---
title: "Submit a gasless deposit"
method: POST
path: "/deposits/permit"
tags: ["Processing"]
---

# Submit a gasless deposit

`POST /deposits/permit`

## Request

- Base URL: `https://v1.orchestrator.rhinestone.dev/deposit-processor`
- URL: `https://v1.orchestrator.rhinestone.dev/deposit-processor/deposits/permit`
- Auth: one of:
  - API key in header `x-api-key`
  - HTTP bearer
- TypeScript: <https://skmtc.dev/rhinestonewtf/apis/deposit-service-api/docs/deposits/permit/post.ts> (a function with typed inputs; its response is checked against the schema)

Starts a deposit using a signed token authorization. Experimental.

## Headers

- `x-api-key` string: API key for authentication

## Request body

- union
  - object
    - `account` string, required: Ethereum address (0x followed by 40 hex characters)
    - `sourceChain` string, required: CAIP-2 chain identifier (e.g. "eip155:8453")
    - `token` string, required: Ethereum address (0x followed by 40 hex characters)
    - `amount` string, required: Numeric string representing a bigint value
    - `owner` string, required: Ethereum address (0x followed by 40 hex characters)
    - `signature` string, required: Hex-encoded string (0x followed by hex characters)
    - `kind` 'erc3009', required
    - `nonce` string, required: ERC-3009 bytes32 authorization nonce
    - `validAfter` string, required: Numeric string representing a bigint value
    - `validBefore` string, required: Numeric string representing a bigint value
  - object
    - `account` string, required: Ethereum address (0x followed by 40 hex characters)
    - `sourceChain` string, required: CAIP-2 chain identifier (e.g. "eip155:8453")
    - `token` string, required: Ethereum address (0x followed by 40 hex characters)
    - `amount` string, required: Numeric string representing a bigint value
    - `owner` string, required: Ethereum address (0x followed by 40 hex characters)
    - `signature` string, required: Hex-encoded string (0x followed by hex characters)
    - `kind` 'erc2612', required
    - `nonce` string, required: Numeric string representing a bigint value
    - `deadline` string, required: Numeric string representing a bigint value
  - object
    - `account` string, required: Ethereum address (0x followed by 40 hex characters)
    - `sourceChain` string, required: CAIP-2 chain identifier (e.g. "eip155:8453")
    - `token` string, required: Ethereum address (0x followed by 40 hex characters)
    - `amount` string, required: Numeric string representing a bigint value
    - `owner` string, required: Ethereum address (0x followed by 40 hex characters)
    - `signature` string, required: Hex-encoded string (0x followed by hex characters)
    - `kind` 'permit2', required
    - `nonce` string, required: Numeric string representing a bigint value
    - `deadline` string, required: Numeric string representing a bigint value

## Response `202`

Deposit accepted and processing started

- PermitDepositSubmitResponse
  - `depositId` string, required
  - `txHash` string, required: Hex-encoded string (0x followed by hex characters)
  - `status` 'processing', required

## Other responses

- `400`: Invalid signature (PERMIT-1), deadline outside the acceptance window (PERMIT-2), nonce already used (PERMIT-3), owner funding insufficient (PERMIT-4), or ineligible token/route (PERMIT-5)
- `401`: Missing or invalid API key
- `403`: API key lacks the deposits write scope, or permit deposits are disabled
- `404`: Account not found or not owned by the caller
- `409`: A deposit for this permit already exists
- `422`: Permit refused; no deposit is created (deposits paused `PLATFORM-1`, below the USD minimum `BALANCE-4`, whitelist violation, unsupported token route, or no session for the source chain)
- `503`: Tenant billing verification is temporarily unavailable; retry after 5 seconds.

## Changes

- **2026-11-06** `aa1767d704fa`: 4 info
  - the endpoint scheme security `internalProjectBearer` was added to the API
  - the endpoint scheme security `tenantApiKey` was added to the API
  - the `header` request parameter `x-api-key` became optional
  - added the non-success response with the status `503`
- **2026-09-17** `676300ac19ff`: 6 info
  - added the optional property `code` to the response with the `400` status
  - added the optional property `code` to the response with the `401` status
  - added the optional property `code` to the response with the `403` status
  - added the optional property `code` to the response with the `404` status
  - …2 more
- **2026-09-11** `b49146029e5a`: 1 breaking, 1 warning
  - the `header` request parameter `x-api-key` became required
  - deleted the `header` request parameter `authorization`
- **2026-08-19** `c9aa3f252e4f`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/rhinestonewtf/apis/deposit-service-api/changes/deposits/permit/post.md)

---

[API](https://skmtc.dev/rhinestonewtf/apis/deposit-service-api.md) - [All operations](https://skmtc.dev/rhinestonewtf/apis/deposit-service-api/llms.txt) - [OpenAPI document](https://skmtc.dev/rhinestonewtf/apis/deposit-service-api/revisions/aa1767d704fa?raw)