> This page is for API, version 2026-01-01 (Stable) (default).
> For other versions, use one of these documentation indexes:
> - 2026-01-01 (Stable) (default): https://developer.deel.com/api/stable/llms.txt

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://developer.deel.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://developer.deel.com/_mcp/server.

# Update a child organization bank account

PATCH https://api.letsdeel.com/rest/organizations/children/{child_id}/payment-methods/{payment_method_id}
Content-Type: application/json

Make a verified bank account the one Deel debits for the child organization. Deel debits nothing until this is set. The first call creates the child organization’s automatic payment (every product, charged daily as invoices become due); later calls move it to the given account, which is how to swap accounts before removing the old one. Calling it on the current default changes nothing.

 **Token scopes**: `organizations:write`

 **Beta**: this version requires the `X-Beta: true` request header and its contract may change before it is promoted to stable. It is scheduled to become stable on 2027-02-12.

Reference: https://developer.deel.com/api/reference/endpoints/organizations/set-default-child-organization-payment-method-v-2026-11-12

## Authentication

- `Authorization` header (bearer token, required) — ## Authentication The Deel API uses bearer tokens to authenticate requests. All API calls must be made over HTTPS — calls over plain HTTP or without authentication will fail. ```curl curl -X GET 'https://api.letsdeel.com/rest/v2/contracts' \ -H 'Authorization: Bearer YOUR-TOKEN-HERE' ``` [Learn more about authentication](/api/authentication)
- `Authorization` header (bearer token, required) — Standard OAuth2 security scheme based on https://swagger.io/docs/specification/authentication/

## Servers

- `https://api.letsdeel.com/rest` (Production, default)
- `https://api-staging.letsdeel.com/rest` (Demo)

## Request

### Path parameters

- `child_id` (string, required) — Public id of the child organization, as returned in the id field of the create child organization response. It must be a direct child organization of the authenticated organization; any other id answers 403, an unknown id 404.
- `payment_method_id` (integer, required) — Id of the payment method, as returned when it was added. It must belong to the child organization; any other id answers 404.

### Headers

- `X-Beta` (enum, required, default: true) — Opts in to the beta version of this endpoint. Must be `true`.
  - Allowed values: `true`

### Body (application/json)

This endpoint expects an object.

- `data` (OrganizationsChildrenChildIdPaymentMethodsPaymentMethodIdPatchRequestBodyContentApplicationJsonSchemaData, required) — The request payload.

## Response

### 200

The account is now the default: is_default is true and it can no longer be removed until another account replaces it.

- `data` (OrganizationsChildrenChildIdPaymentMethodsPaymentMethodIdPatchResponsesContentApplicationJsonSchemaData, required) — The bank account as stored by Deel. The full account and routing numbers are never returned.

## Errors

### 400 Bad Request Error

Bad request. Nothing is written. The request body failed validation; the error item names the offending key.

- `errors` (list of OrganizationsChildrenChildIdPaymentMethodsPaymentMethodIdPatchResponsesContentApplicationJsonSchemaErrorsItems, required)

### 401 Unauthorized Error

Unauthorized. The request token is missing or invalid.

- `errors` (list of OrganizationsChildrenChildIdPaymentMethodsPaymentMethodIdPatchResponsesContentApplicationJsonSchemaErrorsItems, required)

### 403 Forbidden Error

Forbidden. The child organization is not a direct child of the caller, the feature is not enabled for the caller, or the token carries no person. Nothing is written.

- `errors` (list of OrganizationsChildrenChildIdPaymentMethodsPaymentMethodIdPatchResponsesContentApplicationJsonSchemaErrorsItems, required)

### 404 Not Found Error

Not found. No organization has the given child_id, or the child organization has no active ACH method with that id. Nothing is written.

- `errors` (list of OrganizationsChildrenChildIdPaymentMethodsPaymentMethodIdPatchResponsesContentApplicationJsonSchemaErrorsItems, required)

### 409 Conflict Error

Conflict. The account has not passed micro-deposit verification. Nothing is written.

- `errors` (list of OrganizationsChildrenChildIdPaymentMethodsPaymentMethodIdPatchResponsesContentApplicationJsonSchemaErrorsItems, required)

### 422 Unprocessable Entity Error

Unprocessable. The account is verified but the child organization cannot be debited yet (status ON_HOLD); details.reason is ORGANIZATION_NOT_VERIFIED. Nothing is written.

- `errors` (list of OrganizationsChildrenChildIdPaymentMethodsPaymentMethodIdPatchResponsesContentApplicationJsonSchemaErrorsItems, required)

### 500 Internal Server Error

An unexpected error occurred. Nothing is written; retry the call.

- `errors` (list of OrganizationsChildrenChildIdPaymentMethodsPaymentMethodIdPatchResponsesContentApplicationJsonSchemaErrorsItems, required)

## Types

### OrganizationsChildrenChildIdPaymentMethodsPaymentMethodIdPatchRequestBodyContentApplicationJsonSchemaData

The request payload.

- `is_default` (boolean, required) — Must be true: make this account the one Deel debits. Unsetting is not supported; set another account instead.
- `notification_emails` (list of string, optional) — Addresses Deel emails before each debit. Used only when the automatic payment is created by this call; later calls keep the existing addresses. Without it no email is sent.

### OrganizationsChildrenChildIdPaymentMethodsPaymentMethodIdPatchResponsesContentApplicationJsonSchemaData

The bank account as stored by Deel. The full account and routing numbers are never returned.

- `id` (integer, required) — Id of the payment method. Use it in the verify, update and remove calls.
- `type` (enum, required) — Payment rail of the method. Only ACH in this version.
  - Allowed values: `ACH`
- `last4` (string, required) — Last four digits of the account number.
- `status` (enum, required) — PENDING_VERIFICATION until the two micro-deposit amounts are confirmed; VERIFIED once they are; ON_HOLD when the account is verified but the child organization has not completed its own verification yet; VERIFICATION_FAILED after three wrong attempts (it stays so while Deel reviews a bank statement, and becomes VERIFIED on approval); REMOVED after deletion.
  - Allowed values: `PENDING_VERIFICATION`, `VERIFIED`, `ON_HOLD`, `VERIFICATION_FAILED`, `REMOVED`
- `created_at` (string, required) — When the method was added.
- `is_default` (boolean, required) — Whether Deel debits this account for the child organization’s invoices.
- `account_type` (enum, required) — Checking or savings.
  - Allowed values: `CHECKING`, `SAVINGS`
- `is_deletable` (boolean, required) — Whether a remove call would succeed right now.
- `attempts_remaining` (integer, required) — Micro-deposit confirmation attempts left before the method needs a bank statement.
- `account_holder_name` (string, required) — Name on the bank account, as submitted.
- `verification_method` (enum, required) — How the account is verified. Only micro-deposits in this version.
  - Allowed values: `MICRO_DEPOSITS`
- `bank_name` (string, optional, nullable) — Name of the bank. Not available in this version; always null.
- `status_reason` (enum, optional, nullable) — Why the method is on hold, when it is. Null otherwise.
  - Allowed values: `NO_US_LEGAL_ENTITY`, `ORGANIZATION_NOT_VERIFIED`, `ACH_DISABLED`
- `not_deletable_reason` (enum, optional, nullable) — Why the method cannot be deleted, when it cannot. Null otherwise.
  - Allowed values: `USED_IN_AUTOMATIC_PAYMENT`, `USED_AS_BACKUP`

### OrganizationsChildrenChildIdPaymentMethodsPaymentMethodIdPatchResponsesContentApplicationJsonSchemaErrorsItems

- `code` (enum, required) — Machine-readable error code.
  - Allowed values: `GENERIC_ERROR`
- `message` (string, required) — Human-readable explanation of the error.
- `details` (OrganizationsChildrenChildIdPaymentMethodsPaymentMethodIdPatchResponsesContentApplicationJsonSchemaErrorsItemsDetails, optional) — Extra context for the code, when any: the ineligibility, rate-limit or not-deletable reason.

### OrganizationsChildrenChildIdPaymentMethodsPaymentMethodIdPatchResponsesContentApplicationJsonSchemaErrorsItemsDetails

Extra context for the code, when any: the ineligibility, rate-limit or not-deletable reason.

- `reason` (string, optional) — Why the request was refused, for the NOT_ELIGIBLE, INVALID_BANK_ACCOUNT, RATE_LIMITED and NOT_DELETABLE codes.
- `attempts_remaining` (string, optional) — Micro-deposit attempts left, for the INVALID_AMOUNTS code.

## Examples

**Request**

```json
{
  "data": {
    "is_default": true
  }
}
```

**Response**

```json
{
  "data": {
    "id": 635390,
    "type": "ACH",
    "last4": "2227",
    "status": "PENDING_VERIFICATION",
    "created_at": "2026-10-16T04:49:58Z",
    "is_default": false,
    "account_type": "CHECKING",
    "is_deletable": true,
    "attempts_remaining": 3,
    "account_holder_name": "Acme Inc",
    "verification_method": "MICRO_DEPOSITS",
    "bank_name": "Chase",
    "status_reason": "ORGANIZATION_NOT_VERIFIED",
    "not_deletable_reason": "USED_IN_AUTOMATIC_PAYMENT"
  }
}
```

**SDK Code**

```python
import requests

url = "https://api.letsdeel.com/rest/organizations/children/8f1d2e3a-4b5f-4a2c-9c4e-1c0e6f1c4a52/payment-methods/635390"

payload = { "data": { "is_default": True } }
headers = {
    "X-Beta": "true",
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.patch(url, json=payload, headers=headers)

print(response.json())
```

```javascript
const url = 'https://api.letsdeel.com/rest/organizations/children/8f1d2e3a-4b5f-4a2c-9c4e-1c0e6f1c4a52/payment-methods/635390';
const options = {
  method: 'PATCH',
  headers: {
    'X-Beta': 'true',
    Authorization: 'Bearer <token>',
    'Content-Type': 'application/json'
  },
  body: '{"data":{"is_default":true}}'
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}
```

```go
package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.letsdeel.com/rest/organizations/children/8f1d2e3a-4b5f-4a2c-9c4e-1c0e6f1c4a52/payment-methods/635390"

	payload := strings.NewReader("{\n  \"data\": {\n    \"is_default\": true\n  }\n}")

	req, _ := http.NewRequest("PATCH", url, payload)

	req.Header.Add("X-Beta", "true")
	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(res)
	fmt.Println(string(body))

}
```

```ruby
require 'uri'
require 'net/http'

url = URI("https://api.letsdeel.com/rest/organizations/children/8f1d2e3a-4b5f-4a2c-9c4e-1c0e6f1c4a52/payment-methods/635390")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Patch.new(url)
request["X-Beta"] = 'true'
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"data\": {\n    \"is_default\": true\n  }\n}"

response = http.request(request)
puts response.read_body
```

```java
import com.mashape.unirest.http.HttpResponse;
import com.mashape.unirest.http.Unirest;

HttpResponse<String> response = Unirest.patch("https://api.letsdeel.com/rest/organizations/children/8f1d2e3a-4b5f-4a2c-9c4e-1c0e6f1c4a52/payment-methods/635390")
  .header("X-Beta", "true")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"data\": {\n    \"is_default\": true\n  }\n}")
  .asString();
```

```php
<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('PATCH', 'https://api.letsdeel.com/rest/organizations/children/8f1d2e3a-4b5f-4a2c-9c4e-1c0e6f1c4a52/payment-methods/635390', [
  'body' => '{
  "data": {
    "is_default": true
  }
}',
  'headers' => [
    'Authorization' => 'Bearer <token>',
    'Content-Type' => 'application/json',
    'X-Beta' => 'true',
  ],
]);

echo $response->getBody();
```

```csharp
using RestSharp;

var client = new RestClient("https://api.letsdeel.com/rest/organizations/children/8f1d2e3a-4b5f-4a2c-9c4e-1c0e6f1c4a52/payment-methods/635390");
var request = new RestRequest(Method.PATCH);
request.AddHeader("X-Beta", "true");
request.AddHeader("Authorization", "Bearer <token>");
request.AddHeader("Content-Type", "application/json");
request.AddParameter("application/json", "{\n  \"data\": {\n    \"is_default\": true\n  }\n}", ParameterType.RequestBody);
IRestResponse response = client.Execute(request);
```

```swift
import Foundation

let headers = [
  "X-Beta": "true",
  "Authorization": "Bearer <token>",
  "Content-Type": "application/json"
]
let parameters = ["data": ["is_default": true]] as [String : Any]

let postData = JSONSerialization.data(withJSONObject: parameters, options: [])

let request = NSMutableURLRequest(url: NSURL(string: "https://api.letsdeel.com/rest/organizations/children/8f1d2e3a-4b5f-4a2c-9c4e-1c0e6f1c4a52/payment-methods/635390")! as URL,
                                        cachePolicy: .useProtocolCachePolicy,
                                    timeoutInterval: 10.0)
request.httpMethod = "PATCH"
request.allHTTPHeaderFields = headers
request.httpBody = postData as Data

let session = URLSession.shared
let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in
  if (error != nil) {
    print(error as Any)
  } else {
    let httpResponse = response as? HTTPURLResponse
    print(httpResponse)
  }
})

dataTask.resume()
```