Guides Use cases API Changelog

Submit attestations

Submit a new authorization attestation for a bank account in an errored status due to an R29 ACH return (Corporate Customer Advises Not Authorized).

After obtaining new authorization from the receiver, submit an attestation with the date the authorization was obtained and a brief description of how the authorization was obtained. If the attestation is accepted, the bank account transitions from errored to verified.

Constraints

  • The bank account's current errored status must be the result of an R29 return.
  • attestedAt must be on or after the date of the bank account's most recent R29 return and cannot be a future date.
  • Only one attestation may be submitted for a bank account. Use the Get attestation eligibility endpoint to confirm eligibility before submitting an attestation.

This endpoint is available only to allowlisted partners. Contact Moov Support for more information.

POST
/accounts/{accountID}/bank-accounts/{bankAccountID}/attestations
curl -X POST "https://api.moov.io/accounts/{accountID}/bank-accounts/{bankAccountID}/attestations" \
  -H "Authorization: Bearer {token}" \
  -H "X-Moov-Version: v2026.10.00" \
  -d '{
  "attestedAt": "2026-05-15",
  "description": "string"
}'
import { Moov } from "@moovio/sdk";

const moov = new Moov({
  security: {
    username: "",
    password: "",
  },
});

async function run() {
  const result = await moov.bankAccounts.createAttestation({
    accountID: "<id>",
    bankAccountID: "<id>",
    createBankAccountAttestation: {
      attestedAt: new Date("2026-05-15"),
      description: "each duh famously athwart",
    },
  });

  console.log(result);
}

run();
declare(strict_types=1);

require 'vendor/autoload.php';

use Brick\DateTime\LocalDate;
use Moov\MoovPhp;
use Moov\MoovPhp\Models\Components;

$sdk = MoovPhp\Moov::builder()
    ->setSecurity(
        new Components\Security(
            username: '',
            password: '',
        )
    )
    ->build();

$createBankAccountAttestation = new Components\CreateBankAccountAttestation(
    attestedAt: LocalDate::parse('2026-05-15'),
    description: 'each duh famously athwart',
);

$response = $sdk->bankAccounts->createAttestation(
    accountID: '<id>',
    bankAccountID: '<id>',
    createBankAccountAttestation: $createBankAccountAttestation

);

if ($response->bankAccountAttestation !== null) {
    // handle response
}
package hello.world;

import io.moov.sdk.Moov;
import io.moov.sdk.models.components.CreateBankAccountAttestation;
import io.moov.sdk.models.components.Security;
import io.moov.sdk.models.errors.BankAccountAttestationValidationError;
import io.moov.sdk.models.errors.GenericError;
import io.moov.sdk.models.operations.CreateBankAccountAttestationResponse;
import java.lang.Exception;
import java.time.LocalDate;

public class Application {

    public static void main(String[] args) throws GenericError, BankAccountAttestationValidationError, Exception {

        Moov sdk = Moov.builder()
                .security(Security.builder()
                    .username("")
                    .password("")
                    .build())
            .build();

        CreateBankAccountAttestationResponse res = sdk.bankAccounts().createAttestation()
                .accountID("<id>")
                .bankAccountID("<id>")
                .createBankAccountAttestation(CreateBankAccountAttestation.builder()
                    .attestedAt(LocalDate.parse("2026-05-15"))
                    .description("each duh famously athwart")
                    .build())
                .call();

        if (res.bankAccountAttestation().isPresent()) {
            System.out.println(res.bankAccountAttestation().get());
        }
    }
}
from datetime import date
from moovio_sdk import Moov
from moovio_sdk.models import components


with Moov(
    security=components.Security(
        username="",
        password="",
    ),
) as moov:

    res = moov.bank_accounts.create_attestation(account_id="<id>", bank_account_id="<id>", attested_at=date.fromisoformat("2026-05-15"), description="each duh famously athwart")

    # Handle response
    print(res)
require 'moov_ruby'

Models = ::Moov::Models
s = ::Moov::Client.new(
  security: Models::Components::Security.new(
    username: '',
    password: ''
  )
)
res = s.bank_accounts.create_attestation(account_id: '<id>', bank_account_id: '<id>', create_bank_account_attestation: Models::Components::CreateBankAccountAttestation.new(
  attested_at: Date.parse('2026-05-15'),
  description: 'each duh famously athwart'
))

unless res.bank_account_attestation.nil?
  # handle response
end
using Moov.Sdk;
using Moov.Sdk.Models.Components;
using System;

var sdk = new MoovClient(security: new Security() {
    Username = "",
    Password = "",
});

var res = await sdk.BankAccounts.CreateAttestationAsync(
    accountID: "<id>",
    bankAccountID: "<id>",
    body: new CreateBankAccountAttestation() {
        AttestedAt = DateOnly.Parse("2026-05-15"),
        Description = "each duh famously athwart",
    }
);

// handle response
The request completed successfully.
application/json
Example
An attestation that a new authorization was obtained for a R29-errored bank account.
{
  "attestationID": "string",
  "bankAccountID": "string",
  "accountID": "string",
  "createdOn": "2026-05-19T14:30:00Z",
  "attestedAt": "2026-05-15",
  "description": "string"
}

Response headers

x-request-id

string required
A unique identifier used to trace requests.
The server could not understand the request due to invalid syntax.
application/json
Example
{
  "error": "string"
}

Response headers

x-request-id

string required
A unique identifier used to trace requests.
The request contained missing or expired authentication.

Response headers

x-request-id

string required
A unique identifier used to trace requests.
The user is not authorized to make the request.

Response headers

x-request-id

string required
A unique identifier used to trace requests.
The requested resource was not found.

Response headers

x-request-id

string required
A unique identifier used to trace requests.
The request conflicted with the current state of the target resource.
application/json
Example
{
  "error": "string"
}

Response headers

x-request-id

string required
A unique identifier used to trace requests.
The request was well-formed, but the contents failed validation. Check the request for missing or invalid fields.
application/json
Example
Describes which fields of a bank account attestation request failed validation.
{
  "attestedAt": "string",
  "description": "string"
}

Response headers

x-request-id

string required
A unique identifier used to trace requests.
Request was refused due to rate limiting.

Response headers

x-request-id

string required
A unique identifier used to trace requests.
The request failed due to an unexpected error.

Response headers

x-request-id

string required
A unique identifier used to trace requests.
The request failed because a downstream service failed to respond.

Response headers

x-request-id

string required
A unique identifier used to trace requests.

Headers

X-Moov-Version

string
Set this header to v2026.10.00 to use the API described in this specification. When omitted, the server defaults to v2024.01.00, the earliest supported version, which may not match the behavior documented here. An unrecognized well-formed version uses the latest supported version that is not newer than the requested version, when one exists. For example, v2026.08.00 uses v2026.07.00. A malformed value, such as 2022, returns a 404 response.
Possible values: v2026.10.00

Path parameters

accountID

string required

bankAccountID

string required

Body

application/json
Request body for creating a R29 re-authorization attestation for an errored bank account.

attestedAt

string<date> required
Date on which new authorization was obtained from the receiver, formatted as YYYY-MM-DD.

description

string <=500 characters required
Freeform text description describing how the authorization was obtained.

Response

application/json
An attestation that a new authorization was obtained for a R29-errored bank account.

accountID

string required
ID of the Moov account the bank account is linked to.

attestationID

string required
ID of the created attestation.

attestedAt

string<date> required
Date on which new authorization was obtained from the receiver, formatted as YYYY-MM-DD.

bankAccountID

string required
ID of the bank account the attestation belongs to.

createdOn

string<date-time> required
Timestamp at which the attestation was created.

description

string <=500 characters required
Freeform text description describing how the authorization was obtained.