Custody API

Tokenization & Contract Deployment

Qustody provides an audited global QRC contract catalog, managed QRC20 token operations, and a separate deployment path for verified team artifacts. Every deployment and state-changing call follows the normal policy, approval, EnQlave signing, broadcast, and confirmation lifecycle.

Global QRC catalog

GET/v1/tokenization/templates

The global catalog is ordered for operators: QRC20, QRC721, QRC1155, QRC1400, QRC3643, and QRC4626. Template detail includes provenance, compiler target, ABI, source evidence, runtime verification data, and whether the artifact is deployable.

GET/v1/tokenization/templates/{id}

Global and team evidence are different Global entries are immutable built-ins maintained by Qustody. A team upload is private to its tenant, starts UNVERIFIED and non-deployable, and becomes deployable only through an independent review that creates a separate VERIFIED artifact.

Managed QRC20

POST/v1/tokenization/tokens

{
  "networkCode": "QUANTUM_SANDBOX",
  "vaultId": "<network vault UUID>",
  "walletId": "<signing wallet UUID>",
  "templateId": "qrc20-managed-v1",
  "externalId": "treasury-token-001",
  "name": "Treasury Units",
  "symbol": "TRSY",
  "decimals": 18,
  "initialSupply": "1000000000000000000000000",
  "adminAddress": "0x0123456789abcdef0123456789abcdef01234567"
}

The response is a token record linked to a deployment transaction. Treat DEPLOYING as asynchronous work. Qustody marks the token DEPLOYED only after the receipt is confirmed and the on-chain runtime matches the approved template.

Endpoint	Purpose
GET`/v1/tokenization/tokens`	List managed token records
GET`/v1/tokenization/tokens/{id}`	Read deployment and lifecycle status
POST`/v1/tokenization/tokens/{id}/mint`	Mint through a controlled contract transaction
POST`/v1/tokenization/tokens/{id}/burn`	Burn managing-wallet or allowance-backed supply
POST`/v1/tokenization/tokens/{id}/pause`	Pause transfers
POST`/v1/tokenization/tokens/{id}/unpause`	Resume transfers

Verified artifact deployment

POST/v1/contract-artifacts/{id}/deployments

Use generic deployment for a deployable global built-in or a team artifact that has completed verification. Constructor arguments are typed JSON values encoded by Qustody against the stored ABI. Raw creation calldata is not accepted.

{
  "networkCode": "QUANTUM_MAINNET",
  "vaultId": "<network vault UUID>",
  "walletId": "<signing wallet UUID>",
  "externalId": "bond-contract-001",
  "constructorArguments": ["Quantum Bond 2027", "QB27", 1000000]
}

This path creates a contract deployment record, not a managed token record or asset. The deployment becomes DEPLOYED only after receipt and runtime verification.

Operational requirements

Select an explicit network, a vault on that network, and a signing-capable wallet placed in that vault.
Use a unique externalId; retries with a conflicting artifact or network fail closed.
Addresses accept exactly 40 hexadecimal digits with optional 0x; Qustody canonicalizes valid input and never pads or truncates it.
Plan, tenant, credential, artifact, wallet, network, policy, and block controls are rechecked server-side.
Deployment success is asynchronous. Track the returned transaction and deployment record or consume webhooks.