Adds a new stored payment method to a customer's collection and persists it.
POST
/api/customers/add-stored-payment-method-async
deprecated
Requires: Customers.Customers, Customers.Customers.Create, merchant scope.
**Required permissions**: `Customers`, `Customers.Create` **Scope**: merchant
Example request
Every block below sends the same request. Replace {{BASE_URL}} with the address of the API you are calling and {{API_KEY}} with your own key.
The request body is a AddStoredPaymentMethodInput. See the Request body section below for its fields.
Parameters
| Name | In | Type | Description |
|---|---|---|---|
customerId
required |
query | string (uuid) | The customer to add the payment method to. |
suppressNulls
required |
query | boolean | If true, omit properties with null values. |
Request body
application/json
, required
| Field | Type | Description |
|---|---|---|
paymentMethodType
required |
all of CustomerStoredPaymentMethodType | Gets or sets the type of payment method (Card or Check). Conditional: When IsReaderTokenBacked is true. Must equal Card. |
cardData
required |
all of CardData | Gets or sets the card data when `paymentMethodType` is Card. Required: When PaymentMethodType == Card and IsReaderTokenBacked is false. Conditional: When CardData is not null and PaymentMethodType == Card and IsReaderTokenBacked is false. |
checkData
required |
all of CheckData | Gets or sets the check data when `paymentMethodType` is Check. Required: When PaymentMethodType == Check. Conditional: When CheckData is not null and PaymentMethodType == Check. |
isDefault
required |
boolean | Gets or sets whether this should be the customer's default payment method. |
customName
required |
string | Gets or sets an optional user-defined display name (e.g., "Marriott Chase"). nullable |
initialSchemeTransactionId
required |
string | Optional initial (first-in-series) network / scheme transaction id captured from the authorization response of the cardholder-initiated transaction that stored this credential. Populated only on the transaction-driven save-card path (the manual Customer admin add has no authorization response); persisted onto the stored payment method so later charges can echo it without a consent lookup. Non-sensitive card-network protocol metadata. nullable |
schemeTransactionIdBrand
required |
string | Optional card brand at capture time (e.g. "Visa") tagged alongside `initialSchemeTransactionId`. Ignored when the initial id is absent. nullable |
schemeTransactionIdProcessor
required |
string | Optional originating processor ("tsys" / "fiserv") tagged alongside `initialSchemeTransactionId`. Ignored when the initial id is absent. nullable |
readerToken
required |
string | The processor reader token to store for a PAN-less card (a decrypt-and-forward processor such as MagTek DAF, where the gateway never sees the PAN). When set, this input mints a reader-token stored method: the token is written encrypted onto the backing vault token's `ProcessorTokens` and there is no card data to vault. Set by the server only: a value supplied over the API is not accepted. Never logged. nullable |
readerTokenProcessorName
required |
string | The processor key ("magtekdaf") the `readerToken` belongs to, used as the `ProcessorTokens` selection key. Required when `readerToken` is set. Required: When IsReaderTokenBacked is true. nullable |
readerTokenProcessorProfileId
required |
string (uuid) | The processor profile the `readerToken` was captured under, used as the second part of the `ProcessorTokens` selection key. Optional. nullable |
readerTokenRequestorId
required |
string | Optional token-requestor id captured alongside the `readerToken`. Stored on the backing token's `ProcessorTokens` entry for lineage. Non-sensitive. nullable |
readerTokenMaskedCardNumber
required |
string | The masked card number of the card the `readerToken` stands in for, in the platform's masked shape (for example `411111******1111`), read off the approved authorization. Optional: absent when the processor response carried no card identity. Display only. It is never a charge credential and never a dedupe input (two distinct reader tokens can share a last four; `ReaderTokenFingerprint` stays the only matching key). The consuming services re-mask it before persisting, so a full PAN cannot travel through this field. Ignored unless `readerToken` is set. nullable |
readerTokenCardBrand
required |
string | The card brand ("Visa", "Mastercard", ...) resolved for the card behind the `readerToken`, or `null` when neither the processor response nor the BIN lookup produced one. Best-effort display metadata; ignored unless `readerTokenMaskedCardNumber` is set. nullable |
isReaderTokenBacked
required |
boolean | True when this input describes a reader-token (PAN-less) stored method rather than a PAN- or account-backed one. In that case `cardData` is absent by design. read only |
This request body has no documented fields.
Responses
200 OK
Body: CustomerStoredPaymentMethodDto
Each item has these fields.
| Field | Type | Description |
|---|---|---|
extraProperties
required |
object | nullableread only |
id
required |
string (uuid) | |
creationTime
required |
string (date-time) | The date and time when this entity was created. |
creatorId
required |
string (uuid) | The ID of the user who created this entity. nullable |
lastModificationTime
required |
string (date-time) | The date and time when this entity was last modified. nullable |
lastModifierId
required |
string (uuid) | The ID of the user who last modified this entity. nullable |
isDeleted
required |
boolean | Indicates whether this entity has been deleted. |
deleterId
required |
string (uuid) | The ID of the user who deleted this entity, if it is deleted. nullable |
deletionTime
required |
string (date-time) | The date and time when this entity was deleted, if it is deleted. nullable |
tenantId
required |
string (uuid) | Id of the related tenant. nullableread only |
concurrencyStamp
required |
string | Gets or sets the concurrency stamp used for optimistic concurrency control. nullable |
entityVersion
required |
integer (int32) | A version value that is increased whenever the entity is changed. read only |
paymentMethodType
required |
all of CustomerStoredPaymentMethodType | Gets or sets the type of stored payment method (card, check, etc.). |
cardData
required |
all of CardData | Gets or sets the card data when `paymentMethodType` is `Card`. |
checkData
required |
all of CheckData | Gets or sets the check/ACH data when `paymentMethodType` is `Check`. |
isDefault
required |
boolean | Gets or sets a value indicating whether this is the customer's default payment method. |
displayName
required |
string | Gets the human-readable display name for this payment method. When `customName` is set, it takes priority over the computed brand + last-4 fallback. nullableread only |
customName
required |
string | Gets or sets an optional user-defined name for this payment method (e.g., "Marriott Chase", "Bank of America Checkcard"). nullable |
paymentTokenId
required |
string (uuid) | Gets or sets the identifier of the `PaymentToken` document that stores the encrypted card/check data for this stored payment method. nullable |
publicReference
required |
string | Gets or sets the chargeable public reference (the opaque `pt_`-prefixed handle) of the backing `PaymentToken`. nullable |
origin
required |
all of StoredPaymentMethodOrigin | Gets or sets the surface / add-channel this stored payment method was captured through (manual admin, hosted payment page, virtual terminal, or API). Null when the method predates this field, which callers treat as `Unknown`. Non-sensitive add-channel metadata. nullable |
isReaderTokenBacked
required |
boolean | Gets or sets whether this stored method is backed by a processor card token rather than a stored card number: the card was captured by a card reader on a decrypt-and-forward processor, so the platform never held its number and the method carries no expiration date. Such a method is charged through its `publicReference` exactly like any other, but only on the processor that issued the token. `false` for every card-number-backed card and every bank account method. |
This response has no documented body fields.
403 Forbidden
Body: RemoteServiceErrorResponse
Each item has these fields.
| Field | Type | Description |
|---|---|---|
error
required |
RemoteServiceErrorInfo |
This response has no documented body fields.
401 Unauthorized
Body: RemoteServiceErrorResponse
Each item has these fields.
| Field | Type | Description |
|---|---|---|
error
required |
RemoteServiceErrorInfo |
This response has no documented body fields.
400 Bad Request
Body: RemoteServiceErrorResponse
Each item has these fields.
| Field | Type | Description |
|---|---|---|
error
required |
RemoteServiceErrorInfo |
This response has no documented body fields.
404 Not Found
Body: RemoteServiceErrorResponse
Each item has these fields.
| Field | Type | Description |
|---|---|---|
error
required |
RemoteServiceErrorInfo |
This response has no documented body fields.
501 Not Implemented
Body: RemoteServiceErrorResponse
Each item has these fields.
| Field | Type | Description |
|---|---|---|
error
required |
RemoteServiceErrorInfo |
This response has no documented body fields.
500 Internal Server Error
Body: RemoteServiceErrorResponse
Each item has these fields.
| Field | Type | Description |
|---|---|---|
error
required |
RemoteServiceErrorInfo |
This response has no documented body fields.
default The request failed. The body carries the standard error envelope: a machine-readable `error.code`, a human-readable `error.message`, and `error.validationErrors` when the failure was a validation rejection. See the error-code reference in this document's description for the values `error.code` can take.
Body: RemoteServiceErrorResponse
Each item has these fields.
| Field | Type | Description |
|---|---|---|
error
required |
RemoteServiceErrorInfo |
This response has no documented body fields.
429 The request was refused because a rate limit was exceeded. Wait at least the interval `Retry-After` names before retrying, then back off. Limits are tuned per deployment, so read the allowance from the response headers rather than assuming a fixed ceiling.
Body: RateLimitProblemDetails
Each item has these fields.
| Field | Type | Description |
|---|---|---|
type
required |
string | The problem type identifier. Always the same value: the failure is the status code itself, so there is no sub-type for a caller to branch on. nullable |
title
required |
string | A short, human-readable summary of the problem type. nullable |
status
required |
integer (int32) | The HTTP status code, repeated in the body as the problem-details format defines. |
detail
required |
string | A human-readable explanation of this occurrence of the problem. nullable |
retryAfterSeconds
required |
integer (int32) | How long to wait before retrying, in whole seconds, carrying the same figure as the `Retry-After` header. Always at least one: a value of zero would invite an immediate retry that is certain to be rejected again. |
This response has no documented body fields.
Errors
A failed request returns the platform error envelope. The
error reference lists every value
error.code can carry and shows the four response shapes.