Cards

List and delete a customer's saved cards

These endpoints manage the Visa / Mastercard cards saved to a customer's account. They are called in a user-authenticated context (the customer's access token), not with your service client credentials.

Cards are saved automatically

A card is saved to the customer's account automatically when they pay with a new card on the hosted card page — you do not save it yourself. See the Card Payments guide. Saved cards also appear inline in the Payment Methods list.

List Cards#

Returns the cards saved to the customer's account.

GET/api/v1/cards

Bearer Token

List the customer's saved cards.

Query Parameters#

pmCodestringoptional

Filter by payment method code (the card method's code).

Required Headers#

Authorizationstringrequired

Bearer authentication.

x-client-tokenstringrequired

The customer's access token.

x-servicestringrequired

Your service code.

x-platformstringrequired

The platform making the request.

Allowed values:

APIWEBANDROIDIOS

Ordering#

Ordering is owned by the backend, not the client. Cards are returned most recently used first, then most recently saved first. Render them in the order received so every surface shows the buyer the same default card.

Response Fields#

data[].idstringrequired

The saved card's ID. Use this as cardId when proceeding with a payment.

data[].brandstringrequired

The card brand. Example: visa

data[].last4stringrequired

The last four digits of the card. Example: 3456

data[].numberstringoptional

Deprecated alias of last4, kept for existing clients. Use last4.

data[].expMonthnumberoptional

Expiry month, 1–12. null when the provider did not return one.

data[].expYearnumberoptional

Expiry year, four digits. null when the provider did not return one.

data[].paymentMethodIdstringrequired

The payment method that owns this card.

data[].paymentMethodCodestringoptional

Code of the owning payment method. Example: STRIPE

data[].isMostRecentlyUsedbooleanoptional

Whether this is the card the buyer used most recently. Exactly one saved card carries true, and it is returned first.

data[].createdAtstringoptional

When the card was saved, ISO 8601.

List Cards

curl "https://api.payment.yassir.io/api/v1/cards" \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  -H "x-client-token: CUSTOMER_ACCESS_TOKEN" \
  -H "x-service: YOUR_SERVICE" \
  -H "x-platform: API"

curl "https://api.payment.yassir.io/api/v1/cards" \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  -H "x-client-token: CUSTOMER_ACCESS_TOKEN" \
  -H "x-service: YOUR_SERVICE" \
  -H "x-platform: API"

200 OK

{
  "data": [
    {
      "id": "d290f1ee-6c54-4b01-90e6-d701748f0851",
      "brand": "visa",
      "last4": "3456",
      "number": "3456",
      "expMonth": 4,
      "expYear": 2028,
      "paymentMethodId": "1330fa89-4115-43b1-b34d-0e3df2e6a5ba",
      "paymentMethodCode": "STRIPE",
      "isMostRecentlyUsed": true,
      "createdAt": "2026-03-20T10:00:00.000Z"
    }
  ],
  "message": "card listed successfully"
}

{
  "data": [
    {
      "id": "d290f1ee-6c54-4b01-90e6-d701748f0851",
      "brand": "visa",
      "last4": "3456",
      "number": "3456",
      "expMonth": 4,
      "expYear": 2028,
      "paymentMethodId": "1330fa89-4115-43b1-b34d-0e3df2e6a5ba",
      "paymentMethodCode": "STRIPE",
      "isMostRecentlyUsed": true,
      "createdAt": "2026-03-20T10:00:00.000Z"
    }
  ],
  "message": "card listed successfully"
}

Delete a Card#

Removes a saved card from the customer's account.

DELETE/api/v1/cards/:id

Bearer Token

Delete a saved card.

URL Parameters#

idstringrequired

The card ID (the data[].id from List Cards).