What's new in the Direct Deposit API: 9–10 November 2026
SET Direct Deposit API · Live in staging and production since 2026-11-10
Four releases went live overnight on 9–10 November 2026. Every change adds to the API: no field was renamed or removed, and an integration that ignores the new fields works as it did before. This page lists the changes. Each edge case has its own guide.
At a glance
| Change | Calls | Guide |
|---|---|---|
| Quote the amount to send for an exact bank amount | GET /api/partner/quote?netUsd= | Paying an exact amount to the bank |
| Answers that know the amount | amountUsdc on POST /api/partner/payees, GET /api/partner/payees/{payeeId} and GET /api/partner/address | Amounts below the minimum |
| Pay each reference once | POST /api/partner/payout_intents and three more calls; event payout_intent.paid | Paying each reference once |
| Addresses that stop taking payouts | active, deactivatedAt and reason on GET /api/partner/address; event address.deactivated | When a payee's address stops taking payouts |
| Batches of up to 5,000 | POST /api/partner/payees/batch/{id}/items; CSV and Safe exports | Batches of up to 5,000 |
| Contracts that pay without signing | proof: "owner" on POST /api/partner/senders | Sender wallets |
| Sender wallet screening | screening on every sender wallet | Sender wallets |
| Fair webhook delivery, and pausing an endpoint that always fails | event webhook_endpoint.disabled; status and disabledAt on endpoints | Webhook delivery when an endpoint fails |
| One key for both APIs | the direct_deposit scope on a SET API key | One key for both APIs |
| Pin your key to your servers | POST /api/partner/keys/allowed_cidrs; 403 ip_not_allowed | Pinning a key to your servers |
| What changed on your account | GET /api/partner/audit_log | Read the audit log |
| Which API an event belongs to | api on every event: set_api, direct_deposit or account | One key for both APIs |
Amounts and fees
netUsdquotes.GET /api/partner/quote?netUsd=100.00gives, for each plan or for one address, the least whole-cent amount to send so the payee's bank receives at least 100.00 after SET's fee: 103.09 at 3% and 101.52 at 1.5%. The fee is still the payee's, taken from what you send.- Answers that know the amount. Send
amountUsdcwhen you resolve a payee or check an address. SET then never gives you a Cash-Out Address for an amount that would not reach the bank after SET's fee. You get the payee's Threshold Address when they have one, orstatus: "below_minimum". With today's fees (3% and 1.5%) and Payable Email amounts (from 2.00), this changes no answer you get now. It protects you from a future fee or minimum change, and from direct payments under 2.00.
Paying safely
- Payout intents reserve one payout per reference: a retry, a double click or a second worker gets
409 already_intendedwith the first intent, and never a second address to pay. - Address lifecycle. A Cash-Out Address stops taking payouts when the payee removes it in SET Wallet, or when SET's provider deactivates it. SET tells every partner it gave that address to, once, with
address.deactivated. The address check then answersactive: false. Before this release, the check could still answeracceptsPayouts: truefor an address the payee had retired. That is fixed. - Contract senders. An escrow, bounty or stream contract that pays out without signing can now be registered by the address its
owner()returns. Its payouts are then credited to you and carry your Travel Rule data.
Volume
- A Payable Email batch holds up to 5,000 payees. Add them 20 a call with
POST /api/partner/payees/batch/{id}/items. GET /api/partner/payees/batch/{id}?format=csvgives the multisend list as CSV.?format=safegives a Safe Transaction Builder file to import in the Safe app and sign once.
Your account
- Webhook delivery is fair between businesses. One business's slow or failing endpoint no longer delays anyone else's events. An endpoint that has failed every delivery for at least 24 hours, and at least 20 times in a row, is paused. You get one
webhook_endpoint.disabledevent, and setting the URL again resumes it. - One key for both APIs. A SET API key with the
direct_depositscope opens this API as the same business. Yourset_partner_…key works as before. - IP allowlists. Pin your partner key to up to 20 addresses or CIDR ranges. The key cannot shut itself out.
- Audit log.
GET /api/partner/audit_loglists who changed what on your account: your key, a dashboard member or SET. It gives codes and times, never a body. apion every event.direct_depositfor this API's objects,accountfor your account's, andset_apifor SET API objects if you use both APIs.payout.*is a payee's cash-out here and a/v1payout on the SET API;apitells them apart.- The stated limit. The OpenAPI document now states the limit the API enforces: 300 requests a minute per key, the same in staging and production. It said 10 until 10 November.
- Screening. Every sender wallet shows
screening. Until SET starts using a screening provider, it isnot_screened, and nothing is held because of it.
Try it in the sandbox
On staging, POST /api/partner/sandbox/address_deactivated sends you a simulated address.deactivated for an address you have checked. Every other call above works with your test key.
Not in this release
- A partner-specific Cash-Out Address, and a platform paying SET's fee instead of the payee. Each payee keeps one Cash-Out Address per network and bank, and payouts are attributed by the sender wallet. To make the payee whole, use
netUsd. - Sender wallets on Solana.
- Crediting a payout by the wallet that called a contract, rather than the contract that sent the USDC. Anyone can call a public release function, so this would let one platform claim another's payout.
RateLimit-Remainingon every answer. Limits are stated on a429(RateLimit-Policy,Retry-After).