Create funding source

POST
/providers/{providerID}/participants/{participantID}/funding-sources

Create an active funding source for one of your participants, identified by the participant’s participantID or your externalID for them.

Creation is idempotent on (participant, fundingType, providerSourceID): re-sending an existing source returns the existing fundingSourceID, and reactivates the source if it had been removed.

Auth: API key or bearer token. Scoped to the calling provider. Returns 404 when no participant matches within your provider. Returns 422 when the body fails validation.

Request
cURL
curl -X POST https://api.moov.money/providers/{providerID}/participants/{participantID}/funding-sources \
  -u "$MOOV_API_KEY_ID:$MOOV_API_KEY_SECRET" \
  -H "X-Moov-Version: v2026.10.00" \
  -H "Content-Type: application/json" \
  -d '{
  "displayName": "First National Checking",
  "fundingType": "bank_account",
  "last4": "4321",
  "providerSourceID": "src_01HP5J9ZKQT4RXP8M2VYBN3D"
}'
Responses
201 400 401 403 404 409 422
The resource was successfully created.
{
  "fundingSourceID": "01HF5J9ZKQT4RXP8M2VYBN3D_fsrc"
}
Malformed request: the body or headers failed validation.
Response body application/problem+json
RFC 9457 Problem Details error body, served as application/problem+json. From v2026.10.00, every error response that has a body uses this schema.

type

string required
URI that tells you which problem occurred. Branch on this value; it never changes. Moov problem types look like https://api.moov.money/errors#<code> (for example invalid-request, idempotency-key-reused, or idempotency-request-in-progress). Treat the value as an opaque constant and do not fetch it. about:blank means the HTTP status code says everything there is to know.

title

string required
Short human-readable name of the problem type. Fixed per type; defaults to the HTTP status text.

status

integer<int32> required
The HTTP status code of this response.

detail

string
Human-readable explanation of this specific occurrence.

instance

string
URI reference that identifies this specific occurrence.

errors

array<object>
The request-body fields that failed validation. Present on validation errors only.
Show child attributes

errors[]

pointer

string required
RFC 6901 JSON Pointer to the field, using the public JSON field names. If the field is missing, the pointer shows where it belongs.

detail

string required
What is wrong with the field.
Authentication missing, invalid, or insufficient.
Authentication present but the action is forbidden for this principal/claim.
The requested resource was not found.
The request conflicts with the current state of the target resource.
Response body application/problem+json
RFC 9457 Problem Details error body, served as application/problem+json. From v2026.10.00, every error response that has a body uses this schema.

type

string required
URI that tells you which problem occurred. Branch on this value; it never changes. Moov problem types look like https://api.moov.money/errors#<code> (for example invalid-request, idempotency-key-reused, or idempotency-request-in-progress). Treat the value as an opaque constant and do not fetch it. about:blank means the HTTP status code says everything there is to know.

title

string required
Short human-readable name of the problem type. Fixed per type; defaults to the HTTP status text.

status

integer<int32> required
The HTTP status code of this response.

detail

string
Human-readable explanation of this specific occurrence.

instance

string
URI reference that identifies this specific occurrence.

errors

array<object>
The request-body fields that failed validation. Present on validation errors only.
Show child attributes

errors[]

pointer

string required
RFC 6901 JSON Pointer to the field, using the public JSON field names. If the field is missing, the pointer shows where it belongs.

detail

string required
What is wrong with the field.
The request was well-formed but couldn’t be processed (e.g. card declined).
Response body application/problem+json
RFC 9457 Problem Details error body, served as application/problem+json. From v2026.10.00, every error response that has a body uses this schema.

type

string required
URI that tells you which problem occurred. Branch on this value; it never changes. Moov problem types look like https://api.moov.money/errors#<code> (for example invalid-request, idempotency-key-reused, or idempotency-request-in-progress). Treat the value as an opaque constant and do not fetch it. about:blank means the HTTP status code says everything there is to know.

title

string required
Short human-readable name of the problem type. Fixed per type; defaults to the HTTP status text.

status

integer<int32> required
The HTTP status code of this response.

detail

string
Human-readable explanation of this specific occurrence.

instance

string
URI reference that identifies this specific occurrence.

errors

array<object>
The request-body fields that failed validation. Present on validation errors only.
Show child attributes

errors[]

pointer

string required
RFC 6901 JSON Pointer to the field, using the public JSON field names. If the field is missing, the pointer shows where it belongs.

detail

string required
What is wrong with the field.

Headers

X-Moov-Version

string
Set this header to the API version being targeted (e.g. v2026.10.00). When omitted, the server applies its default version.

Path parameters

providerID

string required
Your provider account ID.

participantID

string required
The participant’s participantID, or your externalID for them. Both resolve to the same participant.

Request

application/json
A funding source to create. You identify the underlying source with fundingType and providerSourceID, and you supply the display metadata. Participant create and POST /providers/{providerID}/participants/{participantID}/funding-sources both accept this shape.

fundingType

string<enum> required
Funding source discriminator.
Possible values: card, bank_account

providerSourceID

string [1 to 256] characters required
Your identifier for the underlying funding source. Must be 1–256 characters.

displayName

string [1 to 256] characters required
Human-readable display label. Must be 1–256 characters.

last4

string
Last four digits of the funding source number: the card number for card, or the bank account number for bank_account. Rendered with displayName in the UI. At most 4 characters.

Response

Returns the stable fundingSourceID for the created (or existing) funding source.

fundingSourceID

string required
The stable server-owned identifier for the created (or existing) funding source.