started

Qustody Developer Documentation

Qustody is non-custodial digital-asset custody for Quantum Chain. Your keys stay with you: every outbound transaction must be signed by your signer — the EnQlave desktop app or your own signing service — before Qustody will broadcast it. The platform provides vault and wallet management, policy enforcement, AML screening, quantum-safe signature verification, and delivery of every state change via webhooks.

The basics

ItemValue
API base URLhttps://app.qustody.io
ChainQuantum Chain mainnet, chain ID 20803
FormatJSON over HTTPS; timestamps are RFC 3339; IDs are UUIDs
AmountsDecimal integer strings in wei / raw token units — never floats
AuthAuthorization: Bearer <keyId>:<secret> — see Authentication
Max request body1 MB
HealthGET/healthz and /readyz (unauthenticated)
Key material is never accepted Qustody rejects any request body that contains private keys, seeds, or mnemonics — before it reaches a handler. There is no API through which the platform can take custody of a signing key.

The non-custodial model

You / EnQlave Qustody Quantum Chain │ │ │ │ create transaction ─────────▶│ policy · screening · quotas │ │ │ status: PENDING_SIGNATURE │ │ fetch signing payload ◀──────▶│ │ │ sign 32-byte digest locally │ │ │ submit signature ───────────▶│ verify against registered key │ │ │ assemble + re-verify raw tx ───▶│ broadcast │ webhooks ◀────────────────────│ CONFIRMING → COMPLETED │

Qustody stores the transaction intent and the wallet's registered public key. It cannot alter what you signed: before broadcast, the unsigned transaction is rebuilt from stored intent, its hash must equal the digest you signed, and the assembled raw transaction is re-verified field by field. A mismatch fails closed.

Quickstart

1. Create an account

Sign up in the dashboard or via the API, then verify your email. API credentials are issued during onboarding in the dashboard (Keys page); the API itself only lists and rotates keys.

curl -X POST https://app.qustody.io/v1/signup \
  -H 'Content-Type: application/json' \
  -d '{
    "organizationName": "Acme Corp",
    "email": "ops@acme.example",
    "name": "Acme Ops",
    "password": "a-strong-passphrase"
  }'
# 201 → {"tenantId":"…","userId":"…","status":"PENDING_EMAIL_VERIFICATION",…}

2. Create a vault and a wallet

curl -X POST https://app.qustody.io/v1/vault/accounts \
  -H "Authorization: Bearer $QUSTODY_KEY" \
  -H 'Content-Type: application/json' \
  -d '{"name": "Treasury"}'

curl -X POST https://app.qustody.io/v1/vault/accounts/$VAULT_ID/wallets/generate \
  -H "Authorization: Bearer $QUSTODY_KEY" \
  -H 'Content-Type: application/json' \
  -d '{"assetId": "QC", "label": "ops-hot"}'

Or register a wallet whose key lives in your EnQlave signer, proving ownership with a challenge signature — see Register an external wallet.

3. Create a transfer

curl -X POST https://app.qustody.io/v1/transactions \
  -H "Authorization: Bearer $QUSTODY_KEY" \
  -H 'Content-Type: application/json' \
  -H "X-Idempotency-Key: $(uuidgen)" \
  -d '{
    "externalId": "payout-2026-08-001",
    "sourceWalletId": "'$WALLET_ID'",
    "destinationAddress": "0x9f8c…",
    "assetId": "QC",
    "amount": "1000000000000000000"
  }'
# 201 → status SUBMITTED, then PENDING_SIGNATURE once policy and screening clear

4. Sign and broadcast

Open EnQlave — it picks up the pending transaction, shows you exactly what you are signing, and submits the signature. Integrating your own signer instead? The full contract is in Signing & EnQlave.

5. Track completion

curl https://app.qustody.io/v1/transactions/$TX_ID \
  -H "Authorization: Bearer $QUSTODY_KEY"
# status: SIGNED → BROADCASTING → CONFIRMING → COMPLETED (chainTxHash populated)

Or subscribe to webhooks and receive transaction.status_changed events with HMAC-signed payloads.

Where next

Authentication →