# Account Numbers
URL: https://www.quiltt.dev/api/numbers
Description: Learn how to retrieve verified ACH account and routing numbers through Quiltt
Navigation: api → numbers
Tags: API, Core Resources

**Account Numbers** provide access to verified ACH account and routing numbers
for [Accounts](/api/accounts). These numbers enable money movement operations
such as direct deposits and withdrawals.

Warning:
Account numbers are sensitive financial data. Always follow security best
  practices for logging, storage, and transmission. Never expose account numbers
  in client-side code or unencrypted communications.

## Overview

To access Account Numbers:

1. Enable the **Account Numbers** product in your Connector configuration
2. Have the end-user connect their institution through the Connector
3. Subscribe to the `account.verified` webhook to be notified when numbers are
   available
4. Retrieve the ACH numbers by calling the [ACH Numbers endpoint](#retrieve-ach-numbers)

## REST Operations

REST API Note:

ACH numbers are only available via server-to-server calls to the below endpoint.

### Retrieve ACH Numbers

API Endpoint - GET https://api.quiltt.io/v1/accounts/{accountId}/ach_numbers:

### Examples

Code Examples:

  ```json
    ["accountId": "acct_12Hz9Dz7vEAuljYvhmPcvM9",
      "number": "1234567890",
      "routing": "021000021"]
    ```
  ```json
    ["message": "Bad Request",
      "instruction": "Unsupported account kind: LOAN. Try a DEPOSITORY account."]
    ```
  ```json
    ["message": "Forbidden",
      "instruction": "Connection is not enabled with the `ACCOUNT_NUMBERS` product."]
    ```
  ```json
    [conditional content]
    ```

## GraphQL Queries

While ACH numbers are only available via REST, you can check the verification
status of accounts via GraphQL:

GraphQLRequest:

Query:
```graphql
query GetAccount($id: ID!) {
  account(id: $id) [id
    name
    verified]
}
```

  

Response:
```json
{
  "data": {
    "account": ["id": "acct_16FvuCM1Pg8NzjwuN9qndzm",
      "name": "Checking Account",
      "verified": true]
  }
}
```

The `verified` field indicates whether the account has been verified for money
movement and ACH numbers are available.

## Webhooks

### `account.verified`

The `account.verified` event fires when an account becomes verified for money
movement and ACH numbers become available via the [REST Account Numbers API](https://www.quiltt.dev/api-reference/rest#tag/Account-Numbers).

```json
{
  "id": "evt_132KkExx5EIhvJmrYqIh8Y",
  "at": "2026-03-02T14:30:00Z",
  "type": "account.verified",
  "profile": ["id": "p_132KkEtQv92QhqZ8xDAhck",
    "uuid": "019c1c0e-3571-7337-8238-542bc1d2c0ae",
    "metadata": null],
  "record": ["id": "acct_132KkEtZJ7LHnqM8apAwXz",
    "connectionId": "conn_132KkEtV70C4z4KI2Rqq9S",
    "kind": "DEPOSITORY",
    "state": "OPEN",
    "metadata": null,
    "at": "2026-03-02T14:30:00Z"],
  "metadata": {}
}
```

Webhooks Note:

## Tokenized Account Numbers

The `Account.mask` is the last four digits of the account number surfaced during
data aggregation — typically the institution's real account number. The `number`
you retrieve from the [ACH Numbers endpoint](#retrieve-ach-numbers) after an
`account.verified` webhook can be different, and its last four digits may not
match the `mask`.

This behavior is expected for institutions that issue **tokenized account numbers
(TANs)**. A TAN is a surrogate account number that maps to the underlying account
but intentionally differs from the real account number, letting end-users move
money without exposing their actual account details. Because the verified
`number` is a token rather than the real account number, its last four digits do
not match the `mask`.

A mismatch between the `mask` and the verified ACH `number` is by design and does
not indicate an error. For background on how tokenized numbers work, see
Mastercard's [Tokenized Account Numbers (TAN)](https://developer.mastercard.com/open-finance-us/documentation/products/pay/verification-money-transfer/#tokenized-account-numbers-tan)
documentation.

Info:
When an Account is reconnected, Quiltt resets its verification status and
  re-verifies it, because a tokenized number can change across connections.
  Always use the most recently retrieved ACH numbers for money movement.

## Security Considerations

- Account numbers are considered **Sensitive Customer Information** under various
  regulations. Implement appropriate data retention policies and ensure compliance
  with applicable frameworks (GLBA, SOC 2, etc.).

### Best Practices

- **Logging**: Never log full account numbers. If logging is necessary,
  mask all but the last 4 digits.
- **Storage**: Store account numbers only when necessary.
  Use encrypted storage (AES-256 or equivalent).
- **Transmission**: Always use TLS 1.2 or higher for API calls.
- **Payment Processors**: Consider using a trusted Payment Processor like
  [Straddle](/integrations/payments/straddle) for handling money movement operations.
  Straddle provides a secure, compliant platform for processing
  bank payments using Quiltt's Processor Tokens.