# Link a bank account

`POST /accounts/{accountID}/bank-accounts`

API version: `v2026.10.00`. Send `X-Moov-Version: v2026.10.00` to get the behavior described here.

> AI agents: search and read all Moov docs with the docs MCP server at https://docs.moov.io/mcp (no API key). Setup: https://docs.moov.io/guides/developer-tools/mcp-ai/docs-mcp/index.md

Link a bank account to an existing Moov account. Read our [bank accounts guide](https://docs.moov.io/guides/sources/bank-accounts/) to learn more.

It is strongly recommended that callers include the `X-Wait-For` header, set to `payment-method`, if the newly linked
bank account is intended to be used right away. If this header is not included, the caller will need to poll the [List Payment
Methods](https://docs.moov.io/api/sources/payment-methods/list/)
endpoint to wait for the new payment methods to be available for use.

To access this endpoint using an [access token](https://docs.moov.io/api/authentication/access-tokens/) 
you'll need to specify the `/accounts/{accountID}/bank-accounts.write` scope.

## Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `X-Moov-Version` | header | string |  | Set this header to v2026.10.00 to use the API described in this specification. When omitted, the server defaults to v2024.01.00, the earliest supported version, which may not match the behavior documented here. An unrecognized well-formed version uses the latest supported version that is not newer than the requested version, when one exists. For example, `v2026.08.00` uses `v2026.07.00`. A malformed value, such as `2022`, returns a `404` response. Values: `v2026.10.00`. |
| `x-wait-for` | header | string |  | Optional header to wait for certain events, such as the creation of a payment method, to occur before returning a response. When this header is set to `payment-method`, the response will include any payment methods that were created for the newly linked bank account in the `paymentMethods` field. Otherwise, the `paymentMethods` field will be omitted from the response. Values: `payment-method`, `rail-response`. |
| `accountID` | path | string | Yes |  |

## Request body

Content type: `application/json`

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `account` | object |  | Send exactly one of `account`, `requestRiskVerification`, `plaid`, `plaidLink`, `mx`. |
| `account.holderName` | string | Yes |  |
| `account.holderType` | string | Yes | The type of holder on a funding source. Values: `individual`, `business`, `guest`. |
| `account.accountNumber` | string | Yes |  |
| `account.bankAccountType` | string | Yes | The bank account type. Values: `checking`, `savings`, `general-ledger`, `loan`. |
| `account.routingNumber` | string | Yes |  |
| `requestRiskVerification` | boolean |  | Send exactly one of `account`, `requestRiskVerification`, `plaid`, `plaidLink`, `mx`. Requests a synchronous risk-verification attempt on create or re-link. Only honored for allowlisted calling accounts; ignored otherwise. |
| `plaid` | object |  | Send exactly one of `account`, `requestRiskVerification`, `plaid`, `plaidLink`, `mx`. The details of a Plaid processor integration for a linked funding source. `sandbox` - When linking a bank account to a `sandbox` account using a Plaid processor token a default bank account response will be used. The following default data will be used to generate the bank account in this flow: ``` RoutingNumber: "011401533", AccountNumber: "1111222233330000", AccountType: "checking", Mask: "0000" ``` |
| `plaid.token` | string | Yes |  |
| `plaidLink` | object |  | Send exactly one of `account`, `requestRiskVerification`, `plaid`, `plaidLink`, `mx`. This is used by Moov.js with a Plaid reseller relationship. The details of a Plaid link integration for a linked funding source. You can simulate linking bank accounts with Plaid in test mode. See our [test mode](https://docs.moov.io/guides/get-started/test-mode/#plaid) guide for more information. Plaid's `sandbox` environment - (requires Plaid reseller setup with Moov). When linking a bank account to a `sandbox` account using a Plaid public token it will utilize Plaid's sandbox environment. The Plaid public token provided must be generated from Plaid's sandbox environment. Please see <a href="https://plaid.com/docs/api/sandbox/#sandboxpublic_tokencreate" target="_blank">Plaid's sandbox documentation</a> for more details. |
| `plaidLink.publicToken` | string | Yes |  |
| `mx` | object |  | Send exactly one of `account`, `requestRiskVerification`, `plaid`, `plaidLink`, `mx`. The authorization code of a MX account which allows a processor to retrieve a linked payment account. `sandbox` - When linking a bank account to a `sandbox` account using a MX authorization code it will utilize MX's sandbox environment. The MX authorization code provided must be generated from MX's sandbox environment. |
| `mx.authorizationCode` | string | Yes |  |

## Response 200

The request completed successfully.

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `bankAccountID` | string | Yes |  |
| `fingerprint` | string | Yes | Once the bank account is linked, we don't reveal the full bank account number. The fingerprint acts as a way to identify whether two linked bank accounts are the same. |
| `status` | string | Yes | Values: `new`, `verified`, `verificationFailed`, `pending`, `errored`. |
| `holderName` | string | Yes |  |
| `holderType` | string | Yes | The type of holder on a funding source. Values: `individual`, `business`, `guest`. |
| `bankName` | string | Yes |  |
| `bankAccountType` | string | Yes | The bank account type. Values: `checking`, `savings`, `general-ledger`, `loan`. |
| `routingNumber` | string | Yes |  |
| `lastFourAccountNumber` | string | Yes |  |
| `updatedOn` | string (date-time) | Yes |  |
| `statusReason` | string |  | The reason the bank account status changed to the current value. Values: `bank-account-created`, `verification-initiated`, `micro-deposit-attempts-exceeded`, `micro-deposit-expired`, `max-verification-failures`, `verification-attempts-exceeded`, `verification-expired`, `verification-successful`, `ach-debit-return`, `ach-credit-return`, `rtp-credit-failure`, `fednow-credit-failure`, `micro-deposit-return`, `admin-action`, `other`. |
| `exceptionDetails` | object |  | Reason for, and details related to, an `errored` or `verificationFailed` bank account status. |
| `exceptionDetails.achReturnCode` | string |  | The return code of an ACH transaction that caused the bank account status to change. - R02: Account Closed - R03: No Account/Unable to Locate Account - R04: Invalid Account Number - R05: Improper Debit to Consumer Account - R07: Authorization Revoked by Customer - R08: Payment Stopped - R10: Customer Advises Originator is Not Known or Authorized to Receiver - R11: Customer Advises Entry Not in Accordance with the Terms of the Authorization - R12: Branch Sold to Another DFI - R13: RDFI not qualified to participate - R14: Representative payee deceased or unable to continue in that capacity - R15: Beneficiary or bank account holder - R16: Bank account frozen - R17: Entry with Invalid Account Number Initiated Under Questionable Circumstances - R20: Non-payment bank account - R23: Credit entry refused by receiver - R29: Corporate customer advises not authorized - R34: Limited participation RDFI - R38: Stop Payment on Source Document (Adjustment Entry) - R39: Improper Source Document Values: `R02`, `R03`, `R04`, `R05`, `R07`, `R08`, `R10`, `R11`, `R12`, `R13`, `R14`, `R15`, `R16`, `R17`, `R20`, `R23`, `R29`, `R34`, `R38`, `R39`. |
| `exceptionDetails.rtpRejectionCode` | string |  | The rejection code of an RTP transaction that caused the bank account status to change. - AC03: Account Invalid - AC04: Account Closed - AC06: Account Blocked - AC14: Creditor Account Type Invalid - AG01: Transactions Forbidden On Account - AG03: Transaction Type Not Supported - MD07: Customer Deceased Values: `AC03`, `AC04`, `AC06`, `AC14`, `AG01`, `AG03`, `MD07`. |
| `exceptionDetails.fednowRejectionCode` | string |  | The rejection code of a FedNow transaction that caused the bank account status to change. - AC02: Debtor account is invalid - AC03: Creditor account is invalid - AC04: Account closed - AC06: Account is blocked - AC07: Creditor account closed - AC10: Debtor account currency is invalid or missing - AC11: Creditor account currency is invalid or missing - AC13: Debtor account type missing or invalid - AC14: Creditor account type missing or invalid - AG01: Transaction is forbidden on this type of account - AG03: Transaction type is not supported/authorized on this account - BE06: End customer specified is not known at associated Sort/National Bank Code or no longer exists in the books - DUPL: Payment is a duplicate of another payment - MD07: End customer is deceased - NOAT: Receiving customer account does not support/accept this message type - RC02: Bank identifier is invalid or missing - RC03: Debtor FI identifier is invalid or missing - RC04: Creditor FI identifier is invalid or missing |
| `exceptionDetails.description` | string | Yes | Details related to an `errored` or `verificationFailed` bank account status. |
| `paymentMethods` | array of object |  | Includes any payment methods generated for a newly created bank account, removing the need to call the List Payment Methods endpoint following a successful Create BankAccount request. **NOTE: This field is only populated for Create BankAccount requests made with the `X-Wait-For` header.** |
| `paymentMethods[].paymentMethodID` | string | Yes | ID of the payment method. |
| `paymentMethods[].paymentMethodType` | string | Yes | The payment method type that represents a payment rail and directionality Values: `moov-wallet`, `ach-debit-fund`, `ach-debit-collect`, `ach-credit-standard`, `ach-credit-same-day`, `rtp-credit`, `card-payment`, `push-to-card`, `pull-from-card`, `apple-pay`, `card-present-payment`, `instant-bank-credit`, `push-to-apple-pay`, `pull-from-apple-pay`, `google-pay`, `push-to-google-pay`, `pull-from-google-pay`. |
| `riskVerificationOutcome` | string |  | The outcome of a requested risk-verification attempt. `notAttempted` when `requestRiskVerification` was not set, or the calling account was not allowlisted. Values: `notAttempted`, `success`, `inconclusive`, `decline`. |

## Errors

| Status | Meaning |
| --- | --- |
| 400 | The server could not understand the request due to invalid syntax. |
| 401 | The request contained missing or expired authentication. |
| 403 | The user is not authorized to make the request. |
| 404 | The requested resource was not found. |
| 409 | The request conflicted with the current state of the target resource. |
| 422 | The request was well-formed, but the contents failed validation. Check the request for missing or invalid fields. |
| 429 | Request was refused due to rate limiting. |
| 500 | The request failed due to an unexpected error. |
| 504 | The request failed because a downstream service failed to respond. |

## Examples

### cURL

```bash
curl -X POST "https://api.moov.io/accounts/{accountID}/bank-accounts" \
  -H "Authorization: Bearer {token}" \
  -H "X-Moov-Version: v2026.10.00" \
  -d '{
  "account": {
    "holderName": "string",
    "holderType": "individual",
    "accountNumber": "string",
    "bankAccountType": "checking",
    "routingNumber": "string"
  }
}'
```

### Typescript (SDK)

```typescript
import { Moov } from "@moovio/sdk";

const moov = new Moov({
  security: {
    username: "",
    password: "",
  },
});

async function run() {
  const result = await moov.bankAccounts.link({
    accountID: "b326319d-6118-4921-8d82-d5810d562eef",
    linkBankAccount: {
      plaidLink: {
        publicToken: "<value>",
      },
    },
  });

  console.log(result);
}

run();
```

Full reference with SDK examples in every language: https://docs.moov.io/api/v2026.10.00/sources/bank-accounts/create/