curl --request GET \
--url https://sandbox-api.polygon.technology/v0.13/external-accounts \
--header 'Authorization: Bearer <token>'import requests
url = "https://sandbox-api.polygon.technology/v0.13/external-accounts"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://sandbox-api.polygon.technology/v0.13/external-accounts', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://sandbox-api.polygon.technology/v0.13/external-accounts",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://sandbox-api.polygon.technology/v0.13/external-accounts"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://sandbox-api.polygon.technology/v0.13/external-accounts")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://sandbox-api.polygon.technology/v0.13/external-accounts")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"object": "<string>",
"limit": 123,
"hasMore": true,
"nextCursor": "<string>",
"previousCursor": "<string>",
"data": [
{
"id": "<string>",
"object": "externalAccount",
"owner": {
"kind": "customer",
"customerId": "<string>"
},
"ownerDisplayName": "<string>",
"customer": {
"id": "<string>",
"name": "<string>"
},
"type": "bankUs",
"category": "fiatAccount",
"status": "active",
"failureReason": "ereborRejected",
"failureDetail": {
"provider": "<string>",
"code": "<string>",
"message": "<string>",
"details": [
"<string>"
],
"providerRequestId": "<string>"
},
"rejectionReason": "countryProhibited",
"invalidReason": "accountClosed",
"invalidReasonCode": "<string>",
"label": "<string>",
"metadata": {},
"bankUs": {
"accountNumberLast4": "<string>",
"routingNumber": "<string>",
"accountType": "checking",
"bankName": "<string>",
"supportedDestinations": [
{
"asset": "<string>",
"network": "ach",
"minimumAmount": "<string>",
"maximumAmount": "<string>"
}
]
},
"bankIban": {
"ibanLast4": "<string>",
"BIC": "<string>",
"countryCode": "<string>",
"bankAddress": {
"line1": "<string>",
"line2": "<string>",
"city": "<string>",
"state": "<string>",
"country": "<string>",
"zipCode": "<string>"
}
},
"bankCanada": {
"institutionNumber": "<string>",
"transitNumber": "<string>",
"accountNumberLast4": "<string>",
"bankName": "<string>"
},
"walletExternal": {
"blockchainAddress": "<string>",
"networkFamily": "evm",
"custodian": "ANCHORAGE_SG",
"otherCustodian": "<string>",
"supportedDestinations": [
{
"asset": "<string>",
"network": "ethereum"
}
]
},
"card": {
"cardNumberLast4": "<string>",
"cardProvider": "visa",
"cardType": "debit",
"expiryMonth": 123,
"expiryYear": 123,
"billingAddressSource": "provided"
},
"resolvedTransactions": [
"<string>"
],
"createdAt": "2023-11-07T05:31:56Z",
"updatedAt": "2023-11-07T05:31:56Z"
}
]
}{
"error": "InvalidCounterpartyID",
"code": 10068,
"msg": "invalid counterparty id",
"cause": "<string>"
}List External Accounts
List External Accounts. customerId, counterpartyId, and status are all optional filters — omit all to list all non-deleted external accounts in the project (still tenant-scoped by project). Omitting status excludes soft-deleted rows, matching prior behavior; pass status=deleted to see them.
curl --request GET \
--url https://sandbox-api.polygon.technology/v0.13/external-accounts \
--header 'Authorization: Bearer <token>'import requests
url = "https://sandbox-api.polygon.technology/v0.13/external-accounts"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://sandbox-api.polygon.technology/v0.13/external-accounts', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://sandbox-api.polygon.technology/v0.13/external-accounts",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://sandbox-api.polygon.technology/v0.13/external-accounts"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://sandbox-api.polygon.technology/v0.13/external-accounts")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://sandbox-api.polygon.technology/v0.13/external-accounts")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"object": "<string>",
"limit": 123,
"hasMore": true,
"nextCursor": "<string>",
"previousCursor": "<string>",
"data": [
{
"id": "<string>",
"object": "externalAccount",
"owner": {
"kind": "customer",
"customerId": "<string>"
},
"ownerDisplayName": "<string>",
"customer": {
"id": "<string>",
"name": "<string>"
},
"type": "bankUs",
"category": "fiatAccount",
"status": "active",
"failureReason": "ereborRejected",
"failureDetail": {
"provider": "<string>",
"code": "<string>",
"message": "<string>",
"details": [
"<string>"
],
"providerRequestId": "<string>"
},
"rejectionReason": "countryProhibited",
"invalidReason": "accountClosed",
"invalidReasonCode": "<string>",
"label": "<string>",
"metadata": {},
"bankUs": {
"accountNumberLast4": "<string>",
"routingNumber": "<string>",
"accountType": "checking",
"bankName": "<string>",
"supportedDestinations": [
{
"asset": "<string>",
"network": "ach",
"minimumAmount": "<string>",
"maximumAmount": "<string>"
}
]
},
"bankIban": {
"ibanLast4": "<string>",
"BIC": "<string>",
"countryCode": "<string>",
"bankAddress": {
"line1": "<string>",
"line2": "<string>",
"city": "<string>",
"state": "<string>",
"country": "<string>",
"zipCode": "<string>"
}
},
"bankCanada": {
"institutionNumber": "<string>",
"transitNumber": "<string>",
"accountNumberLast4": "<string>",
"bankName": "<string>"
},
"walletExternal": {
"blockchainAddress": "<string>",
"networkFamily": "evm",
"custodian": "ANCHORAGE_SG",
"otherCustodian": "<string>",
"supportedDestinations": [
{
"asset": "<string>",
"network": "ethereum"
}
]
},
"card": {
"cardNumberLast4": "<string>",
"cardProvider": "visa",
"cardType": "debit",
"expiryMonth": 123,
"expiryYear": 123,
"billingAddressSource": "provided"
},
"resolvedTransactions": [
"<string>"
],
"createdAt": "2023-11-07T05:31:56Z",
"updatedAt": "2023-11-07T05:31:56Z"
}
]
}{
"error": "InvalidCounterpartyID",
"code": 10068,
"msg": "invalid counterparty id",
"cause": "<string>"
}Authorizations
Token from POST /auth/token
Query Parameters
Page size, supported range 1-100. The default and maximum are per-resource (see each endpoint's description; most endpoints default to 50) and are resolved at runtime from configuration. Values outside the range are clamped to the nearest bound rather than rejected. The range is published machine-readably via the x-minimum/x-maximum OpenAPI extensions below — deliberately NOT via @minValue/@maxValue, which emit JSON-Schema minimum/maximum and make the generated SDK (Zod) reject values the server accepts and clamps. See PaginatedList.limit for the effective value applied.
Filter to a single customer (cst_ prefix).
Counterparty ID (ctp_ prefix).
Filter to a single status. Omitted by default, which excludes soft-deleted rows; pass deleted explicitly to list them.
pending: being validated with the provider. active: usable. failed: the account could not be provisioned — the provider declined it, provisioning timed out, or an internal error stopped it (see failureReason). rejected: failed validation at creation (see rejectionReason). invalid: became unusable after activation (see invalidReason). deleted: soft-deleted by the developer.
active, pending, rejected, invalid, deleted, failed Response
The request has succeeded.
Paginated list of ExternalAccount resources.
Resource type discriminator.
The effective page size applied to this response, after clamping an out-of-range or unset requested limit into the supported bound.
True when more rows exist beyond this page in the direction of travel (forward by default, backward when endingBefore was supplied).
Opaque cursor pointing at the last item in this page. Present when data is non-empty. Pass as startingAfter to fetch the next page; hasMore=false signals no more pages forward.
Opaque cursor pointing at the first item in this page. Present when data is non-empty. Pass as endingBefore to page backward; when this yields an empty response the client is at the start of the list.
The page of results.
Hide child attributes
Hide child attributes
External Account ID (ext_ prefix).
^[a-z]+_([0-9a-hjkmnp-tv-z]{26}|[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$Resource type discriminator. Always "externalAccount".
externalAccount Who owns this account: the customer or one of their counterparties.
- Customer-owned
- Counterparty-owned
Server-rendered display name of the owning Customer — lets a list row render "who owns this account" without a second request. Additive next to the owner reference. Present only when owner.kind is customer; absent for counterparty-owned accounts.
Resolved id + display name of the owning customer. Present only when owner.kind = customer; absent for counterparty-owned accounts.
The instrument type; determines which detail object is populated.
bankUs, bankIban, bankCanada, card, walletExternal High-level grouping: fiatAccount for bank or card accounts, crypto for wallets. The same value as the instrument category when this account is referenced in a transaction.
fiatAccount, crypto Current lifecycle status. A transition to invalid always fires the externalAccount.statusChanged webhook.
active, pending, rejected, invalid, deleted, failed Set when status = failed.
ereborRejected, cardProviderRejected, providerAccountMissing, cardLimitReached, cardInUse, provisioningTimeout, systemError Structured provider rejection detail. Set when status = failed and the failure was a provider terminal rejection; absent for provisioning timeouts and internal failures.
Hide child attributes
Hide child attributes
The institution that rejected the request — erebor for Erebor Bank, N.A. New providers may be added, so treat the string as free-form rather than a fixed set.
Vendor machine-readable error code (e.g. INVALID_REQUEST).
Vendor human-readable message.
Per-field validation messages, each in field: message form.
Vendor request id, for support escalation.
Why registration was rejected. Present when status is rejected; the key is absent otherwise.
countryProhibited, cardVerificationDeclined, bankVerificationDeclined, countryNotSupported Why the account became unusable after activation, derived from a returned payout. Present when status is invalid; the key is absent otherwise.
accountClosed, accountFrozenByBank, routingOrAccountNumberInvalid, accountHolderDeceased, accountDoesNotSupportTransfers, payeeNameMismatch, walletUnreachableOnNetwork, billingAddressMismatch, cardExpired, cardClosedOrLostStolen, pushToCardUnsupported, cardDeclinedByIssuer The provider's own code for the failure behind invalidReason, verbatim — for US bank accounts the NACHA return code from the failed payout, e.g. R15. Absent when the provider gave no code, or when the account was invalidated by something other than a returned payment.
Read invalidReason to decide what to do; read this when you need the precise cause for support or reconciliation. invalidReason is a deliberately small set, so several codes map to one member — treat this field as an open vocabulary and do not switch on it. A return code that maps to no invalidReason leaves the account active and sets neither field; the returned payout still fails the transaction, but the unmapped code is not surfaced on the External Account.
Optional display label.
Populated when type = bankUs.
Hide child attributes
Hide child attributes
Last four digits of the US bank account number.
Nine-digit ABA routing number (not a secret).
The account type on file. Always present.
checking, savings Bank display name.
The (asset, rail) pairs this account can be paid over — a per-account answer, not a platform-wide one. For an account provisioned through Coinme Inc. it is the participation list this specific bank reported at registration, narrowed by the rails your project and the platform enable, so it never advertises a rail a payout or Deposit Address create would then refuse. Erebor Bank, N.A. publishes no per-bank participation check, so accounts it provisions report the conservative ach / achSameDay / wire set and rtp stays absent — there, a missing rtp means unverified, not refused. Look for an {asset: usd, network: rtp} pair before choosing rtp as a payout rail.
Hide child attributes
Hide child attributes
Fiat currency, e.g. usd.
Rail this account can receive on.
ach, achSameDay, wire, rtp Minimum transfer amount enforced for this (asset, rail) pair. Absent when no limit is published for the rail — absence is not a claim that the provider enforces none.
Maximum transfer amount enforced for this (asset, rail) pair. Absent on the same terms as minimumAmount.
Populated when type = bankIban.
Hide child attributes
Hide child attributes
Last four characters of the IBAN.
SWIFT BIC (8 or 11 chars).
ISO 3166-1 alpha-2; derived from the IBAN prefix when not supplied.
Structured bank postal address (canonical Address).
Hide child attributes
Hide child attributes
Street address, line 1.
Street address, line 2.
City.
State / province / region.
ISO 3166-1 alpha-2
ZIP / postal code.
Populated when type = bankCanada.
Hide child attributes
Hide child attributes
Three-digit institution number.
Five-digit transit number.
Last four digits of the Canadian bank account number.
Bank display name.
Populated when type = walletExternal.
Hide child attributes
Hide child attributes
The registered blockchain address, as submitted.
Crypto network family for a registered external wallet. A walletExternal is registered per family (an EVM address is valid across every EVM chain), and the registration covers every served network in that family.
evm, solana DestinationCustodian enum value (reused from VA).
ANCHORAGE_SG, ANCHORAGE_US, AQUANOW_CA, B2C2_UK, B2C2_US, BITGO_SG, BITGO_US, BITSTAMP_US, BVNK_US, CIRCLE_FR, CIRCLE_US, CITIBANK_US, COINBASE_US, COINSMART_CA, COPPER_CH, COPPER_UK, CUMBERLAND_DRW_LLC_US, CUMBERLAND_SG, EREBOR_BANK_US, FALCONX_US, FIDELITY_UK, FIDELITY_US, FIREBLOCKS_APAC, FIREBLOCKS_US, GALAXY_KY, GEMINI_US, KRAKEN_BVI, KRAKEN_EU_IE, KRAKEN_UK, KRAKEN_US, NUBANK_BR, PAXOS_US, RAMP_NETWORK_US, ROBINHOOD_US, WINTERMUTE_GB, SELF_HOSTED, OTHER Set when custodian = OTHER.
The (asset, network) pairs this wallet can receive, derived from networkFamily ({usdc, usdt} across the family's served networks).
Hide child attributes
Hide child attributes
Populated when type = card.
Hide child attributes
Hide child attributes
Last four digits of the card PAN.
Card brand, derived server-side from the PAN.
visa, mastercard, amex, discover Card funding type, derived server-side. Only debit today.
debit, credit, prepaid Card expiry month (MM).
Card expiry year (YYYY).
Whether the stored billing address was supplied on the request or filled from the owning customer's address.
provided, customerDefault Transaction ids that this registration submitted for sender-attribution release. Returned ONLY on the POST create response, and only when registering this walletExternal matched held inbounds. Attribution is async: each entry is submitted to the provider from awaitingAction.awaitingSenderAttribution and moves to processing.fundsPulled once settlement confirms — so an immediate GET of an id may still show awaitingAction. Omitted on GETs (the create path is the only writer).
Public TypeID, e.g. txn_01h455vb4pex5vsknk084sn02q; legacy UUID suffixes are accepted until non-v7 rows are retired.
^[a-z]+_([0-9a-hjkmnp-tv-z]{26}|[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$When the external account was registered.
When the external account was last updated.
Was this page helpful?