curl --request GET \
--url https://sandbox-api.polygon.technology/v0.13/external-accounts \
--header 'Authorization: Bearer <token>'import requests
url = "https://sandbox-api.polygon.technology/v0.13/external-accounts"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://sandbox-api.polygon.technology/v0.13/external-accounts', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://sandbox-api.polygon.technology/v0.13/external-accounts",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://sandbox-api.polygon.technology/v0.13/external-accounts"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://sandbox-api.polygon.technology/v0.13/external-accounts")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://sandbox-api.polygon.technology/v0.13/external-accounts")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"object": "<string>",
"limit": 123,
"hasMore": true,
"nextCursor": "<string>",
"previousCursor": "<string>",
"data": [
{
"id": "<string>",
"object": "externalAccount",
"owner": {
"kind": "customer",
"customerId": "<string>"
},
"ownerDisplayName": "<string>",
"customer": {
"id": "<string>",
"name": "<string>"
},
"type": "bankUs",
"category": "fiatAccount",
"status": "active",
"failureReason": "ereborRejected",
"failureDetail": {
"provider": "<string>",
"code": "<string>",
"message": "<string>",
"details": [
"<string>"
],
"providerRequestId": "<string>"
},
"rejectionReason": "<string>",
"invalidReason": "accountClosed",
"invalidReasonCode": "<string>",
"label": "<string>",
"metadata": {},
"bankUs": {
"accountNumberLast4": "<string>",
"routingNumber": "<string>",
"accountType": "checking",
"bankName": "<string>",
"supportedDestinations": [
{
"asset": "<string>",
"network": "ach",
"minimumAmount": "<string>",
"maximumAmount": "<string>"
}
]
},
"bankIban": {
"ibanLast4": "<string>",
"BIC": "<string>",
"countryCode": "<string>",
"bankAddress": {
"line1": "<string>",
"line2": "<string>",
"city": "<string>",
"state": "<string>",
"country": "<string>",
"zipCode": "<string>"
}
},
"bankCanada": {
"institutionNumber": "<string>",
"transitNumber": "<string>",
"accountNumberLast4": "<string>",
"bankName": "<string>"
},
"walletExternal": {
"blockchainAddress": "<string>",
"networkFamily": "evm",
"custodian": "ANCHORAGE_SG",
"otherCustodian": "<string>",
"supportedDestinations": [
{
"asset": "<string>",
"network": "ethereum"
}
]
},
"card": {
"cardNumberLast4": "<string>",
"cardProvider": "visa",
"cardType": "debit",
"expiryMonth": 123,
"expiryYear": 123,
"billingAddressSource": "provided"
},
"resolvedTransactions": [
"<string>"
],
"createdAt": "2023-11-07T05:31:56Z",
"updatedAt": "2023-11-07T05:31:56Z"
}
]
}List External Accounts
List External Accounts. customerId, counterpartyId, and status are all optional filters. Omitting status excludes soft-deleted rows; pass status=deleted to list them.
curl --request GET \
--url https://sandbox-api.polygon.technology/v0.13/external-accounts \
--header 'Authorization: Bearer <token>'import requests
url = "https://sandbox-api.polygon.technology/v0.13/external-accounts"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://sandbox-api.polygon.technology/v0.13/external-accounts', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://sandbox-api.polygon.technology/v0.13/external-accounts",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://sandbox-api.polygon.technology/v0.13/external-accounts"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://sandbox-api.polygon.technology/v0.13/external-accounts")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://sandbox-api.polygon.technology/v0.13/external-accounts")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"object": "<string>",
"limit": 123,
"hasMore": true,
"nextCursor": "<string>",
"previousCursor": "<string>",
"data": [
{
"id": "<string>",
"object": "externalAccount",
"owner": {
"kind": "customer",
"customerId": "<string>"
},
"ownerDisplayName": "<string>",
"customer": {
"id": "<string>",
"name": "<string>"
},
"type": "bankUs",
"category": "fiatAccount",
"status": "active",
"failureReason": "ereborRejected",
"failureDetail": {
"provider": "<string>",
"code": "<string>",
"message": "<string>",
"details": [
"<string>"
],
"providerRequestId": "<string>"
},
"rejectionReason": "<string>",
"invalidReason": "accountClosed",
"invalidReasonCode": "<string>",
"label": "<string>",
"metadata": {},
"bankUs": {
"accountNumberLast4": "<string>",
"routingNumber": "<string>",
"accountType": "checking",
"bankName": "<string>",
"supportedDestinations": [
{
"asset": "<string>",
"network": "ach",
"minimumAmount": "<string>",
"maximumAmount": "<string>"
}
]
},
"bankIban": {
"ibanLast4": "<string>",
"BIC": "<string>",
"countryCode": "<string>",
"bankAddress": {
"line1": "<string>",
"line2": "<string>",
"city": "<string>",
"state": "<string>",
"country": "<string>",
"zipCode": "<string>"
}
},
"bankCanada": {
"institutionNumber": "<string>",
"transitNumber": "<string>",
"accountNumberLast4": "<string>",
"bankName": "<string>"
},
"walletExternal": {
"blockchainAddress": "<string>",
"networkFamily": "evm",
"custodian": "ANCHORAGE_SG",
"otherCustodian": "<string>",
"supportedDestinations": [
{
"asset": "<string>",
"network": "ethereum"
}
]
},
"card": {
"cardNumberLast4": "<string>",
"cardProvider": "visa",
"cardType": "debit",
"expiryMonth": 123,
"expiryYear": 123,
"billingAddressSource": "provided"
},
"resolvedTransactions": [
"<string>"
],
"createdAt": "2023-11-07T05:31:56Z",
"updatedAt": "2023-11-07T05:31:56Z"
}
]
}Authorizations
Token from POST /auth/token
Query Parameters
Page size, supported range 1-100. The default and maximum are per-resource
(see each endpoint's description; most endpoints default to
50) and are resolved at runtime from configuration. Values outside the range
are clamped to the nearest bound rather than rejected. The range is published
machine-readably via the x-minimum/x-maximum OpenAPI extensions below —
deliberately NOT via @minValue/@maxValue, which emit JSON-Schema
minimum/maximum and make the generated SDK (Zod) reject values the server
accepts and clamps. See PaginatedList.limit for the effective value applied.
Filter to a single customer (cst_ prefix).
Counterparty ID (ctp_ prefix).
Filter to a single status. Omitted by default, which excludes soft-deleted rows; pass deleted explicitly to list them.
Lifecycle of an External Account. pending → active on successful Erebor
provisioning; pending → failed on Erebor rejection or provisioning
timeout. rejected (create-time country screening) and invalid (derived
from payout returns) are reserved enum values with no transition logic in
this slice. deleted is the soft-delete terminal.
active, pending, rejected, invalid, deleted, failed Response
The request has succeeded.
Paginated list of ExternalAccount resources.
Resource type discriminator.
The effective page size applied to this response, after clamping an
out-of-range or unset requested limit into the supported bound.
True when more rows exist beyond this page in the direction of travel (forward by default, backward when endingBefore was supplied).
Opaque cursor pointing at the last item in this page. Present when
data is non-empty. Pass as startingAfter to fetch the next page;
hasMore=false signals no more pages forward.
Opaque cursor pointing at the first item in this page. Present when
data is non-empty. Pass as endingBefore to page backward; when
this yields an empty response the client is at the start of the list.
The page of results.
Hide child attributes
Hide child attributes
External Account ID (ext_ prefix).
^[a-z]+_([0-9a-hjkmnp-tv-z]{26}|[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$Resource type discriminator. Always "externalAccount".
externalAccount Who owns this account: the customer or one of their counterparties.
- Customer-owned
- Counterparty-owned
Resolved display name of the customer owner, for list/detail rendering
without a follow-up fetch (v0.12 list enrichment, #2520/#2665). Present
only when owner.kind = customer; absent for counterparty-owned
accounts — no counterparty-name resolver is wired for this resource.
Resolved id + display name of the owning customer. Present only when
owner.kind = customer; absent for counterparty-owned accounts.
The instrument type; determines which detail object is populated.
bankUs, bankIban, bankCanada, card, walletExternal High-level grouping: fiatAccount for bank or card accounts, crypto for
wallets. The same value as the instrument category when this account is
referenced in a transaction.
fiatAccount, crypto Current lifecycle status. A transition to invalid always fires the
externalAccount.statusChanged webhook.
active, pending, rejected, invalid, deleted, failed Set when status = failed.
ereborRejected, cardProviderRejected, providerAccountMissing, cardLimitReached, cardInUse, provisioningTimeout, systemError Structured provider rejection detail. Set when status = failed and the failure was a provider terminal rejection; absent for provisioning timeouts and internal failures.
Hide child attributes
Hide child attributes
Vendor that rejected the request (e.g. erebor).
Vendor machine-readable error code (e.g. INVALID_REQUEST).
Vendor human-readable message.
Per-field validation messages, each in field: message form.
Vendor request id, for support escalation.
Set when status = rejected (compliance screening).
Set when status = invalid (derived from payout returns).
accountClosed, accountFrozenByBank, routingOrAccountNumberInvalid, accountHolderDeceased, accountDoesNotSupportTransfers, payeeNameMismatch, walletUnreachableOnNetwork, billingAddressMismatch, cardExpired, cardClosedOrLostStolen, pushToCardUnsupported, cardDeclinedByIssuer The provider's own code for the failure behind invalidReason, verbatim. For US bank accounts, this is the NACHA return code from the failed payout (for example, R15). Absent when the provider gave no code or when the account was invalidated by something other than a returned payment. Read invalidReason to decide what to do; read this field only for support or reconciliation.
Optional display label.
Populated when type = bankUs.
Hide child attributes
Hide child attributes
Last four digits of the US bank account number.
Nine-digit ABA routing number (not a secret).
The account type on file. Always present.
checking, savings Bank display name.
The (asset, rail) pairs this account can be paid over. This is a per-account signal, derived from the platform's supported rails, the participation list this account's bank reported at registration (so rtp appears only when the specific bank participates), the project's rail allow-list, and the operator's platform-wide rail configuration. The list never advertises a rail that the deposit-address create gate would refuse. Accounts whose underlying provider exposes no per-bank participation check report the conservative ach, achSameDay, and wire set; an absent rtp entry there means participation could not be verified, not that the bank cannot receive rtp.
Hide child attributes
Hide child attributes
Fiat currency, for example usd.
Rail this account can receive on.
ach, achSameDay, wire, rtp Minimum transfer amount enforced for this (asset, rail) pair when known. Null when no source-of-truth limit is available; omission is not a claim that no minimum exists.
Maximum transfer amount enforced for this (asset, rail) pair when known. Same null-means-unknown caveat as minimumAmount.
Populated when type = bankIban.
Hide child attributes
Hide child attributes
Last four characters of the IBAN.
SWIFT BIC (8 or 11 chars).
ISO 3166-1 alpha-2; derived from the IBAN prefix when not supplied.
Structured bank postal address (canonical Address).
Hide child attributes
Hide child attributes
Street address, line 1.
Street address, line 2.
City.
State / province / region.
ISO 3166-1 alpha-2
ZIP / postal code.
Populated when type = bankCanada.
Hide child attributes
Hide child attributes
Three-digit institution number.
Five-digit transit number.
Last four digits of the Canadian bank account number.
Bank display name.
Populated when type = walletExternal.
Hide child attributes
Hide child attributes
The registered blockchain address, as submitted.
Crypto network family for a registered external wallet. A walletExternal is registered per family: an EVM address is valid across every EVM chain in the family, and the service maps it to each served network in that family.
evm, solana, tron DestinationCustodian enum value (reused from VA).
ANCHORAGE_SG, ANCHORAGE_US, AQUANOW_CA, B2C2_UK, B2C2_US, BITGO_SG, BITGO_US, BITSTAMP_US, BVNK_US, CIRCLE_FR, CIRCLE_US, CITIBANK_US, COINBASE_US, COINSMART_CA, COPPER_CH, COPPER_UK, CUMBERLAND_DRW_LLC_US, CUMBERLAND_SG, EREBOR_BANK_US, FALCONX_US, FIDELITY_UK, FIDELITY_US, FIREBLOCKS_APAC, FIREBLOCKS_US, GALAXY_KY, GEMINI_US, KRAKEN_BVI, KRAKEN_EU_IE, KRAKEN_UK, KRAKEN_US, NUBANK_BR, PAXOS_US, RAMP_NETWORK_US, ROBINHOOD_US, WINTERMUTE_GB, SELF_HOSTED, OTHER Set when custodian = OTHER.
The (asset, network) pairs this wallet can receive, derived from
networkFamily ({usdc, usdt} across the family's served networks).
Hide child attributes
Hide child attributes
Stablecoin symbol, for example usdc or usdt.
Network the asset can be delivered on, for example ethereum, base, or solana.
ethereum, polygon, base, solana, tron Populated when type = card.
Hide child attributes
Hide child attributes
Last four digits of the card PAN.
Card brand, derived server-side from the PAN.
visa, mastercard, amex, discover Card funding type, derived server-side. Only debit today.
debit, credit, prepaid Card expiry month (MM).
Card expiry year (YYYY).
Whether the stored billing address was supplied on the request or filled from the owning customer's address.
provided, customerDefault Transaction ids that this registration submitted for sender-attribution
release. Returned ONLY on the POST create response, and only when
registering this walletExternal matched held inbounds. Attribution is async:
each entry is submitted to the provider from
awaitingAction.awaitingSenderAttribution and moves to
processing.fundsPulled once settlement confirms — so an immediate GET of an
id may still show awaitingAction. Omitted on GETs (the create path is the
only writer).
Public TypeID, e.g. txn_01h455vb4pex5vsknk084sn02q; legacy UUID suffixes are accepted until non-v7 rows are retired.
^[a-z]+_([0-9a-hjkmnp-tv-z]{26}|[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$When the external account was registered.
When the external account was last updated.
Was this page helpful?