> ## Documentation Index > Fetch the complete documentation index at: https://docs.polygon.technology/llms.txt > Use this file to discover all available pages before exploring further. # List External Accounts > List External Accounts. Both `customerId` and `counterpartyId` are optional filters — omit both to list all external accounts in the project (still tenant-scoped by project). ## OpenAPI ````yaml /api-reference/openapi.yaml get /external-accounts openapi: 3.0.3 info: title: Polygon OMS Public API version: v26.05.28-0001 description: >- Unified API for moving money between crypto and fiat. Three ways to move money: Transactions (instant, wallet or card funded, including Cash-In for in-person cash deposits), Deposit Addresses (reusable crypto deposit configurations), and Virtual Accounts (dedicated bank accounts that auto-convert fiat to crypto). Standard transactions follow a two-step flow: create a Quote (pricing), then create a Transaction (execution). Cash-in codes generate a one-time deposit code for in-person cash deposits at retail locations. contact: name: Polygon OMS url: https://oms.polygon.technology servers: - url: https://sandbox-api.polygon.technology/v0.12 description: Sandbox - url: https://api.polygon.technology/v0.12 description: Production security: - BearerAuth: [] tags: - name: Auth description: Authentication via FrontEgg - name: Customers description: Customer management and KYC - name: Customer - name: Wallet - name: Quote - name: Transaction - name: CashIns - name: CashLocation - name: Sandbox - name: VirtualAccount - name: Counterparty - name: ExternalAccount - name: Reference - name: DepositAddress paths: /external-accounts: get: tags: - ExternalAccount summary: List External Accounts description: >- List External Accounts. Both `customerId` and `counterpartyId` are optional filters — omit both to list all external accounts in the project (still tenant-scoped by project). operationId: listExternalAccounts parameters: - $ref: '#/components/parameters/PaginationParams.limit' - $ref: '#/components/parameters/PaginationParams.startingAfter' - $ref: '#/components/parameters/PaginationParams.endingBefore' - name: customerId in: query required: false description: Filter to a single customer (`cst_` prefix). schema: type: string - name: counterpartyId in: query required: false description: Counterparty ID (`ctp_` prefix). schema: type: string responses: '200': description: The request has succeeded. content: application/json: schema: $ref: '#/components/schemas/ExternalAccountList' components: parameters: PaginationParams.limit: name: limit in: query required: false description: >- Page size, supported range 1-100. The default and maximum are per-resource (see each endpoint's description; most endpoints default to 50) and are resolved at runtime from configuration. Values outside the range are clamped to the nearest bound rather than rejected. The range is published machine-readably via the `x-minimum`/`x-maximum` OpenAPI extensions below — deliberately NOT via `@minValue`/`@maxValue`, which emit JSON-Schema `minimum`/`maximum` and make the generated SDK (Zod) reject values the server accepts and clamps. See `PaginatedList.limit` for the effective value applied. schema: type: integer format: int32 x-maximum: 100 x-minimum: 1 PaginationParams.startingAfter: name: startingAfter in: query required: false schema: type: string PaginationParams.endingBefore: name: endingBefore in: query required: false schema: type: string schemas: ExternalAccountList: type: object properties: object: type: string description: Resource type discriminator. limit: type: integer format: int32 description: |- The effective page size applied to this response, after clamping an out-of-range or unset requested `limit` into the supported bound. hasMore: type: boolean description: >- True when more rows exist beyond this page in the direction of travel (forward by default, backward when `endingBefore` was supplied). nextCursor: type: string description: |- Opaque cursor pointing at the last item in this page. Present when `data` is non-empty. Pass as `startingAfter` to fetch the next page; `hasMore=false` signals no more pages forward. previousCursor: type: string description: >- Opaque cursor pointing at the first item in this page. Present when `data` is non-empty. Pass as `endingBefore` to page backward; when this yields an empty response the client is at the start of the list. data: type: array items: $ref: '#/components/schemas/ExternalAccount' description: The page of results. description: Paginated list of ExternalAccount resources. ExternalAccount: type: object properties: id: allOf: - $ref: '#/components/schemas/typeId' description: External Account ID (`ext_` prefix). object: type: string enum: - externalAccount description: Resource type discriminator. Always "externalAccount". owner: allOf: - $ref: '#/components/schemas/ExternalAccountOwner' description: 'Who owns this account: the customer or one of their counterparties.' ownerDisplayName: type: string description: >- Resolved display name of the customer owner, for list/detail rendering without a follow-up fetch (v0.12 list enrichment, #2520/#2665). Present only when `owner.kind = customer`; absent for counterparty-owned accounts — no counterparty-name resolver is wired for this resource. customer: allOf: - $ref: '#/components/schemas/CustomerSummary' description: |- Resolved id + display name of the owning customer. Present only when `owner.kind = customer`; absent for counterparty-owned accounts. type: allOf: - $ref: '#/components/schemas/ExternalAccountType' description: The instrument type; determines which detail object is populated. category: allOf: - $ref: '#/components/schemas/ExternalAccountCategory' description: >- High-level grouping: `fiatAccount` for bank or card accounts, `crypto` for wallets. The same value as the instrument `category` when this account is referenced in a transaction. status: allOf: - $ref: '#/components/schemas/ExternalAccountStatus' description: |- Current lifecycle status. A transition to `invalid` always fires the `externalAccount.statusChanged` webhook. failureReason: allOf: - $ref: '#/components/schemas/ExternalAccountFailureReason' description: Set when `status = failed`. failureDetail: allOf: - $ref: '#/components/schemas/ProviderRejectionDetail' description: >- Structured provider rejection detail. Set when `status = failed` and the failure was a provider terminal rejection; absent for provisioning timeouts and internal failures. rejectionReason: type: string description: Set when status = `rejected` (compliance screening). invalidReason: type: string description: >- Set when `status = invalid` (derived from payout returns). Free-text for now; a closed enum lands with the invalidation transition logic. label: type: string description: Optional display label. metadata: type: object additionalProperties: type: string description: Free-form key-value pairs supplied at creation or update. bankUs: allOf: - $ref: '#/components/schemas/ExternalAccountBankUsResponse' description: Populated when `type = bankUs`. bankIban: allOf: - $ref: '#/components/schemas/ExternalAccountBankIbanResponse' description: Populated when `type = bankIban`. bankCanada: allOf: - $ref: '#/components/schemas/ExternalAccountBankCanadaResponse' description: Populated when `type = bankCanada`. walletExternal: allOf: - $ref: '#/components/schemas/ExternalAccountWalletExternalResponse' description: Populated when `type = walletExternal`. card: allOf: - $ref: '#/components/schemas/ExternalAccountCardResponse' description: Populated when `type = card`. resolvedTransactions: type: array items: $ref: '#/components/schemas/typeId' description: >- Transaction ids that this registration submitted for sender-attribution release. Returned ONLY on the POST create response, and only when registering this walletExternal matched held inbounds. Attribution is async: each entry is submitted to the provider from `awaitingAction.awaitingSenderAttribution` and moves to `processing.fundsPulled` once settlement confirms — so an immediate GET of an id may still show `awaitingAction`. Omitted on GETs (the create path is the only writer). createdAt: type: string format: date-time description: When the external account was registered. updatedAt: type: string format: date-time description: When the external account was last updated. description: |- A saved payment destination registered for a customer or one of their counterparties. Exactly one of the per-type response detail objects is populated, selected by `type`. Write-only secrets (full account number, full IBAN) are never present on reads - only their last-4 renderings. typeId: type: string pattern: >- ^[a-z]+_([0-9a-hjkmnp-tv-z]{26}|[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$ description: >- Public TypeID, e.g. `txn_01h455vb4pex5vsknk084sn02q`; legacy UUID suffixes are accepted until non-v7 rows are retired. x-go-type: string ExternalAccountOwner: type: object oneOf: - $ref: '#/components/schemas/OwnerCustomer' - $ref: '#/components/schemas/OwnerCounterparty' discriminator: propertyName: kind mapping: customer: $ref: '#/components/schemas/OwnerCustomer' counterparty: $ref: '#/components/schemas/OwnerCounterparty' description: Who owns the External Account. CustomerSummary: type: object required: - id - name properties: id: allOf: - $ref: '#/components/schemas/typeId' description: The OMS customer id (`cst_` prefix). name: type: string description: Customer display name. description: >- A minimal, resolved reference to the owning OMS customer — id plus display name, for list/detail rendering without a follow-up customer fetch (v0.12 list enrichment, #2665). Distinct from `Party`: this is always the record's OWNING customer (Transaction.customerId / VirtualAccount.customerId / DepositAddress.customerId), not whichever side a party sits on. ExternalAccountType: type: string enum: - bankUs - bankIban - bankCanada - card - walletExternal description: >- External Account type. `card` is created only via the dedicated `POST /external-accounts/cards` endpoint; supplying `type = card` to the generic create is rejected with 422 `cardMustUseCardEndpoint`. `card` and `walletExternal` remain valid for reads, lists, get and delete. ExternalAccountCategory: type: string enum: - fiatAccount - crypto description: Coarse classification derived from `type`, stored for query convenience. ExternalAccountStatus: type: string enum: - active - pending - rejected - invalid - deleted - failed description: >- Lifecycle of an External Account. `pending → active` on successful Erebor provisioning; `pending → failed` on Erebor rejection or provisioning timeout. `rejected` (create-time country screening) and `invalid` (derived from payout returns) are reserved enum values with no transition logic in this slice. `deleted` is the soft-delete terminal. ExternalAccountFailureReason: type: string enum: - ereborRejected - cardProviderRejected - providerAccountMissing - cardLimitReached - cardInUse - provisioningTimeout - systemError description: Closed enum stamped on an External Account when `status = failed`. ProviderRejectionDetail: type: object properties: provider: type: string description: Vendor that rejected the request (e.g. `erebor`). code: type: string description: Vendor machine-readable error code (e.g. `INVALID_REQUEST`). message: type: string description: Vendor human-readable message. details: type: array items: type: string description: 'Per-field validation messages, each in `field: message` form.' providerRequestId: type: string description: Vendor request id, for support escalation. description: >- Structured, partner-safe description of a terminal provider rejection. Populated alongside a `failed` status so the rejection reason is visible without support/log access. The same object is returned as the `details` field of the `422` error body when a create is terminally rejected by the provider. ExternalAccountBankUsResponse: type: object required: - accountNumberLast4 - routingNumber properties: accountNumberLast4: type: string description: Last four digits of the US bank account number. routingNumber: type: string description: Nine-digit ABA routing number (not a secret). accountType: $ref: '#/components/schemas/BankAccountType' bankName: type: string description: Bank display name. description: >- bankUs response detail. The full account number is never echoed - only its last four digits. ExternalAccountBankIbanResponse: type: object required: - ibanLast4 - BIC - countryCode properties: ibanLast4: type: string description: Last four characters of the IBAN. BIC: type: string description: SWIFT BIC (8 or 11 chars). bankAddress: allOf: - $ref: '#/components/schemas/Address' description: Structured bank postal address (canonical Address). countryCode: type: string description: ISO 3166-1 alpha-2; derived from the IBAN prefix when not supplied. description: |- bankIban response detail. The full IBAN is never echoed - only its last four characters. ExternalAccountBankCanadaResponse: type: object required: - institutionNumber - transitNumber - accountNumberLast4 properties: institutionNumber: type: string description: Three-digit institution number. transitNumber: type: string description: Five-digit transit number. accountNumberLast4: type: string description: Last four digits of the Canadian bank account number. bankName: type: string description: Bank display name. description: >- bankCanada response detail. The full account number is never echoed - only its last four digits. ExternalAccountWalletExternalResponse: type: object required: - blockchainAddress - networkFamily - custodian properties: blockchainAddress: type: string description: The registered blockchain address, as submitted. networkFamily: $ref: '#/components/schemas/NetworkFamily' custodian: allOf: - $ref: '#/components/schemas/DestinationCustodian' description: DestinationCustodian enum value (reused from VA). otherCustodian: type: string description: Set when `custodian = OTHER`. supportedDestinations: type: array items: $ref: '#/components/schemas/SupportedDestination' description: >- The (asset, network) pairs this wallet can receive, derived from `networkFamily` (`{usdc, usdt}` across the family's served networks). description: >- walletExternal response detail. The blockchain address is public, so it is echoed as submitted. ExternalAccountCardResponse: type: object properties: cardNumberLast4: type: string description: Last four digits of the card PAN. cardProvider: allOf: - $ref: '#/components/schemas/CardBrand' description: Card brand, derived server-side from the PAN. cardType: allOf: - $ref: '#/components/schemas/CardType' description: Card funding type, derived server-side. Only `debit` today. expiryMonth: type: integer format: int32 description: Card expiry month (MM). expiryYear: type: integer format: int32 description: Card expiry year (YYYY). billingAddressSource: allOf: - $ref: '#/components/schemas/BillingAddressSource' description: >- Whether the stored billing address was supplied on the request or filled from the owning customer's address. description: >- card response detail. Last-4 + expiry only; PAN/CVV are never stored or returned. `cardProvider` (brand) and `cardType` are derived server-side from the PAN and are response-only. OwnerCustomer: type: object required: - kind - customerId properties: kind: type: string enum: - customer description: Owner kind discriminator. customerId: allOf: - $ref: '#/components/schemas/typeId' description: Owning customer (cus_… or legacy public id). description: Customer-owned External Account. title: Customer-owned OwnerCounterparty: type: object required: - kind - counterpartyId properties: kind: type: string enum: - counterparty description: Owner kind discriminator. counterpartyId: allOf: - $ref: '#/components/schemas/typeId' description: Counterparty (ctp_…) id. description: Counterparty-owned External Account (an address-book entry). title: Counterparty-owned BankAccountType: type: string enum: - checking - savings description: Bank account sub-type for US accounts. Address: type: object properties: line1: type: string description: Street address, line 1. line2: type: string description: Street address, line 2. city: type: string description: City. state: type: string description: State / province / region. country: type: string description: ISO 3166-1 alpha-2 zipCode: type: string description: ZIP / postal code. description: A postal address. country is an ISO 3166-1 alpha-2 country code. NetworkFamily: type: string enum: - evm - solana description: >- Crypto network family for a registered external wallet. A walletExternal is registered per family (an EVM address is valid across every EVM chain), and the registration covers every served network in that family. DestinationCustodian: type: string enum: - ANCHORAGE_SG - ANCHORAGE_US - AQUANOW_CA - B2C2_UK - B2C2_US - BITGO_SG - BITGO_US - BITSTAMP_US - BVNK_US - CIRCLE_FR - CIRCLE_US - CITIBANK_US - COINBASE_US - COINSMART_CA - COPPER_CH - COPPER_UK - CUMBERLAND_DRW_LLC_US - CUMBERLAND_SG - EREBOR_BANK_US - FALCONX_US - FIDELITY_UK - FIDELITY_US - FIREBLOCKS_APAC - FIREBLOCKS_US - GALAXY_KY - GEMINI_US - KRAKEN_BVI - KRAKEN_EU_IE - KRAKEN_UK - KRAKEN_US - NUBANK_BR - PAXOS_US - RAMP_NETWORK_US - ROBINHOOD_US - WINTERMUTE_GB - SELF_HOSTED - OTHER SupportedDestination: type: object required: - asset - network properties: asset: type: string description: Stablecoin symbol, e.g. `usdc` / `usdt`. network: allOf: - $ref: '#/components/schemas/CryptoNetwork' description: >- Network the asset can be delivered on, e.g. `ethereum` / `base` / `solana`. description: >- An (asset, network) pair a walletExternal external account can receive — one entry per supported stablecoin on each network its family serves. CardBrand: type: string enum: - visa - mastercard - amex - discover description: >- Card network/brand. Derived server-side from the PAN; never accepted on a request. CardType: type: string enum: - debit - credit - prepaid description: |- Card funding type, derived server-side from the PAN. Only `debit` is supported today; `credit` and `prepaid` are reserved for future push-to-card / pull-from-card support. BillingAddressSource: type: string enum: - provided - customerDefault description: |- Where a card's billing address came from. `provided` = supplied on the request; `customerDefault` = filled from the owning customer's address because the request omitted it. CryptoNetwork: type: string enum: - ethereum - polygon - base - solana description: >- Wire vocabulary for a crypto `network` request field: ethereum, polygon, base, solana. This is vocabulary, not availability — which of these a given destination type actually accepts is enforced at runtime per destination type against the narrower Erebor-served set, so `polygon` is legal on the wire but currently rejected wherever Erebor does not serve it. Numeric EVM chain ids (e.g. "1", "137", "8453") were never accepted by BPN — no chain-id-to-name coercion exists, so nothing here deprecates prior behavior. Values are lowercase on the wire; the server additionally normalizes case and surrounding whitespace on input, so this schema is stricter than the server in that one dimension — send lowercase, untrimmed-safe values to stay strictly schema-valid. A `network` field may be typed `CryptoNetwork` regardless of whether it appears on a response, as long as its sole writer is gated by `eanetworks.AllServedNetworks()` — a runtime-enforced subset of this enum, with the containment itself enforced by `TestCryptoNetwork_SupersetOfServedNetworks` (services/externalaccount/networks/networks_test.go). That guarantee is what makes the enum safe there: the value can never leave the enum's vocabulary no matter which code path renders it. A `network` field whose writer is NOT so gated stays `string` pending #2666's outbound enum guard — for such a field, a stored value outside the enum would break a strict partner client validator (this happened in production: #2528). `chain` fields are deliberately excluded too: their vocabulary is wider and includes `bitcoin`, which this enum does not carry. securitySchemes: BearerAuth: type: http scheme: bearer bearerFormat: JWT description: Token from POST /auth/token ````