# QSTOD ## Docs - Integrations [General](https://docs.qstod.com/general-2220035m0.md): ## API Docs - Identity [Platform liveness probe](https://docs.qstod.com/platform-liveness-probe-38360508e0.md): Platform liveness probe proxied to identity-service `/health/live`. Returns `200` when the service process is running. No authentication required. - Identity [Get JSON Web Key Set](https://docs.qstod.com/get-json-web-key-set-38360509e0.md): Returns the JSON Web Key Set used to verify RS256 JWTs issued by identity-service. Consumed by API gateway and backend services for token validation. - Identity [Login with identifier and password](https://docs.qstod.com/login-with-identifier-and-password-38360510e0.md): Authenticates a user by `identifier` (email or phone) and `password`. If MFA is enabled, returns an MFA challenge (`mfa_session_id`, available methods) instead of tokens. Otherwise returns access and refresh tokens directly. Rate-limited at the gateway (`auth_login`). Returns `401` for invalid credentials, unverified account, or blocked user. - Identity [Logout and invalidate refresh token](https://docs.qstod.com/logout-and-invalidate-refresh-token-38360511e0.md): Invalidates the current session. Accepts optional `refresh_token` in body to revoke refresh token server-side. Requires Bearer access token. Returns `204`. - Identity [Verify MFA during login](https://docs.qstod.com/verify-mfa-during-login-38360512e0.md): Completes login after MFA challenge. Requires `mfa_session_id` (UUID from login response) and OTP `code`. Returns JWT access and refresh tokens on success. Invalid or expired session returns `400 INVALID_SESSION`. - Identity [Refresh access token](https://docs.qstod.com/refresh-access-token-38360513e0.md): Issues a new access token (and optionally rotated refresh token) from a valid `refresh_token`. Public endpoint; no Bearer header required. - Identity [Register a new user](https://docs.qstod.com/register-a-new-user-38360514e0.md): Creates a new retail or business user in identity-service. Exactly one of `email` or `phone` must be provided (not both). Password must meet complexity rules (upper, lower, digit, special). Individual users require `first_name`, `last_name`, and a full postal address with ISO 3166-1 alpha-2 `country`. Returns `201` with `user_id` and verification instructions. Conflicts if email/phone is already registered (`409 CONFLICT`). - Identity [Initiate step-up authentication](https://docs.qstod.com/initiate-step-up-authentication-38360515e0.md): Starts step-up MFA for a sensitive operation. Body: `operation_type` (e.g. `transfer:create`, `card:reveal`, `password:change`). Returns `step_up_session_id` and MFA delivery details. Complete with `POST /v1/auth/step-up/verify` to obtain `X-Step-Up-Token`. - Identity [Verify step-up MFA and issue step-up token](https://docs.qstod.com/verify-step-up-mfa-and-issue-step-up-token-38360516e0.md): Verifies step-up MFA and returns a short-lived `step_up_token` for the `X-Step-Up-Token` header. Public endpoint; requires `step_up_session_id` and OTP `code`. Token is validated by the gateway before forwarding sensitive requests. - Identity [Verify email OTP](https://docs.qstod.com/verify-email-otp-38360517e0.md): Verifies email ownership using OTP sent during registration. Body: `email`, `code`. On success activates the account and returns JWT tokens. - Identity [Verify phone OTP](https://docs.qstod.com/verify-phone-otp-38360518e0.md): Verifies phone ownership using SMS OTP. Body: `phone`, `code`. On success activates the account and returns JWT tokens. - Identity [Platform liveness probe](https://docs.qstod.com/platform-liveness-probe-38360519e0.md): Alias for platform liveness check. Same behavior as `GET /health`. - Identity [Get current user profile](https://docs.qstod.com/get-current-user-profile-38360520e0.md): Returns the authenticated user's profile, MFA settings, and account status. Includes `user_id`, contact info, `profile` (name, address), and `mfa` configuration. - Identity [GET /v1/users/me/mfa](https://docs.qstod.com/get-v1usersmemfa-38360521e0.md): Returns MFA configuration: TOTP status, email/SMS OTP toggles, preferred method. - Identity [PATCH /v1/users/me/mfa](https://docs.qstod.com/patch-v1usersmemfa-38360522e0.md): Updates MFA channel preferences (`email_otp_enabled`, `sms_otp_enabled`). Requires `X-Step-Up-Token` (`mfa:settings`). Cannot disable the last remaining MFA method. SMS requires verified phone. - Identity [DELETE /v1/users/me/mfa/totp](https://docs.qstod.com/delete-v1usersmemfatotp-38360523e0.md): Disables TOTP. Requires `X-Step-Up-Token` (`mfa:totp:disable`), current OTP `code`, and `password`. Returns `204`. - Identity [POST /v1/users/me/mfa/totp/confirm](https://docs.qstod.com/post-v1usersmemfatotpconfirm-38360524e0.md): Confirms TOTP setup with a valid OTP `code` from the authenticator app. Activates TOTP for subsequent logins and step-up flows. - Identity [POST /v1/users/me/mfa/totp/setup](https://docs.qstod.com/post-v1usersmemfatotpsetup-38360525e0.md): Initiates TOTP enrollment. Returns `secret`, `qr_code_url`, and base64 QR image. Must be confirmed with `POST .../totp/confirm` before TOTP is active. - Identity [Change password (step-up required)](https://docs.qstod.com/change-password-step-up-required-38360526e0.md): Changes the user's password. Requires `X-Step-Up-Token` from step-up flow (`password:change`). Body: `current_password`, `new_password` (min 8 chars, complexity rules). New password must differ from current. Returns `204`. - Identity [Update user profile](https://docs.qstod.com/update-user-profile-38360527e0.md): Updates mutable profile fields (`first_name`, `last_name`, `address`). Profile may be locked while KYC is under review (`409 PROFILE_LOCKED_BY_KYC`). Returns `204` on success. - Finance [List openable account types](https://docs.qstod.com/list-openable-account-types-38360528e0.md): Lists account types the user may open (`user_can_open=true`). Includes supported currencies, card eligibility, and interest configuration. - Finance [List user accounts](https://docs.qstod.com/list-user-accounts-38360529e0.md): Lists all accounts owned by the authenticated user with balances and status. - Finance [Open account (step-up required)](https://docs.qstod.com/open-account-step-up-required-38360530e0.md): Opens a new account immediately when account type allows user self-service. Requires step-up (`account:open`) via `X-Step-Up-Token`. Body: `account_type_id`, `currency`, optional `credit_limit` for credit products. - Finance [Aggregated balance history across accounts](https://docs.qstod.com/aggregated-balance-history-across-accounts-38360531e0.md): Aggregated net-worth history across all user accounts in `currency` display currency. Requires FX rates for non-account currencies (`400 FX_RATE_NOT_FOUND` if missing). - Finance [Submit account open request](https://docs.qstod.com/submit-account-open-request-38360532e0.md): Submits an account open request for manual admin review when auto-open is disabled. Optional `card_product_id` for bundled card request. Returns `202`. - Finance [List my account open requests](https://docs.qstod.com/list-my-account-open-requests-38360533e0.md): Lists the user's account open requests and their review status. - Finance [Get accounts summary totals](https://docs.qstod.com/get-accounts-summary-totals-38360534e0.md): Aggregated totals: `total_deposits`, `total_net_worth` across all accounts (FX-converted where applicable). - Finance [Get account details](https://docs.qstod.com/get-account-details-38360535e0.md): Account detail including balance, available balance, credit limit, linked cards. Ownership enforced; returns `403` if account belongs to another user. - Finance [Account balance history](https://docs.qstod.com/account-balance-history-38360536e0.md): Daily balance snapshots for one account over `days` (default 30). Returns opening/current balance, change, and chart points. - Finance [List account ledger transactions](https://docs.qstod.com/list-account-ledger-transactions-38360537e0.md): Paginated ledger transaction history for an account. Filters: `type` (credit/debit), `purpose`, `from`/`to` (RFC3339), `cursor`, `limit`. Ownership required. - Finance [List issuable card products](https://docs.qstod.com/list-issuable-card-products-38360538e0.md): Lists card products available for issuance. Query `for_existing_account=true` filters by account compatibility. - Finance [List user cards](https://docs.qstod.com/list-user-cards-38360539e0.md): Lists payment cards linked to the user's accounts. - Finance [Issue card on existing account (step-up required)](https://docs.qstod.com/issue-card-on-existing-account-step-up-required-38360540e0.md): Issues a card on an existing active account. Step-up required (`card:issue`). Body: `account_id`, `card_product_id`. - Finance [Open account and issue card (step-up required)](https://docs.qstod.com/open-account-and-issue-card-step-up-required-38360541e0.md): Atomic account open + card issue. Step-up uses `account:open`. Returns both account and card objects. - Finance [Get card details](https://docs.qstod.com/get-card-details-38360542e0.md): Card metadata (last four, expiry, product, status). Does not include PAN or CVV. - Finance [Reveal card CVV (step-up required)](https://docs.qstod.com/reveal-card-cvv-step-up-required-38360543e0.md): Returns card CVV. Requires step-up token (`card:reveal`). Short-lived sensitive data; never stored in responses cache. - Finance [Reveal card number](https://docs.qstod.com/reveal-card-number-38360544e0.md): Returns full card number (PAN). Sensitive; logged access. User must own the card. - Finance [Block or unblock card](https://docs.qstod.com/block-or-unblock-card-38360545e0.md): Blocks or unblocks user's card. Body: `action` (`block`|`unblock`), optional `reason`. Step-up required only when `action=block` (`card:block`). - Finance [List recent transfer recipients](https://docs.qstod.com/list-recent-transfer-recipients-38360546e0.md): Recently used transfer recipients for quick re-selection in the UI. - Finance [Search transactions and recipients](https://docs.qstod.com/search-transactions-and-recipients-38360547e0.md): Unified search across ledger transactions and recent recipients. Query `q` required; optional `account_id` UUID scope and `limit`. - Finance [List available transfer types](https://docs.qstod.com/list-available-transfer-types-38360548e0.md): Lists enabled transfer types available to the user with execution mode and fee hints. - Finance [Create transfer (step-up required)](https://docs.qstod.com/create-transfer-step-up-required-38360549e0.md): Creates and executes (or queues) a transfer. Requires step-up (`transfer:create`). Gateway rate limit applies. Returns `201` when completed or `202` when pending manual approval. Errors: `INSUFFICIENT_FUNDS`, `TRANSFER_TYPE_DISABLED`, blocked account/card. - Finance [List user transfers](https://docs.qstod.com/list-user-transfers-38360550e0.md): Lists user's transfers ordered by recency. Query `limit` (default 50). - Finance [Quote transfer fees and FX](https://docs.qstod.com/quote-transfer-fees-and-fx-38360551e0.md): Calculates fees, FX conversion, hold amount, and total debited without creating a transfer. Same body schema as transfer creation. Amount must be positive decimal. - Finance [Get transfer details](https://docs.qstod.com/get-transfer-details-38360552e0.md): Transfer detail including status, amounts, FX, metadata. User must be transfer owner. - Finance [Cancel pending transfer (step-up required)](https://docs.qstod.com/cancel-pending-transfer-step-up-required-38360553e0.md): Cancels a pending/cancellable transfer. Step-up required (`transfer:cancel`). Optional `reason`. Returns `204`. Fails with `NOT_CANCELLABLE` if policy disallows. - Admin > Finance [List pending account requests](https://docs.qstod.com/list-pending-account-requests-38360554e0.md): Pending account open requests awaiting admin review. Requires `account_requests:review`. - Admin > Finance [Review account request](https://docs.qstod.com/review-account-request-38360555e0.md): Approve or reject open request. Body: `action`, optional `reason`. Returns `204`. - Admin > Finance [List account types](https://docs.qstod.com/list-account-types-38360556e0.md): Full account type catalog for admin configuration. Requires `account_types:read`. - Admin > Finance [Create account type](https://docs.qstod.com/create-account-type-38360557e0.md): Creates account type with currencies, card/interest settings. Requires `account_types:write`. - Admin > Finance [Get account type](https://docs.qstod.com/get-account-type-38360558e0.md): Single account type definition. - Admin > Finance [Update account type](https://docs.qstod.com/update-account-type-38360559e0.md): Updates account type configuration. Requires `account_types:write`. - Admin > Finance [Delete account type](https://docs.qstod.com/delete-account-type-38360560e0.md): Deletes account type if unused. Requires `account_types:write`. Returns `204`. - Admin > Finance [List accounts](https://docs.qstod.com/list-accounts-38360561e0.md): Paginated admin account search. Filters: `status`, `currency`, `user_id`, `search`. Requires `accounts:read`. - Admin > Finance [Open account for user](https://docs.qstod.com/open-account-for-user-38360562e0.md): Opens account on behalf of a user. Body: `user_id`, `account_type_id`, `currency`. Requires `accounts:write`. - Admin > Finance [Count accounts](https://docs.qstod.com/count-accounts-38360563e0.md): Account count with same filters as list endpoint. - Admin > Finance [Get account detail](https://docs.qstod.com/get-account-detail-38360564e0.md): Admin account detail: financial snapshot, active holds, linked cards, AML flags. - Admin > Finance [Clear AML flag on account](https://docs.qstod.com/clear-aml-flag-on-account-38360565e0.md): Clears an AML flag on account. Body: `action` must be `clear`, optional `notes`. Requires `accounts:aml_clear`. - Admin > Finance [Close, block, or unblock account](https://docs.qstod.com/close-block-or-unblock-account-38360566e0.md): Close, block, or unblock account. Body: `action` (`close`|`block`|`unblock`), `reason`. Requires `accounts:close`. - Admin > Finance [List account ledger transactions](https://docs.qstod.com/list-account-ledger-transactions-38360567e0.md): Ledger entries for account without user ownership check. Same filters as user endpoint. - Admin > Finance [List account transfers](https://docs.qstod.com/list-account-transfers-38360568e0.md): Paginated transfers that touched this account (sender or recipient). - Admin > Finance [List card payment systems](https://docs.qstod.com/list-card-payment-systems-38360569e0.md): Card network/BIN configuration (Visa, Mastercard, etc.). - Admin > Finance [Create card payment system](https://docs.qstod.com/create-card-payment-system-38360570e0.md): Creates payment system with `name` and `bin_prefix`. - Admin > Finance [Get card payment system](https://docs.qstod.com/get-card-payment-system-38360571e0.md): Payment system detail. - Admin > Finance [Update card payment system](https://docs.qstod.com/update-card-payment-system-38360572e0.md): Updates payment system. - Admin > Finance [List card products](https://docs.qstod.com/list-card-products-38360573e0.md): Admin card product catalog with issuance rules. - Admin > Finance [Create card product](https://docs.qstod.com/create-card-product-38360574e0.md): Creates card product linked to payment system. - Admin > Finance [Get card product](https://docs.qstod.com/get-card-product-38360575e0.md): Card product detail. - Admin > Finance [Update card product](https://docs.qstod.com/update-card-product-38360576e0.md): Updates card product. - Admin > Finance [Issue card (admin)](https://docs.qstod.com/issue-card-admin-38360577e0.md): Issue card for user account. Requires `cards:issue`. - Admin > Finance [Open account and issue card (admin)](https://docs.qstod.com/open-account-and-issue-card-admin-38360578e0.md): Open account and issue card in one operation for a user. - Admin > Finance [Block or unblock card (admin)](https://docs.qstod.com/block-or-unblock-card-admin-38360579e0.md): Admin block/unblock card. Requires `cards:block`. - Admin > Finance [Create fee rule](https://docs.qstod.com/create-fee-rule-38360580e0.md): Creates fee rule (flat, percentage, or tiered). - Admin > Finance [List fee rules](https://docs.qstod.com/list-fee-rules-38360581e0.md): All fee rule definitions including tiered structures. - Admin > Finance [Get fee rule](https://docs.qstod.com/get-fee-rule-38360582e0.md): Single fee rule by UUID. - Admin > Finance [Update fee rule](https://docs.qstod.com/update-fee-rule-38360583e0.md): Updates fee rule configuration. - Admin > Finance [List FX rates](https://docs.qstod.com/list-fx-rates-38360584e0.md): Current FX rate pairs used for multi-currency transfers and balance aggregation. - Admin > Finance [Upsert FX rate](https://docs.qstod.com/upsert-fx-rate-38360585e0.md): Upserts FX rate. Body: `from`, `to` (ISO 4217), positive `rate`. Returns `204`. - Admin > Finance [List transfer type configuration](https://docs.qstod.com/list-transfer-type-configuration-38360586e0.md): Transfer type configuration (enabled, execution mode, fee rules). - Admin > Finance [Update transfer type configuration](https://docs.qstod.com/update-transfer-type-configuration-38360587e0.md): Update transfer type settings. Path `type` is transfer type code. - Admin > Finance [Create admin credit/debit adjustment](https://docs.qstod.com/create-admin-creditdebit-adjustment-38360588e0.md): Manual admin credit or debit adjustment. Body: `type` (`admin_credit`|`admin_debit`), `account_id`, positive `amount`, `purpose`, `reference`. Optional external party for AML. Requires `transfers:adjust`. - Admin > Finance [Count transfers by status](https://docs.qstod.com/count-transfers-by-status-38360589e0.md): Count transfers; optional `status` filter. - Admin > Finance [List pending transfers](https://docs.qstod.com/list-pending-transfers-38360590e0.md): All transfers awaiting manual execution (e.g. outbound SWIFT). - Admin > Finance [Get transfer details (admin)](https://docs.qstod.com/get-transfer-details-admin-38360591e0.md): Full transfer detail including admin fields (user, accounts, metadata). - Admin > Finance [Cancel pending transfer](https://docs.qstod.com/cancel-pending-transfer-38360592e0.md): Admin cancel of pending transfer. Requires `transfers:cancel`. - Admin > Finance [Execute pending transfer](https://docs.qstod.com/execute-pending-transfer-38360593e0.md): Executes a pending transfer after compliance review. Requires `transfers:execute`. Returns `204`. - Admin > Finance [Reject pending transfer](https://docs.qstod.com/reject-pending-transfer-38360594e0.md): Rejects pending transfer with optional `reason`. Requires `transfers:reject`. - Admin > Finance [Export ledger transaction statement](https://docs.qstod.com/export-ledger-transaction-statement-38370556e0.md): Paginated ledger statement across all accounts, a single account, or all accounts of a user. Required query params: `from`, `to` (YYYY-MM-DD). Optional filters: `account_id`, `user_id` (mutually exclusive), `direction` (`credit`|`debit`), `cursor`, `limit` (max 500). Set `format=csv` for streaming CSV export with `Content-Disposition: attachment`. Requires `transfers:read`. - Admin > AML [List AML flags](https://docs.qstod.com/list-aml-flags-38360595e0.md): Paginated AML flags. Filters: `status`, `severity`, `cursor`, `limit`. - Admin > AML [Count AML flags](https://docs.qstod.com/count-aml-flags-38360596e0.md): Count of open AML flags. - Admin > AML [Get AML flag](https://docs.qstod.com/get-aml-flag-38360597e0.md): AML flag detail with matched rule and account context. - Admin > AML [Clear or mark false positive on AML flag](https://docs.qstod.com/clear-or-mark-false-positive-on-aml-flag-38360598e0.md): Resolve flag: `clear` or `mark_false_positive` with optional `notes`. - Admin > AML [List AML rules](https://docs.qstod.com/list-aml-rules-38360599e0.md): Lists AML monitoring rules (threshold, pattern, velocity types). - Admin > AML [Create AML rule](https://docs.qstod.com/create-aml-rule-38360600e0.md): Creates AML rule with `name`, `type`, `config` JSON, and `action`. - Admin > AML [Get AML rule](https://docs.qstod.com/get-aml-rule-38360601e0.md): Single AML rule definition. - Admin > AML [Update AML rule](https://docs.qstod.com/update-aml-rule-38360602e0.md): Updates rule enabled state, config, or action. - Admin > AML [Delete AML rule](https://docs.qstod.com/delete-aml-rule-38360603e0.md): Deletes AML rule. Returns `204`. - Admin > Crypto [List crypto wallets (admin)](https://docs.qstod.com/list-crypto-wallets-admin-38360604e0.md): All custodial wallets. Query `scope`: `all`, `system`, or `user`. - Admin > Crypto [Refresh wallet balance (admin)](https://docs.qstod.com/refresh-wallet-balance-admin-38360605e0.md): Fetches live on-chain balance from custodian and updates cached balance. - Admin > Compliance [List KYB applications](https://docs.qstod.com/list-kyb-applications-38360606e0.md): Paginated KYB application queue. Requires `kyb:read`. - Admin > Compliance [Get KYB application by user](https://docs.qstod.com/get-kyb-application-by-user-38360607e0.md): KYB application for a specific business user. - Admin > Compliance [Count KYB applications](https://docs.qstod.com/count-kyb-applications-38360608e0.md): Count of KYB applications. Requires `kyb:read`. - Admin > Compliance [Get KYB application details](https://docs.qstod.com/get-kyb-application-details-38360609e0.md): Full KYB application with beneficial owners, documents, and audit log. - Admin > Compliance [Review KYB application](https://docs.qstod.com/review-kyb-application-38360610e0.md): Review KYB application: approve, reject, or request additional info. Requires `kyb:review`. - Admin > Compliance [List KYC applications](https://docs.qstod.com/list-kyc-applications-38360611e0.md): Paginated KYC application queue. Filter by `status`, `cursor`, `limit`. Requires `kyc:read`. - Admin > Compliance [Get KYC application by user](https://docs.qstod.com/get-kyc-application-by-user-38360612e0.md): KYC application for a specific user UUID. Includes documents and audit log. - Admin > Compliance [Count KYC applications](https://docs.qstod.com/count-kyc-applications-38360613e0.md): Count of KYC applications, optionally by `status`. Requires `kyc:read`. - Admin > Compliance [Get KYC application details](https://docs.qstod.com/get-kyc-application-details-38360614e0.md): Full KYC application detail: application, user info, documents, audit trail. - Admin > Compliance [Review KYC application](https://docs.qstod.com/review-kyc-application-38360615e0.md): Review decision: `approve`, `reject`, or `request_info`. Rejection requires `rejection_reason`. Requires `kyc:review`. Returns `204`. - Admin > Notifications [Send admin message to user](https://docs.qstod.com/send-admin-message-to-user-38360616e0.md): Sends admin-authored message to a user via selected `channels[]`. Body: `user_id`, `subject`, `body`. Returns `202` (async delivery). - Admin > Notifications [List notification templates](https://docs.qstod.com/list-notification-templates-38360617e0.md): Message templates per notification type and channel. - Admin > Notifications [Create notification template](https://docs.qstod.com/create-notification-template-38360618e0.md): Creates notification template. - Admin > Notifications [List template variables](https://docs.qstod.com/list-template-variables-38360619e0.md): Available template variable placeholders for substitution. - Admin > Notifications [Get notification template](https://docs.qstod.com/get-notification-template-38360620e0.md): Single template with subject/body content. - Admin > Notifications [Update notification template](https://docs.qstod.com/update-notification-template-38360621e0.md): Updates template content. - Admin > Notifications [Delete notification template](https://docs.qstod.com/delete-notification-template-38360622e0.md): Deletes template. Returns `204`. - Admin > Notifications [List notification types](https://docs.qstod.com/list-notification-types-38360623e0.md): Catalog of notification type codes and display names. - Admin > Notifications [Create notification type](https://docs.qstod.com/create-notification-type-38360624e0.md): Registers new notification type. - Admin > Notifications [Update notification type](https://docs.qstod.com/update-notification-type-38360625e0.md): Updates notification type metadata. - Admin > Identity [List permission action catalog](https://docs.qstod.com/list-permission-action-catalog-38360626e0.md): Catalog of all grantable admin permission action strings with descriptions. Requires `admin_users:read`. - Admin > Identity [List users (admin)](https://docs.qstod.com/list-users-admin-38360627e0.md): Paginated list of platform users for admin review. Query: `search`, `cursor`, `limit` (max 100). Requires admin JWT with `users:read` permission. - Admin > Identity [Create admin user](https://docs.qstod.com/create-admin-user-38360628e0.md): Creates a new admin user with explicit permission `actions` list. Body: `email`, `password`, `first_name`, `last_name`, `actions[]`. Requires `admin_users:manage`. Returns `201` with `user_id`. - Admin > Identity [Count users (admin)](https://docs.qstod.com/count-users-admin-38360629e0.md): Returns total user count, optionally filtered by `search` query. Requires `users:read`. - Admin > Identity [Get user details (admin)](https://docs.qstod.com/get-user-details-admin-38360630e0.md): Full user record including profile, status, role, and timestamps. Path `id` is user UUID. Requires `users:read`. - Admin > Identity [Update user profile (admin)](https://docs.qstod.com/update-user-profile-admin-38360631e0.md): Admin update of user profile fields. Requires `users:block` permission at gateway. Returns `204`. - Admin > Identity [Get user permissions](https://docs.qstod.com/get-user-permissions-38360632e0.md): Lists permission actions currently granted to the user. Requires `admin_users:read`. - Admin > Identity [Grant permissions](https://docs.qstod.com/grant-permissions-38360633e0.md): Grants additional permission actions to an admin user. Body: `actions[]`. Requires `admin_users:manage`. Returns `204`. - Admin > Identity [Revoke permissions](https://docs.qstod.com/revoke-permissions-38360634e0.md): Revokes permission actions from an admin user. Body: `actions[]`. Requires `admin_users:manage`. Returns `204`. - Admin > Identity [Promote user to admin](https://docs.qstod.com/promote-user-to-admin-38360635e0.md): Promotes a retail user to admin with given `actions[]`. Requires `admin_users:manage`. Returns `201`. - Admin > Identity [Block or unblock user](https://docs.qstod.com/block-or-unblock-user-38360636e0.md): Blocks or unblocks a user. Body: `status` (`active`|`blocked`), optional `reason`. Cannot change status of other admin users. Requires `users:block`. - Admin > Tickets [List tickets (admin)](https://docs.qstod.com/list-tickets-admin-38360637e0.md): All tickets. Filters: `status`, `category`, `user_id`, pagination. Requires `tickets:read`. - Admin > Tickets [Get ticket (admin)](https://docs.qstod.com/get-ticket-admin-38360638e0.md): Admin view of ticket with full message history. - Admin > Tickets [Close ticket](https://docs.qstod.com/close-ticket-38360639e0.md): Closes ticket. Body: `action=close`, `closing_message`. Requires `tickets:close`. - Admin > Tickets [Reply to ticket (admin)](https://docs.qstod.com/reply-to-ticket-admin-38360640e0.md): Admin reply to ticket. Requires `tickets:reply`. - Admin > Tickets [POST /v1/admin/tickets/{id}/messages/{message_id}/attachments](https://docs.qstod.com/post-v1adminticketsidmessagesmessage-idattachments-38360641e0.md): Admin direct attachment upload. - Admin > Tickets [POST /v1/admin/tickets/{id}/messages/{message_id}/attachments/upload-url](https://docs.qstod.com/post-v1adminticketsidmessagesmessage-idattachmentsupload-url-38360642e0.md): Admin presigned attachment upload URL. - Admin > Tickets [POST /v1/admin/tickets/{id}/messages/{message_id}/attachments/{attachment_id}/confirm](https://docs.qstod.com/post-v1adminticketsidmessagesmessage-idattachmentsattachment-idconfirm-38360643e0.md): Admin confirm attachment upload. - Crypto [Get crypto portfolio balance](https://docs.qstod.com/get-crypto-portfolio-balance-38360644e0.md): Portfolio balance aggregated in USD from ledger/wallet state. - Crypto [Get crypto balance history snapshots](https://docs.qstod.com/get-crypto-balance-history-snapshots-38360645e0.md): Historical portfolio USD totals for charting. Query `days` (default 30). - Crypto [List crypto assets and ensure wallets](https://docs.qstod.com/list-crypto-assets-and-ensure-wallets-38360646e0.md): Supported crypto assets and fiat currencies. Side effect: ensures custodial wallets exist for the user (cached in Redis). - Crypto [List crypto deposits](https://docs.qstod.com/list-crypto-deposits-38360647e0.md): Detected inbound deposits for user's wallets. - Crypto [Create crypto order from quote](https://docs.qstod.com/create-crypto-order-from-quote-38360648e0.md): Executes buy/sell from a prior quote. Requires `Idempotency-Key` header. Body: `quote_id`, `fiat_account_id`. Quote must not be expired. - Crypto [List crypto orders](https://docs.qstod.com/list-crypto-orders-38360649e0.md): User's crypto trade orders. - Crypto [Get crypto order](https://docs.qstod.com/get-crypto-order-38360650e0.md): Single order status and fill details. - Crypto [Get buy/sell quote](https://docs.qstod.com/get-buysell-quote-38360651e0.md): Indicative buy/sell quote. Query: `side`, `asset`, `network_id`, `fiat_currency`, and either `fiat_amount` or `crypto_amount`. - Crypto [List crypto transactions](https://docs.qstod.com/list-crypto-transactions-38360652e0.md): Unified crypto activity: deposits, withdrawals, buy/sell orders. - Crypto [List user crypto wallets](https://docs.qstod.com/list-user-crypto-wallets-38360653e0.md): User's on-chain wallet addresses and cached balances per asset/network. - Crypto [Create crypto withdrawal (step-up required)](https://docs.qstod.com/create-crypto-withdrawal-step-up-required-38360654e0.md): On-chain withdrawal to external address. Requires `Idempotency-Key` and step-up (`crypto:withdraw`). Validates sufficient wallet balance (`INSUFFICIENT_BALANCE`). - Crypto [Privy custodian webhook](https://docs.qstod.com/privy-custodian-webhook-38360655e0.md): Inbound webhook from Privy custodian (deposits, tx confirmations). Public endpoint; HMAC signature verified via `X-Privy-Signature` or `svix-signature`. Returns `204` on acceptance. - Compliance [Submit KYB application](https://docs.qstod.com/submit-kyb-application-38360656e0.md): Submits KYB business verification. Required: company details, legal address, at least one beneficial owner. Total `ownership_percent` across owners must not exceed 100%. - Compliance [Get my KYB application](https://docs.qstod.com/get-my-kyb-application-38360657e0.md): Returns current KYB application status or full application with documents. - Compliance [POST /v1/kyb/applications/{id}/documents](https://docs.qstod.com/post-v1kybapplicationsiddocuments-38360658e0.md): Direct multipart KYB document upload (max 5MB). - Compliance [POST /v1/kyb/applications/{id}/documents/upload-url](https://docs.qstod.com/post-v1kybapplicationsiddocumentsupload-url-38360659e0.md): Presigned upload URL for KYB documents (registration certificate, articles, UBO IDs). - Compliance [POST /v1/kyb/applications/{id}/documents/{document_id}/confirm](https://docs.qstod.com/post-v1kybapplicationsiddocumentsdocument-idconfirm-38360660e0.md): Confirms KYB document upload completion. Returns `204`. - Compliance [Submit KYC application](https://docs.qstod.com/submit-kyc-application-38360661e0.md): Submits a KYC identity verification application. Required: name, nationality, document type/number, DOB (18+), document expiry (future date), address. Document types: `passport`, `id_card`, `drivers_license`. Returns `409` if an active application already exists. - Compliance [Get my KYC application](https://docs.qstod.com/get-my-kyc-application-38360662e0.md): Returns current KYC application status or full application if submitted. - Compliance [Get KYC draft prefilled from profile](https://docs.qstod.com/get-kyc-draft-prefilled-from-profile-38360663e0.md): Returns a draft KYC form prefilled from the user profile with `missing_fields` list. Useful before first submission. - Compliance [POST /v1/kyc/applications/{id}/documents](https://docs.qstod.com/post-v1kycapplicationsiddocuments-38360664e0.md): Direct multipart upload (max 5MB). Fields: `file`, `scan_type`. Alternative to presigned URL flow. - Compliance [POST /v1/kyc/applications/{id}/documents/upload-url](https://docs.qstod.com/post-v1kycapplicationsiddocumentsupload-url-38360665e0.md): Requests a presigned URL for document upload. Body: `scan_type`, `content_type`, `file_name`. Valid scan types include passport/id fronts and backs, selfie, proof of address. - Compliance [POST /v1/kyc/applications/{id}/documents/{document_id}/confirm](https://docs.qstod.com/post-v1kycapplicationsiddocumentsdocument-idconfirm-38360666e0.md): Confirms that a document was uploaded to the presigned URL. Triggers async verification processing. Returns `204`. - Compliance [Skip KYC when allowed](https://docs.qstod.com/skip-kyc-when-allowed-38360667e0.md): Skips KYC when policy allows (e.g. certain account types). Returns updated compliance status. - Notifications [List in-app notifications](https://docs.qstod.com/list-in-app-notifications-38360668e0.md): In-app notification inbox. Query: `cursor`, `limit`, `unread_only=true`. Includes `unread_count`. - Notifications [Get notification channel preferences](https://docs.qstod.com/get-notification-channel-preferences-38360669e0.md): Per notification-type channel preferences (email, SMS, push, in-app). - Notifications [Update notification preferences](https://docs.qstod.com/update-notification-preferences-38360670e0.md): Bulk update channel preferences. Body: `preferences[]` with `type` and channel booleans. - Notifications [Mark all notifications as read](https://docs.qstod.com/mark-all-notifications-as-read-38360671e0.md): Marks all notifications read for the user. Returns `204`. - Notifications [Mark notification as read](https://docs.qstod.com/mark-notification-as-read-38360672e0.md): Marks single notification as read. Returns `204`. - Tickets [Create support ticket](https://docs.qstod.com/create-support-ticket-38360673e0.md): Creates support ticket with initial message. Subject 3-200 chars; category enum; body 1-5000 chars. - Tickets [List user tickets](https://docs.qstod.com/list-user-tickets-38360674e0.md): User's tickets. Filter: `status` (active/closed), pagination. - Tickets [Get ticket with messages](https://docs.qstod.com/get-ticket-with-messages-38360675e0.md): Ticket thread with messages and attachment download URLs. - Tickets [Add message to ticket](https://docs.qstod.com/add-message-to-ticket-38360676e0.md): Adds user reply. Fails with `TICKET_CLOSED` if ticket is closed. - Tickets [POST /v1/tickets/{id}/messages/{message_id}/attachments](https://docs.qstod.com/post-v1ticketsidmessagesmessage-idattachments-38360677e0.md): Direct multipart attachment upload (max 5MB). - Tickets [POST /v1/tickets/{id}/messages/{message_id}/attachments/upload-url](https://docs.qstod.com/post-v1ticketsidmessagesmessage-idattachmentsupload-url-38360678e0.md): Presigned URL for ticket attachment (max size enforced server-side). - Tickets [POST /v1/tickets/{id}/messages/{message_id}/attachments/{attachment_id}/confirm](https://docs.qstod.com/post-v1ticketsidmessagesmessage-idattachmentsattachment-idconfirm-38360679e0.md): Confirms attachment upload. Returns `204`. ## Schemas - [Problem](https://docs.qstod.com/problem-15930340d0.md): - [Address](https://docs.qstod.com/address-15930341d0.md): - [RegisterRequest](https://docs.qstod.com/registerrequest-15930342d0.md): - [LoginRequest](https://docs.qstod.com/loginrequest-15930343d0.md): - [MFAVerifyRequest](https://docs.qstod.com/mfaverifyrequest-15930344d0.md): - [OpenAccountRequest](https://docs.qstod.com/openaccountrequest-15930345d0.md): - [TransferRequest](https://docs.qstod.com/transferrequest-15930346d0.md): - [CryptoWithdrawalRequest](https://docs.qstod.com/cryptowithdrawalrequest-15930347d0.md): - [CreateTicketRequest](https://docs.qstod.com/createticketrequest-15930348d0.md): - [KYCSubmitRequest](https://docs.qstod.com/kycsubmitrequest-15930349d0.md): - [KYBSubmitRequest](https://docs.qstod.com/kybsubmitrequest-15930350d0.md): - [AdminTransferAdjustRequest](https://docs.qstod.com/admintransferadjustrequest-15930351d0.md): - [CountResponse](https://docs.qstod.com/countresponse-15930393d0.md): - [MessageResponse](https://docs.qstod.com/messageresponse-15930394d0.md): - [TokenResponse](https://docs.qstod.com/tokenresponse-15930395d0.md): - [RegisterResponse](https://docs.qstod.com/registerresponse-15930396d0.md): - [LoginResponse](https://docs.qstod.com/loginresponse-15930397d0.md): - [StepUpInitResponse](https://docs.qstod.com/stepupinitresponse-15930398d0.md): - [StepUpVerifyResponse](https://docs.qstod.com/stepupverifyresponse-15930399d0.md): - [UserProfile](https://docs.qstod.com/userprofile-15930400d0.md): - [UserProfileDetails](https://docs.qstod.com/userprofiledetails-15930401d0.md): - [MFASettings](https://docs.qstod.com/mfasettings-15930402d0.md): - [TOTPSetupResponse](https://docs.qstod.com/totpsetupresponse-15930403d0.md): - [JWKSResponse](https://docs.qstod.com/jwksresponse-15930404d0.md): - [AdminUser](https://docs.qstod.com/adminuser-15930405d0.md): - [AdminUserList](https://docs.qstod.com/adminuserlist-15930406d0.md): - [PermissionActionsResponse](https://docs.qstod.com/permissionactionsresponse-15930407d0.md): - [UserPermissionsResponse](https://docs.qstod.com/userpermissionsresponse-15930408d0.md): - [AccountType](https://docs.qstod.com/accounttype-15930409d0.md): - [AccountTypeList](https://docs.qstod.com/accounttypelist-15930410d0.md): - [TransferTypeConfig](https://docs.qstod.com/transfertypeconfig-15930411d0.md): - [TransferTypeList](https://docs.qstod.com/transfertypelist-15930412d0.md): - [CardProduct](https://docs.qstod.com/cardproduct-15930413d0.md): - [CardProductList](https://docs.qstod.com/cardproductlist-15930414d0.md): - [UserAccount](https://docs.qstod.com/useraccount-15930415d0.md): - [UserAccountList](https://docs.qstod.com/useraccountlist-15930416d0.md): - [AccountsSummary](https://docs.qstod.com/accountssummary-15930417d0.md): - [UserAccountDetail](https://docs.qstod.com/useraccountdetail-15930418d0.md): - [AccountOpenRequest](https://docs.qstod.com/accountopenrequest-15930419d0.md): - [AccountOpenRequestList](https://docs.qstod.com/accountopenrequestlist-15930420d0.md): - [Transaction](https://docs.qstod.com/transaction-15930421d0.md): - [TransactionListResponse](https://docs.qstod.com/transactionlistresponse-15930422d0.md): - [StatementLine](https://docs.qstod.com/statementline-15936380d0.md): - [TransactionStatementList](https://docs.qstod.com/transactionstatementlist-15936381d0.md): - [BalancePoint](https://docs.qstod.com/balancepoint-15930423d0.md): - [BalanceHistory](https://docs.qstod.com/balancehistory-15930424d0.md): - [AllAccountsBalanceHistory](https://docs.qstod.com/allaccountsbalancehistory-15930425d0.md): - [Card](https://docs.qstod.com/card-15930426d0.md): - [CardList](https://docs.qstod.com/cardlist-15930427d0.md): - [CardNumberResponse](https://docs.qstod.com/cardnumberresponse-15930428d0.md): - [CardCVVResponse](https://docs.qstod.com/cardcvvresponse-15930429d0.md): - [CardWithAccountResponse](https://docs.qstod.com/cardwithaccountresponse-15930430d0.md): - [Transfer](https://docs.qstod.com/transfer-15930431d0.md): - [AdminTransfer](https://docs.qstod.com/admintransfer-15930432d0.md): - [TransferList](https://docs.qstod.com/transferlist-15930433d0.md): - [AdminTransferList](https://docs.qstod.com/admintransferlist-15930434d0.md): - [TransferQuote](https://docs.qstod.com/transferquote-15930435d0.md): - [RecentRecipient](https://docs.qstod.com/recentrecipient-15930436d0.md): - [RecentRecipientList](https://docs.qstod.com/recentrecipientlist-15930437d0.md): - [SearchResponse](https://docs.qstod.com/searchresponse-15930438d0.md): - [AdminAccount](https://docs.qstod.com/adminaccount-15930439d0.md): - [AdminAccountList](https://docs.qstod.com/adminaccountlist-15930440d0.md): - [AdminAccountDetail](https://docs.qstod.com/adminaccountdetail-15930441d0.md): - [FeeRule](https://docs.qstod.com/feerule-15930442d0.md): - [FeeRuleList](https://docs.qstod.com/feerulelist-15930443d0.md): - [FxRate](https://docs.qstod.com/fxrate-15930444d0.md): - [FxRateList](https://docs.qstod.com/fxratelist-15930445d0.md): - [CardPaymentSystem](https://docs.qstod.com/cardpaymentsystem-15930446d0.md): - [CardPaymentSystemList](https://docs.qstod.com/cardpaymentsystemlist-15930447d0.md): - [AdminCardProduct](https://docs.qstod.com/admincardproduct-15930448d0.md): - [AdminCardProductList](https://docs.qstod.com/admincardproductlist-15930449d0.md): - [AMLRule](https://docs.qstod.com/amlrule-15930450d0.md): - [AMLRuleList](https://docs.qstod.com/amlrulelist-15930451d0.md): - [AMLFlag](https://docs.qstod.com/amlflag-15930452d0.md): - [AMLFlagList](https://docs.qstod.com/amlflaglist-15930453d0.md): - [Notification](https://docs.qstod.com/notification-15930454d0.md): - [NotificationListResponse](https://docs.qstod.com/notificationlistresponse-15930455d0.md): - [NotificationPreferencesResponse](https://docs.qstod.com/notificationpreferencesresponse-15930456d0.md): - [NotificationType](https://docs.qstod.com/notificationtype-15930457d0.md): - [NotificationTypeList](https://docs.qstod.com/notificationtypelist-15930458d0.md): - [NotificationTemplate](https://docs.qstod.com/notificationtemplate-15930459d0.md): - [NotificationTemplateList](https://docs.qstod.com/notificationtemplatelist-15930460d0.md): - [TemplateVariablesResponse](https://docs.qstod.com/templatevariablesresponse-15930461d0.md): - [TicketSummary](https://docs.qstod.com/ticketsummary-15930462d0.md): - [TicketListResponse](https://docs.qstod.com/ticketlistresponse-15930463d0.md): - [TicketDetail](https://docs.qstod.com/ticketdetail-15930464d0.md): - [TicketMessage](https://docs.qstod.com/ticketmessage-15930465d0.md): - [TicketCloseResponse](https://docs.qstod.com/ticketcloseresponse-15930466d0.md): - [UploadURLResponse](https://docs.qstod.com/uploadurlresponse-15930467d0.md): - [DocumentCreatedResponse](https://docs.qstod.com/documentcreatedresponse-15930468d0.md): - [AttachmentCreatedResponse](https://docs.qstod.com/attachmentcreatedresponse-15930469d0.md): - [KYCApplication](https://docs.qstod.com/kycapplication-15930470d0.md): - [KYCApplicationDetail](https://docs.qstod.com/kycapplicationdetail-15930471d0.md): - [KYCApplicationList](https://docs.qstod.com/kycapplicationlist-15930472d0.md): - [KYBApplication](https://docs.qstod.com/kybapplication-15930473d0.md): - [KYBApplicationDetail](https://docs.qstod.com/kybapplicationdetail-15930474d0.md): - [KYBApplicationList](https://docs.qstod.com/kybapplicationlist-15930475d0.md): - [KYCDraftResponse](https://docs.qstod.com/kycdraftresponse-15930476d0.md): - [KYCStatusResponse](https://docs.qstod.com/kycstatusresponse-15930477d0.md): - [KYCSubmitResponse](https://docs.qstod.com/kycsubmitresponse-15930478d0.md): - [CryptoAsset](https://docs.qstod.com/cryptoasset-15930479d0.md): - [CryptoWallet](https://docs.qstod.com/cryptowallet-15930480d0.md): - [CryptoAssetsResponse](https://docs.qstod.com/cryptoassetsresponse-15930481d0.md): - [CryptoWalletList](https://docs.qstod.com/cryptowalletlist-15930482d0.md): - [CryptoAccountBalance](https://docs.qstod.com/cryptoaccountbalance-15930483d0.md): - [CryptoBalanceSnapshots](https://docs.qstod.com/cryptobalancesnapshots-15930484d0.md): - [CryptoTransaction](https://docs.qstod.com/cryptotransaction-15930485d0.md): - [CryptoTransactionList](https://docs.qstod.com/cryptotransactionlist-15930486d0.md): - [CryptoQuote](https://docs.qstod.com/cryptoquote-15930487d0.md): - [CryptoOrder](https://docs.qstod.com/cryptoorder-15930488d0.md): - [CryptoOrderList](https://docs.qstod.com/cryptoorderlist-15930489d0.md): - [CryptoWithdrawal](https://docs.qstod.com/cryptowithdrawal-15930490d0.md): - [CryptoDeposit](https://docs.qstod.com/cryptodeposit-15930491d0.md): - [CryptoDepositList](https://docs.qstod.com/cryptodepositlist-15930492d0.md): - [AdminCryptoWallet](https://docs.qstod.com/admincryptowallet-15930493d0.md): - [AdminCryptoWalletList](https://docs.qstod.com/admincryptowalletlist-15930494d0.md): - [AdminCryptoWalletBalance](https://docs.qstod.com/admincryptowalletbalance-15930495d0.md): - [HealthResponse](https://docs.qstod.com/healthresponse-15930496d0.md):