# Reveal Full Account Number

**POST** `/users/{user_id}/accounts/{account_id}/numbers/reveal`

Base URL: `https://live.savewithsail.com/api/v1`

Returns the unmasked account and routing numbers. Every reveal is audit-logged (partner, key prefix, user, timestamp) and rate-limited per user. Treat the response as a one-time read for immediate use (e.g. initiating a deposit). Do not persist it unencrypted. Nacha's data security rule requires stored DFI account numbers to be rendered unreadable.

## Authorization

- PartnerKey (http, bearer)
- x-sail-user-token (apiKey in header)

## Path parameters

- `user_id` (string, required)
  The Sail user id.
- `account_id` (string, required)
  The Sail account id.

## Responses

### 200

Full deposit numbers (audit-logged).

- `account_id` (string)
  The Sail account id.
- `account_number` (string)
  The full, unmasked account number.
- `routing_number` (string)
  The routing number for this account.
- `reveal_id` (string)
  Audit-log reference for this reveal.
- `revealed_at` (string<date-time>)
  When this reveal occurred.

Example:

```json
{
  "account_id": "string",
  "account_number": "string",
  "routing_number": "string",
  "reveal_id": "rvl_5d81xk",
  "revealed_at": "1970-01-01T00:00:00.000Z"
}
```

### 401

`user_token_required` / `invalid_user_token`.

### 403

`insufficient_key_scope`, `insufficient_token_scope` (token minted without `numbers:reveal`), or `product_not_enabled`.

### 429

`rate_limited`: reveal velocity exceeded for this user.

### default

Standard error envelope covering 400, 401, 403, 404, 429, and 500.

- `error` (object)
  The error detail.
  - `code` (string)
    Machine-readable code, e.g. `not_found`, `token_scope_mismatch`, `product_not_enabled`, `insufficient_key_scope`, `insufficient_token_scope`, `user_token_required`, `user_token_expired`, `invalid_user_token`, `invalid_key_configuration`, `connection_not_reconnectable`, `rate_limited`.
  - `message` (string)
    Human-readable error message. May change, so match on `error.code` instead.
  - `param` (string)
    The request field that caused the error, when applicable. Null otherwise.

Example:

```json
{
  "error": {
    "code": "string",
    "message": "string",
    "param": "string"
  }
}
```