API v1 preview

List payment methods

GET/api/v1/payment-methods

Overview

List cards saved and approved for the business. Requires payments:read (keys with payments:write also qualify); listing needs no spending consent and authorizes no charge. Manage cards on the account Billing page. No raw card data is returned. Pages use limit and cursor, ordered by card ID, and return data, has_more and next_cursor.

Requires payments:read.

Order and payment guide Errors and retries

Request

#!/usr/bin/env bash
# Bash + curl + jq. Requires payments:read (existing payments:write keys also qualify).
set -euo pipefail
: "${API_BASE_URL:?Set API_BASE_URL}"
: "${OTTOMFG_API_KEY:?Set OTTOMFG_API_KEY}"
result=$(curl --fail-with-body --silent --show-error --max-time 60 -X GET "${API_BASE_URL%/}/api/v1/payment-methods" \
  -H "Authorization: Bearer $OTTOMFG_API_KEY") || { printf '%s\n' "$result"; exit 1; }
printf '%s\n' "$result" | jq .

Set API_BASE_URL and OTTOMFG_API_KEY. Save request keys before creating an order or starting payment; reuse the same key and body on retry. See the guide for permissions and recovery.

Order setup and recovery

Parameters

limit query · optional

Maximum number of results.

integer

cursor query · optional

Opaque next_cursor from the previous page. Keep the same account, resource, filters and limit.

string

Responses

HTTP status

Approved account-owned saved cards.

200 response

JSON

{
  "data": [
    {
      "id": "pm_example",
      "brand": "visa",
      "last4": "4242",
      "exp_month": 12,
      "exp_year": 2030
    }
  ],
  "has_more": false,
  "next_cursor": null
}

data array · required

Account-owned cards approved through the account billing setup.

data item fields

id string · required

brand string · required

last4 string · required

exp_month integer · required

Minimum: 1 · Maximum: 12

exp_year integer · required

has_more boolean · required

next_cursor string | null · required

Response headers

X-Request-ID

Request identifier for support. Send X-Request-ID with 8–64 ASCII letters, digits or hyphens to reuse that value; otherwise the server generates a UUID4 hex value. Include the returned X-Request-ID in support requests. Do not put secrets or account IDs in this value.

Errors

HTTP	Code	What to do
400 Bad Request	`invalid_argument`	A field, query parameter or header is invalid. Fix the field named in details, then send the request again.
401 Unauthorized	`unauthenticated`	The API key is missing, invalid or revoked. Send a valid business API key in Authorization: Bearer.
403 Forbidden	`permission_denied`	The key lacks the endpoint's scope, or payments lack spending consent. Check the scope listed on the endpoint.
429 Too Many Requests	`resource_exhausted`	A rate or account limit was reached. Wait at least Retry-After seconds, then retry.
500 Internal Server Error	`internal`	The server failed unexpectedly. Retry with backoff; contact support with X-Request-ID if it persists.
503 Service Unavailable	`unavailable`	A required service is briefly unavailable. Retry with backoff, reusing the same Idempotency-Key.

Idempotent requests

API v1 preview