New Funding Endpoints - Permission Changes From Legacy

Kraken's new Funding API simplifies the permission model for many endpoints. Because the same API key works across both Legacy and the new endpoints, some operations that previously required multiple permissions in Legacy now require fewer permissions in the new endpoints. This article explains what has changed and what you should be aware of.

What changed?

In the Legacy Funding API, several read-only endpoints required compound permissions. For example, viewing your withdrawal addresses required both Query Funds and Withdraw Funds to be enabled on the same key.

In the new endpoints, all read-only funding endpoints have been consolidated under a single Query Funds permission. This makes it easier to set up keys for monitoring and reporting without granting unnecessary write access.

However, this also means that an existing API key with Query Funds enabled will be able to access more information through the new endpoints than it could through the legacy endpoints.

Endpoints with reduced permission requirements

The following endpoints require fewer permissions than their Legacy equivalents:

New Endpoints	New Permissions	Legacy Equivalent	Legacy Permissions
listFundingWithdrawals	Query Funds	Get Status of Recent Withdrawals	Withdraw Funds OR Data - Query Ledger Entries
listFundingAddresses	Query Funds	Get Withdrawal Addresses	Query Funds AND Withdraw Funds
getFundingAddresses	Query Funds	Get Withdrawal Addresses	Query Funds AND Withdraw Funds
listFundingMethods	Query Funds	Get Deposit Methods	Query Funds AND Deposit
listFundingWithdrawalLimits	Query Funds	Get Withdrawal Methods	Query Funds AND Withdraw

What this means for your existing API keys

If you have an API key that was created with only the Query Funds permission, that key can now access the following information through the new endpoints it previously could not access through Legacy:

Your withdrawal address list (previously also required Withdraw Funds)
Your withdrawal history (previously required Withdraw Funds or Data - Query Ledger Entries)
Available funding methods (previously also required Deposit)
Withdrawal limits and methods (previously also required Deposit)

Why this matters

If you granted a Query Funds-only key to a third-party service for portfolio tracking or reporting, that service can now retrieve additional account information through the new API, including your withdrawal addresses and withdrawal history. While this data is read-only, this may be more visibility than you intended to share.

Endpoints with unchanged permissions

The following new endpoints require the same permissions as their Legacy equivalents:

Endpoint	Permission	Operation
createFundingWithdrawal	Withdraw Funds	Create a withdrawal to a whitelisted address
listFundingDepositLimits	Query Funds	View deposit limits
listFundingDeposits	Query Funds	List deposits
listFundingAssets	Query Funds	List available funding assets
listFundingNetworks	Query Funds	List available funding networks
calculateFundingFees	Query Funds	Calculate deposit/withdrawal fees

New endpoints and their permissions

The following endpoints are new and have no Legacy equivalent:

Endpoint	Permission	Operation
claimFundingDepositAddress	Deposit	Generate or claim a deposit address
generateFundingLightningAddress	Deposit	Generate a Lightning deposit address/invoice
listFundingClaimedAddresses	Query Funds	List deposit addresses
createFundingAddress	Add Withdrawal Addresses	Create a withdrawal address
deleteFundingAddress	Add Withdrawal Addresses	Delete a withdrawal address

Recommendations

Review your existing API keys

If you have API keys with Query Funds enabled that are shared with third-party services, review whether you are comfortable with those services accessing additional read-only data through the new endpoints.

Apply the principle of least privilege

When creating new API keys, only enable the permissions your application needs. The simplified permission model makes it easier to grant read-only access without also granting write access.

Use additional security controls

For any API key, especially those with elevated permissions, consider enabling:

Two-factor authentication (2FA) for API keys to require a 2FA code with every API call