Limits and rules
Request limits, amount limits and the security rules for payouts and split.
Requests
| Limit | Value | Response |
|---|---|---|
| Per account (client ID) | 600 requests per minute | 429, code: "RATE_LIMITED" |
| Invalid credentials per IP | 30 failures in 5 minutes block the IP for a while | 429, code: "RATE_LIMITED" |
On 429, wait a few seconds and retry with growing backoff. To track payments, use callbacks instead of polling.
Amounts
- Amounts are always in reais, with up to 2 decimals (
49.9,"49.90"or"49,90"). - Charges and payouts have a per-operation minimum and maximum set by WeetPay; payouts also have a daily limit (rolling 24 h window). When a limit is exceeded, the error message states the allowed value.
- QR Code validity is set by the platform (default: 1 hour). After that the charge becomes
EXPIRED. - Incoming and payout fees follow your contract and are shown in the dashboard. Incoming payments are credited net of fees; the payout fee is debited together with the amount.
API payouts
Enabled by you. API payouts are off by default. Turn them on under Developers in the dashboard (requires your transaction PIN). While off, pix-payment returns 403.
Destination. Unless WeetPay enables it, payouts can only go to the account holder's CPF/CNPJ key. To pay third parties (suppliers, affiliates, customers), ask support to enable it.
Approval. Payouts above the platform's auto-approval amount are reviewed by operations before being sent. Meanwhile the payout stays PROCESSING and the amount stays reserved.
Result. Paid or not, the result arrives at callbackUrl. A payout that is not paid (rejected on review, unknown key, bank failure) has its amount and fee refunded automatically.
Split
The split field on Create PIX charge shares the received amount with another WeetPay account. Since it moves money between accounts, it only works for accounts enabled by Compliance. The destination account must be active with approved verification; the percentage is an integer from 1 to 100.
Identity verification
The API only answers for accounts with approved identity verification (KYC) that are not blocked. Until then, every call returns 403 with code: "KYC_REQUIRED".