Account Numbers

Account Numbers provide access to verified ACH account and routing numbers for Accounts. These numbers enable money movement operations such as direct deposits and withdrawals.

Link to this section#Overview

To access Account Numbers:

1. Enable the Account Numbers product in your Connector configuration
2. Have the end-user connect their institution through the Connector
3. Subscribe to the account.verified webhook to be notified when numbers are available
4. Retrieve the ACH numbers by calling the ACH Numbers endpoint

Link to this section#REST Operations

ACH numbers are only available via server-to-server calls to the below endpoint.

Link to this section#Retrieve ACH Numbers

GEThttps://api.quiltt.io/v1/accounts/{accountId}/ach_numbersCopy endpoint URL to clipboard

Link to this section#Examples

{
  "accountId": "acct_12Hz9Dz7vEAuljYvhmPcvM9",
  "number": "1234567890",
  "routing": "021000021"
}

{
  "message": "Bad Request",
  "instruction": "Unsupported account kind: LOAN. Try a DEPOSITORY account."
}

{
  "message": "Forbidden",
  "instruction": "Connection is not enabled with the `ACCOUNT_NUMBERS` product."
}

{
  "message": "Not Found",
  "instruction": "Does the URL contain the ID of a verified Account?"
}

Link to this section#GraphQL Queries

While ACH numbers are only available via REST, you can check the verification status of accounts via GraphQL:

query GetAccount($id: ID!) {
  account(id: $id) {
    id
    name
    verified
  }
}

{
  "data": {
    "account": {
      "id": "acct_16FvuCM1Pg8NzjwuN9qndzm",
      "name": "Checking Account",
      "verified": true
    }
  }
}

The verified field indicates whether the account has been verified for money movement and ACH numbers are available.

Link to this section#Webhooks

Link to this section#account.verified

The account.verified event fires when an account becomes verified for money movement and ACH numbers become available via the REST Account Numbers API.

{
  "id": "evt_132KkExx5EIhvJmrYqIh8Y",
  "at": "2026-03-02T14:30:00Z",
  "type": "account.verified",
  "profile": {
    "id": "p_132KkEtQv92QhqZ8xDAhck",
    "uuid": "019c1c0e-3571-7337-8238-542bc1d2c0ae",
    "metadata": null
  },
  "record": {
    "id": "acct_132KkEtZJ7LHnqM8apAwXz",
    "connectionId": "conn_132KkEtV70C4z4KI2Rqq9S",
    "state": "OPEN",
    "metadata": null,
    "at": "2026-03-02T14:30:00Z"
  },
  "metadata": {}
}

Link to this section#Tokenized Account Numbers

The Account.mask is the last four digits of the account number surfaced during data aggregation — typically the institution's real account number. The number you retrieve from the ACH Numbers endpoint after an account.verified webhook can be different, and its last four digits may not match the mask.

This behavior is expected for institutions that issue tokenized account numbers (TANs). A TAN is a surrogate account number that maps to the underlying account but intentionally differs from the real account number, letting end-users move money without exposing their actual account details. Because the verified number is a token rather than the real account number, its last four digits do not match the mask.

A mismatch between the mask and the verified ACH number is by design and does not indicate an error. For background on how tokenized numbers work, see Mastercard's Tokenized Account Numbers (TAN) documentation.

Link to this section#Security Considerations

• Account numbers are considered Sensitive Customer Information under various regulations. Implement appropriate data retention policies and ensure compliance with applicable frameworks (GLBA, SOC 2, etc.).

Link to this section#Best Practices

• Logging: Never log full account numbers. If logging is necessary, mask all but the last 4 digits.
• Storage: Store account numbers only when necessary. Use encrypted storage (AES-256 or equivalent).
• Transmission: Always use TLS 1.2 or higher for API calls.
• Payment Processors: Consider using a trusted Payment Processor like Straddle for handling money movement operations. Straddle provides a secure, compliant platform for processing bank payments using Quiltt's Processor Tokens.