API Reference

Create external bank account

post
https://api.wingspan.app/v3/finance/external-bank-accounts

Creates an external bank account either by providing routing/account numbers directly, supplying a provider public token returned by the bank-linking UI, or exchanging a Plaid Link public token for the selected Plaid account. Provider-linked accounts may start Verified when the provider verifies ownership or Pending when micro-deposits are still required. The Idempotency-Key header is REQUIRED so a retry after a 5xx/timeout cannot create a duplicate bank account, duplicate micro-deposit request, or duplicate token exchange. A manual create without accountHolderName derives the holder name from the account's verified legal name; when none can be derived it returns 422 with detailCode users.ExternalBankAccountHolderNameUnavailable, and the caller may supply accountHolderName instead.

Requires a session with recent MFA step-up for BankAccountChange. If step-up is missing or expired, this operation returns 403 StepUpMfaRequired; create and verify an MFA challenge at /v3/platform/mfa-challenges with requiredFor: "BankAccountChange", then retry.

Recent Requests
Log in to see full request history
TimeStatusUser Agent
Retrieving recent requests…
LoadingLoading…
Body Params

Register a US ACH or international bank account using routing number, account number, account type, and holder type. accountHolderType selects the ACH SEC code (Business → CCD, Individual → PPD/WEB) so a business payout is not misclassified; when supplied, accountHolderName is the receiving-party name. For an Account-owned US ACH account, an omitted name is taken from the verified legal identity on file. The request is rejected when no appropriate verified legal name is available.

subject
object

The party this bank account belongs to. Use { type: Payee, id: <Payee.id> } for a payer-managed destination that remains valid while the Payee is unlinked. Defaults to the owning Account when omitted.

string
required

Primary bank routing identifier; a US ABA routing number for domestic accounts.

string

Secondary routing identifier required by some international corridors, such as the Canadian transit number paired with the institution number in routingNumber.

string
required

Account number.

string
enum
required

Account type.

Allowed:
string
enum
required

Individual or Business. Required — selects the ACH SEC code and is orthogonal to accountType.

Allowed:
string

Legal name of the account holder (individual or business) as it appears at the bank. For an Account-owned US ACH account, this may be omitted: Individual uses the verified individual name, while Business uses the verified business name or falls back to the verified individual name. The request is rejected if that name is unavailable. US ACH accounts owned by a Payee or Payer must supply it. International accounts do not derive an omitted name. Used as the ACH receiving-party name in the NACHA entry detail.

string

ISO 3166-1 alpha-2 country of the account's bank. Defaults to US. A non-US country registers an international account (routed via the global payout rail) rather than US ACH, and skips the US ABA routing validation.

string
enum

ISO 4217 currency of the account. Defaults to USD; pair with a non-US country.

string

Beneficiary name in the local script when required by the selected country/currency corridor.

string

Corridor-specific beneficiary bank account type. Allowed values are returned by the external bank account missing-fields requirements for the selected corridor.

string
boolean

Must be false for a Payee or Payer subject.

metadata
object

Free-form key-value pairs. Max 50 keys; key length at most 40 characters; value length at most 500 characters. Where a list endpoint declares metadata filtering, it uses the QueryQL namespace via filter[metadata.{key}][eq]=value or filter[metadata.{key}][in][]=value. Endpoints that do not declare the dynamic Metadata filter do not support Metadata filtering.

Headers
string
required
length between 1 and 255
^[\x21-\x7e]{1,255}$

REQUIRED idempotency token for money-moving requests (e.g. transfers). The token is used by the API so a retry after a 5xx/timeout replays the original result instead of moving funds twice. Reuse the same key to retry safely; use a NEW key to issue a genuinely new transfer. Use 1-255 printable ASCII characters.

string
^(?:[A-Za-z0-9_.]{22}|[a-f0-9]{24})$

Select the Account for an Account-scoped operation. A direct ServiceAccount API key MUST supply this header, and the target must be within the ServiceAccount owner's or Authorization grant's Account boundary. A Person bearer may select an Account on which it has an active Stakeholder, and an Account session may select its bound Account (or a descendant only when the session explicitly includes descendants).

string
enum
Defaults to application/json

Generated from available response content types

Allowed:
Responses

Updated 4 months ago

Did this page help you?
Language
Credentials
Bearer
JWT
LoadingLoading…
Response
Click Try It! to start a request and see the response here! Or choose an example:
application/json
application/problem+json

Updated 4 months ago

Did this page help you?