List Custody Providers

Returns one row per supported custody provider (rudiq, taurus): its stored configuration, or a not-configured stub for a provider that has never been saved, so every provider can be shown. configured tells the two apart. The response is a plain array, not paginated.

Exactly one provider serves custody at a time: the one with is_active: true. Until a provider is activated, every custody operation fails with a "no active custodial wallet provider configured" error.

Credentials never come back. Only whether each is set (username_set, password_set, api_key_set) and the API key's last four characters (api_key_last4). The inbound webhook secret is reported only as webhook.secret_set.

Platform owner only. The caller's node (the node of the access token) must be the platform root node; any other caller is refused with 403 / 10005.

Required permission: custodial-wallet:view

Request

GET /v2/admin/custodial-wallets

Headers

Name	Description
Authorization	Required. Bearer <access_token>

Example

curl --request GET \
  --url '{{baseUrl}}/v2/admin/custodial-wallets' \
  --header 'Authorization: Bearer <access_token>'

Response

[
  {
    "provider": "rudiq",
    "host": "custody-gateway.custody.svc.cluster.local",
    "port": 8080,
    "timeout": 30,
    "is_active": true,
    "effective_active": true,
    "username_set": false,
    "password_set": false,
    "api_key_set": true,
    "api_key_last4": "7c1e",
    "configured": true,
    "webhook": {
      "auth_type": "basic",
      "path": "/v2/webhooks/custodial",
      "url": "https://integration.example.com/v2/webhooks/custodial",
      "username": "apex-custody",
      "secret_set": true
    },
    "created_at": "2026-09-02T08:14:51.120Z",
    "updated_at": "2026-10-21T13:05:09.774Z"
  },
  {
    "provider": "taurus",
    "host": "",
    "port": 0,
    "timeout": 0,
    "is_active": false,
    "effective_active": false,
    "username_set": false,
    "password_set": false,
    "api_key_set": false,
    "api_key_last4": "",
    "configured": false,
    "webhook": {
      "auth_type": "basic",
      "path": "/v2/webhooks/custodial",
      "url": "https://integration.example.com/v2/webhooks/custodial",
      "username": "",
      "secret_set": false
    }
  }
]

Response Fields

Field	Type	Description
provider	string	Provider key: rudiq or taurus
host	string	Host name of the provider's API
port	integer	Port of the provider's API
timeout	integer	Request timeout in seconds
is_active	boolean	Whether this provider is the one serving custody
effective_active	boolean	Whether this provider is in effect. Always equal to is_active
username_set	boolean	Whether a username is stored
password_set	boolean	Whether a password is stored
api_key_set	boolean	Whether an API key is stored
api_key_last4	string	Last four characters of the stored API key; empty when none is stored or the key is four characters or shorter
configured	boolean	true for a saved provider, false for a not-configured stub
webhook	object	The inbound direction: how this provider calls the platform's custody webhook. Hand these values to the custody side
webhook.auth_type	string	basic (HTTP Basic with username and the secret as password) or token (the secret as Authorization: Bearer <secret> or in an X-Webhook-Token header)
webhook.path	string	Path of the webhook endpoint: /v2/webhooks/custodial
webhook.url	string	Full webhook URL. Omitted when the server has no public base URL configured
webhook.username	string	Username custody sends with basic auth
webhook.secret_set	boolean	Whether a webhook secret has been generated. The secret is shown only once, by Regenerate Webhook Secret
created_at	string	Creation time (ISO 8601). Omitted on a stub
updated_at	string	Last update time (ISO 8601). Omitted on a stub

Errors

Status	Code	Description
403	10005	The caller is not the platform owner (domain 2)

See Errors for the error format and common codes.