---
title: "Prepare a gasless deposit"
method: POST
path: "/deposits/permit/prepare"
tags: ["Processing"]
---

# Prepare a gasless deposit

`POST /deposits/permit/prepare`

## Request

- Base URL: `https://v1.orchestrator.rhinestone.dev/deposit-processor`
- URL: `https://v1.orchestrator.rhinestone.dev/deposit-processor/deposits/permit/prepare`
- Auth: one of:
  - API key in header `x-api-key`
  - HTTP bearer
- TypeScript: <https://skmtc.dev/rhinestonewtf/apis/deposit-service-api/docs/deposits/permit/prepare/post.ts> (a function with typed inputs; its response is checked against the schema)

Prepares a token authorization for the user to sign. Experimental.

## Headers

- `x-api-key` string: API key for authentication

## Request body

- PermitDepositPrepareRequest
  - `account` string, required: Ethereum address (0x followed by 40 hex characters)
  - `sourceChain` string, required: CAIP-2 chain identifier (e.g. "eip155:8453")
  - `token` string, required: Ethereum address (0x followed by 40 hex characters)
  - `amount` string, required: Numeric string representing a bigint value
  - `owner` string, required: Ethereum address (0x followed by 40 hex characters)
  - `kind` 'auto' | 'erc3009' | 'erc2612' | 'permit2': Authorization scheme preference. Auto selects ERC-3009, then ERC-2612, then Permit2.

## Response `200`

Typed data to sign, with the server-chosen nonce and deadline

- union
  - object
    - `available` true, required
    - `authorization` union, required
      - object
        - `kind` 'erc3009', required
        - `typedData` PermitTypedData, required
          - `domain` unknown
          - `types` unknown
          - `primaryType` string, required
          - `message` unknown
        - `nonce` string, required: ERC-3009 bytes32 authorization nonce
        - `validAfter` string, required: Numeric string representing a bigint value
        - `validBefore` string, required: Numeric string representing a bigint value
      - object
        - `kind` 'erc2612' | 'permit2', required
        - `typedData` PermitTypedData, required
          - `domain` unknown
          - `types` unknown
          - `primaryType` string, required
          - `message` unknown
        - `nonce` string, required: Numeric string representing a bigint value
        - `deadline` string, required: Numeric string representing a bigint value
  - object
    - `available` false, required
    - `reason` 'permit2-approval-required' | 'unsupported-token' | 'unsupported-owner', required
    - `approval` object
      - `token` string, required: Ethereum address (0x followed by 40 hex characters)
      - `spender` string, required: Ethereum address (0x followed by 40 hex characters)
      - `minimumAmount` string, required: Numeric string representing a bigint value

## Other responses

- `400`: Malformed request, unsupported source chain, same-chain route, or owner funding insufficient (code PERMIT-4)
- `401`: Missing or invalid API key
- `403`: API key lacks the deposits write scope, or permit deposits are disabled
- `404`: Account not found or not owned by the caller
- `422`: Permit refused; no deposit is created (deposits paused `PLATFORM-1`, below the USD minimum `BALANCE-4`, whitelist violation, unsupported token route, or no session for the source chain)
- `503`: Tenant billing verification is temporarily unavailable; retry after 5 seconds.

## Changes

- **2026-11-06** `aa1767d704fa`: 4 info
  - the endpoint scheme security `internalProjectBearer` was added to the API
  - the endpoint scheme security `tenantApiKey` was added to the API
  - the `header` request parameter `x-api-key` became optional
  - added the non-success response with the status `503`
- **2026-09-17** `676300ac19ff`: 5 info
  - added the optional property `code` to the response with the `400` status
  - added the optional property `code` to the response with the `401` status
  - added the optional property `code` to the response with the `403` status
  - added the optional property `code` to the response with the `404` status
  - …1 more
- **2026-09-11** `b49146029e5a`: 1 breaking, 1 warning
  - the `header` request parameter `x-api-key` became required
  - deleted the `header` request parameter `authorization`
- **2026-08-19** `c9aa3f252e4f`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/rhinestonewtf/apis/deposit-service-api/changes/deposits/permit/prepare/post.md)

---

[API](https://skmtc.dev/rhinestonewtf/apis/deposit-service-api.md) - [All operations](https://skmtc.dev/rhinestonewtf/apis/deposit-service-api/llms.txt) - [OpenAPI document](https://skmtc.dev/rhinestonewtf/apis/deposit-service-api/revisions/aa1767d704fa?raw)