---
title: "Update client settings"
method: POST
path: "/setup"
tags: ["Clients"]
---

# Update client settings

`POST /setup`

## Request

- Base URL: `https://v1.orchestrator.rhinestone.dev/deposit-processor`
- URL: `https://v1.orchestrator.rhinestone.dev/deposit-processor/setup`
- Auth: one of:
  - API key in header `x-api-key`
  - HTTP bearer
- TypeScript: <https://skmtc.dev/rhinestonewtf/apis/deposit-service-api/docs/setup/post.ts> (a function with typed inputs; its response is checked against the schema)

Updates client configuration for the authenticated project. Requires the deposits:admin API key scope.

## Headers

- `x-api-key` string: API key for authentication
- `x-api-version` string: API version identifier (e.g. "2026-04.amazon"). Optional today, will become required in a future release.

## Request body

- SetupRequestBody
  - `params` ClientInput, required
    - `webhookUrl` string, uri, nullable
    - `webhookSecret` string, nullable
    - `sponsorship` object
    - `depositWhitelist` DepositWhitelist: Per-source-chain deposit allowlist keyed by CAIP-2 chain identifiers (for example "eip155:8453"). Each key maps to allowed source tokens and optional min/max amount limits in raw token units.
    - `swapQuoters` ProjectSwapQuoters: List of swap venues we may request quotes from, keyed by the EVM chain the swap is FUNDED FROM (CAIP-2, eip155 only). For every EVM deposit that is the chain it arrived on; a HyperCore-origin deposit swaps on HyperEVM, so key it "eip155:999". A routing preference applied when quoting, not a restriction on the account: it does not survive compromise of the executor key, and excluding a venue that would have priced better costs price. Omit a chain to leave it unconstrained. `quoters` applies per intent, so on a cross-chain route the funding chain's list bounds the whole route, and an entry for the destination chain does not constrain a route funded elsewhere.
    - `maxPriceDeviationBps` integer, nullable: Maximum amount, in basis points, by which a bridge quote may fall short of market prices, with itemised fees excluded. Applies to every EVM-origin deposit whose source token has no priceDeviationTokens entry. Defaults to 300 (3%) if not set.
    - `priceDeviationTokens` object: Per-source-token overrides of maxPriceDeviationBps, keyed by the EVM chain (CAIP-2, eip155 only) the deposit is bridged from; a HyperCore-origin deposit is bridged from HyperEVM, so key it "eip155:999". {} clears every override.
    - `minDepositUsd` number, nullable: Minimum deposit value in USD. Deposits priced below this are rejected and the client is notified via deposit-rejected. Applies to all tokens and chains.
    - `appFees` AppFees, nullable: Project app-fee settings. An exact normalized source chain+token rate, including 0, overrides feeBps; unmatched source assets use feeBps or 0 when omitted. On update, feeBps 0 clears only the fallback when tokens is omitted; appFees null clears fallback and overrides.
      - `feeBps` integer
      - `tokens` object

## Response `200`

Client updated successfully

- SetupResponse
  - `message` string, required

## Other responses

- `400`: Invalid request parameters
- `401`: Authentication required, or invalid API key
- `403`: API key lacks the required deposits:admin scope, or the organization can't be billed (no card or approved contract, or suspended)
- `503`: Client configuration could not be persisted, or the organization's fee configuration could not be read; retry

## Changes

- **2026-11-06** `aa1767d704fa`: 3 info
  - the endpoint scheme security `internalProjectBearer` was added to the API
  - the endpoint scheme security `tenantApiKey` was added to the API
  - the `header` request parameter `x-api-key` became optional
- **2026-09-22** `5bfd3ae2eab9`: 1 info
  - added the new optional request property `params/priceDeviationTokens`
- **2026-09-17** `676300ac19ff`: 5 info
  - added the new optional request property `params/sponsorship/additionalProperties/maxAmountUsd`
  - added the optional property `code` to the response with the `400` status
  - added the optional property `code` to the response with the `401` status
  - added the optional property `code` to the response with the `403` status
  - …1 more
- **2026-09-11** `b49146029e5a`: 1 breaking, 1 warning, 1 info
  - the `header` request parameter `x-api-key` became required
  - deleted the `header` request parameter `authorization`
  - added the new optional request property `params/swapQuoters`
- **2026-08-06** `ce4e0abfe33a`: 2 info
  - added the non-success response with the status `401`
  - added the non-success response with the status `503`

[Operation history](https://skmtc.dev/rhinestonewtf/apis/deposit-service-api/changes/setup/post.md)

---

[API](https://skmtc.dev/rhinestonewtf/apis/deposit-service-api.md) - [All operations](https://skmtc.dev/rhinestonewtf/apis/deposit-service-api/llms.txt) - [OpenAPI document](https://skmtc.dev/rhinestonewtf/apis/deposit-service-api/revisions/aa1767d704fa?raw)