direction incoming. Webhooks tell you when an entry arrives and posts. An incoming credit adds funds to the balance behind the account number. An incoming debit takes funds out, under an authorization your customer gave the originator.
Each incoming entry tells you where it posted. core_transaction_id is the ledger entry it created after it reached posted.
Controlling what you accept
Each account number’s ACH controls govern what it can receive:incoming.accept_creditandincoming.accept_debit, bothtrueby default. Whenaccept_debitisfalse, Lead automatically returns incoming debits with return codeR16.incoming.counterparty_filter: accept all counterparties (default), an allowlist of company IDs, or reject all.
active. See Account Number Statuses.
Endpoints
You don’t call anything to receive an entry, but these endpoints are how you observe and act on incoming activity:Statuses
Incoming entries have a shorter lifecycle than outgoing. They move fromscheduled to posted, with a manual review step when a validation rule requires it. Incoming entries can’t be canceled. This table is an excerpt. ACH Statuses is the canonical reference, including the return chain.
Events
The table lists each event and what to do when it arrives.Returning entries you don’t want
You can return any incoming entry, most commonly an unauthorized or erroneous debit, withPOST /v2/ach/{ach_id}/return and an appropriate return code. Deadlines are strict. Standard returns have two business days (weekdays that aren’t Federal Reserve holidays) from settlement. Unauthorized debit returns have 60 calendar days and need a signed WSUD. See Returns, reversals, and exceptions for codes, deadlines, and cutoffs.
You can submit the return before the entry reaches posted. Lead holds it and sends it to the Fed after the original posts.
Testing in sandbox
Create an incoming entry withPOST /v2/simulate/ach/incoming_ach. It starts in scheduled, and you advance it to posted with POST /v2/simulate/ach/{ach_id}/advance.

