API Documentation

Attribution

The free API is free for personal and commercial use. In return, show a visible “Powered by Quantascan” text or badge linking to https://quantascan.io on every page or screen that shows the data: in apps and command-line tools, in the about or credits screen and in your documentation.

Badge in the snippetsLightDark

HTMLCopy HTML

<a href="https://quantascan.io" rel="noopener"><img src="https://quantascan.io/badges/powered-by-quantascan.svg" alt="Powered by Quantascan" width="180" height="40"></a>

MarkdownCopy Markdown

[![Powered by Quantascan](https://quantascan.io/badges/powered-by-quantascan.svg)](https://quantascan.io)

Plain textCopy text

Data: Quantascan (https://quantascan.io)

For apps, command-line tools and docs: put this in your about or credits screen and in your README.

Webhooks

Get a signed POST to your server when a watched address or token contract has on-chain activity: deposit detection without polling. Create endpoints in your account; the signing secret (whsec_…) is shown once. The Free plan includes 2 endpoints and 25 watched addresses (addresses and token contracts, across all endpoints).

Events

• address_activity: native transfers to or from a watched address (QRL and QRL 2.0).
• token_transfer: token transfers involving a watched address and/or a watched token contract (QRL 2.0).
• internal_transfer: value moved by a contract call to or from a watched address (QRL 2.0).
• withdrawal: validator withdrawals to a watched address (QRL 2.0).
• An optional minimum value (base units: shor on QRL, planck on QRL 2.0) filters out small native transfers. Every delivery carries value in base units and value_display in QRL / Quanta.

Payload

{
  "id": "qrl2:0x8f2c…e41a:0:address_activity",
  "type": "address_activity",
  "api_version": "2026-10-22",
  "chain": "qrl2",
  "network": "mainnet",
  "block_height": 1284512,
  "block_hash": "0x5b7d…09c3",
  "timestamp": "2026-10-22T12:00:00Z",
  "tx_hash": "0x8f2c…e41a",
  "from": "Q20b7…a1f4",
  "to": "Q9c0e…77d2",
  "value": "2500000000000000000000",
  "value_display": "2500",
  "unit": "Quanta",
  "token_contract": null,
  "matched_addresses": ["Q9c0e…77d2"],
  "confirmations_at_send": 3,
  "finalized": false,
  "data": {},
  "created_at": "2026-10-22T12:00:40Z"
}

Verifying the signature

Each request carries X-Quantascan-Signature: t=<unix>,v1=<hex>, where v1 is the HMAC-SHA256 of <t>.<raw body> keyed with your secret. Also sent: X-Quantascan-Event, X-Quantascan-Delivery, X-Quantascan-Timestamp and X-Quantascan-Attempt. Reject timestamps older than 5 minutes. For 24 hours after a secret rotation the header carries two v1 values (new secret first): accept the request when any of them matches.

import crypto from "node:crypto";
import express from "express";

const app = express();
const SECRET = process.env.QUANTASCAN_WEBHOOK_SECRET; // whsec_…

// Verify the RAW body bytes — never a re-serialised object.
app.post("/quantascan/webhook", express.raw({ type: "application/json" }), (req, res) => {
  const parts = (req.get("X-Quantascan-Signature") ?? "").split(",");
  const t = parts.find((p) => p.startsWith("t="))?.slice(2);
  const sigs = parts.filter((p) => p.startsWith("v1=")).map((p) => p.slice(3));
  if (!t || Math.abs(Date.now() / 1000 - Number(t)) > 300) return res.sendStatus(400);

  const expected = crypto
    .createHmac("sha256", SECRET)
    .update(`${t}.`)
    .update(req.body)
    .digest("hex");
  const ok = sigs.some(
    (s) => s.length === expected.length &&
      crypto.timingSafeEqual(Buffer.from(s), Buffer.from(expected)),
  );
  if (!ok) return res.sendStatus(401);

  // At-least-once delivery: skip a delivery you already processed.
  const deliveryId = req.get("X-Quantascan-Delivery");
  // if (await alreadyProcessed(deliveryId)) return res.sendStatus(200);

  const event = JSON.parse(req.body.toString("utf8"));
  // event.type: address_activity | token_transfer | internal_transfer | withdrawal | reorg | test
  res.sendStatus(200); // any 2xx = delivered
});

import hashlib, hmac, os, time
from flask import Flask, abort, request

app = Flask(__name__)
SECRET = os.environ["QUANTASCAN_WEBHOOK_SECRET"].encode()  # whsec_…

def verify(header: str, body: bytes, tolerance: int = 300) -> bool:
    parts = [p.split("=", 1) for p in header.split(",") if "=" in p]
    ts = next((v for k, v in parts if k == "t"), "")
    sigs = [v for k, v in parts if k == "v1"]
    if not ts.isdigit() or abs(time.time() - int(ts)) > tolerance:
        return False
    expected = hmac.new(SECRET, ts.encode() + b"." + body, hashlib.sha256).hexdigest()
    return any(hmac.compare_digest(expected, s) for s in sigs)

@app.post("/quantascan/webhook")
def webhook():
    # request.get_data() = the raw body bytes the signature covers.
    if not verify(request.headers.get("X-Quantascan-Signature", ""), request.get_data()):
        abort(401)
    delivery_id = request.headers["X-Quantascan-Delivery"]  # dedupe on this
    event = request.get_json()
    return "", 200

Delivery, retries and reorgs

• At least once. The same event can arrive more than once: dedupe on X-Quantascan-Delivery (equal to the payload id).
• After confirmations: events are sent once the block has 6 confirmations on QRL and 3 on QRL 2.0.
• Retries: any non-2xx answer or a timeout (10 s) is retried after 1 min, 5 min, 30 min, 2 h, 6 h, 12 h and 12 h; after 8 failed attempts the delivery is dead. A Retry-After header is honoured up to 12 h. Redirects are not followed.
• Auto-disable: an endpoint that keeps failing (50 failures in a row over more than 24 hours) is disabled and you get a notification; re-enable it in your account. You can resend any delivery from the deliveries table.
• Reorgs:if a delivered event's block is replaced, you receive a reorg event with id <original id>:reorg. A transaction re-included in a new block is delivered again under a new id.

Explorer-compatible API

A drop-in endpoint for the ?module=…&action=… query format most block-explorer client libraries already speak: point existing client code at the base URL https://quantascan.io/api and pass your key as the apikey query parameter.

curl -s "https://quantascan.io/api?module=account&action=txlist\
&address=Q20b7a1f4…&page=1&offset=25&sort=desc&apikey=qs_your_key_here"

{
  "status": "1",
  "message": "OK",
  "result": [ … ]
}

• Modules: account, contract, transaction, block, logs, stats, gastracker, proxy (node-style action names are translated to the qrl_* methods) and getapilimit.
• QRL 2.0 only. The original QRL chain is served by the REST API.
• Addresses come back Q-prefixed; 0x-prefixed addresses are accepted on input.
• Errors use real HTTP status codes (400, 401, 404, 429, …) with the same {status, message, result} body, so clients can tell a failure from an empty result.
• Contract verification: module=contract&action=verifysourcecode (POST) queues a Hyperion source verification and returns a guid; action=checkverifystatus polls it. Full walkthrough in the contract verification guide.
• Calls count against your plan's daily quota like any other API call.

JSON-RPC endpoint

POST https://quantascan.io/api/v1/qrl2/rpc speaks standard JSON-RPC 2.0 for QRL 2.0, so wallets and RPC libraries can use it like a node. Authenticate with Authorization: Bearer qs_….

curl -s https://quantascan.io/api/v1/qrl2/rpc \
  -H "Authorization: Bearer qs_your_key_here" \
  -H "Content-Type: application/json" \
  -d '[{"jsonrpc":"2.0","id":1,"method":"qrl_blockNumber","params":[]},
       {"jsonrpc":"2.0","id":2,"method":"qrl_getBalance","params":["Q20b7a1f4…","latest"]}]'

• Whitelisted methods: the qrl_* read methods (block number, chain id, sync state, gas price and fee history, balance, nonce, code, storage, qrl_call, qrl_estimateGas, blocks, headers, receipts, transactions and qrl_getLogs) plus net_version, web3_clientVersion and qrl_sendRawTransaction. Anything else (including eth_* names) returns error -32601.
• Batches of up to 20 requests; each item counts as one call against your quota.
• qrl_getLogs needs an address or topic filter and a bounded block range.
• qrl_sendRawTransaction has its own limit of 10 calls per minute per key, on top of your plan limits.

CSV export

GET /api/v1/{chain}/addresses/{address}/export.csv?from=YYYY-MM-DD&to=YYYY-MM-DD&type=… streams one address's history as CSV for tax and accounting tools. The same export is on every address page (“Export CSV”).

curl -sLOJ -H "Authorization: Bearer qs_your_key_here" \
  "https://quantascan.io/api/v1/qrl/addresses/Q0105…/export.csv?from=2025-01-01&to=2025-12-31&type=transactions"

• type: transactions (default), internal, tokens or withdrawals (QRL 2.0 only).
• Columns: date (UTC), block, transaction hash, direction, from, to, value (QRL or Quanta), fee (paid by this address, once per transaction), token, type, status and, where we have a daily price, USD price and value.
• At most 366 days and 100,000 rows per file. A larger range returns 422 (range_too_long or too_many_rows) instead of a truncated file. Export one year, or a shorter range, at a time.
• With an API key it counts as one call; without one (the website) it is limited to 10 exports per hour per IP address.