curl --request POST \
--url https://secure-api.montereyfinancial.app/v1/payment-methods/cards \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--header 'Idempotency-Key: <idempotency-key>' \
--data '
{
"account_id": "<string>",
"card": {
"number": "<string>",
"expiration_month": 6,
"expiration_year": 5999,
"cvc": "<string>"
},
"party_id": "<string>",
"cardholder_name": "<string>",
"billing_address_id": "<string>",
"nickname": "<string>",
"set_default": false
}
'import requests
url = "https://secure-api.montereyfinancial.app/v1/payment-methods/cards"
payload = {
"account_id": "<string>",
"card": {
"number": "<string>",
"expiration_month": 6,
"expiration_year": 5999,
"cvc": "<string>"
},
"party_id": "<string>",
"cardholder_name": "<string>",
"billing_address_id": "<string>",
"nickname": "<string>",
"set_default": False
}
headers = {
"Idempotency-Key": "<idempotency-key>",
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {
'Idempotency-Key': '<idempotency-key>',
Authorization: 'Bearer <token>',
'Content-Type': 'application/json'
},
body: JSON.stringify({
account_id: '<string>',
card: {
number: '<string>',
expiration_month: 6,
expiration_year: 5999,
cvc: '<string>'
},
party_id: '<string>',
cardholder_name: '<string>',
billing_address_id: '<string>',
nickname: '<string>',
set_default: false
})
};
fetch('https://secure-api.montereyfinancial.app/v1/payment-methods/cards', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://secure-api.montereyfinancial.app/v1/payment-methods/cards",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'account_id' => '<string>',
'card' => [
'number' => '<string>',
'expiration_month' => 6,
'expiration_year' => 5999,
'cvc' => '<string>'
],
'party_id' => '<string>',
'cardholder_name' => '<string>',
'billing_address_id' => '<string>',
'nickname' => '<string>',
'set_default' => false
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json",
"Idempotency-Key: <idempotency-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://secure-api.montereyfinancial.app/v1/payment-methods/cards"
payload := strings.NewReader("{\n \"account_id\": \"<string>\",\n \"card\": {\n \"number\": \"<string>\",\n \"expiration_month\": 6,\n \"expiration_year\": 5999,\n \"cvc\": \"<string>\"\n },\n \"party_id\": \"<string>\",\n \"cardholder_name\": \"<string>\",\n \"billing_address_id\": \"<string>\",\n \"nickname\": \"<string>\",\n \"set_default\": false\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Idempotency-Key", "<idempotency-key>")
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://secure-api.montereyfinancial.app/v1/payment-methods/cards")
.header("Idempotency-Key", "<idempotency-key>")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"account_id\": \"<string>\",\n \"card\": {\n \"number\": \"<string>\",\n \"expiration_month\": 6,\n \"expiration_year\": 5999,\n \"cvc\": \"<string>\"\n },\n \"party_id\": \"<string>\",\n \"cardholder_name\": \"<string>\",\n \"billing_address_id\": \"<string>\",\n \"nickname\": \"<string>\",\n \"set_default\": false\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://secure-api.montereyfinancial.app/v1/payment-methods/cards")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Idempotency-Key"] = '<idempotency-key>'
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"account_id\": \"<string>\",\n \"card\": {\n \"number\": \"<string>\",\n \"expiration_month\": 6,\n \"expiration_year\": 5999,\n \"cvc\": \"<string>\"\n },\n \"party_id\": \"<string>\",\n \"cardholder_name\": \"<string>\",\n \"billing_address_id\": \"<string>\",\n \"nickname\": \"<string>\",\n \"set_default\": false\n}"
response = http.request(request)
puts response.read_body{
"id": "<string>",
"party_id": "<string>",
"instrument_type": "<string>",
"is_active": true,
"last_four": "<string>",
"created_at": "2023-11-07T05:31:56Z",
"updated_at": "2023-11-07T05:31:56Z",
"holder_name": "<string>",
"nickname": "<string>",
"card_brand": "<string>",
"card_exp_month": 123,
"card_exp_year": 123,
"bank_name": "<string>",
"bank_account_type": "<string>",
"wallet_type": "<string>"
}{
"detail": {
"error_code": "<string>"
}
}{
"detail": {
"error_code": "<string>"
}
}{
"detail": {
"error_code": "<string>"
}
}{
"detail": {
"error_code": "<string>"
}
}{
"detail": {
"error_code": "<string>"
}
}{
"detail": {
"error_code": "<string>"
}
}{
"detail": {
"error_code": "rate_limited",
"bucket": "api",
"limit_per_minute": 123,
"burst_capacity": 123,
"retry_after_seconds": 123,
"reset_at": "<string>"
}
}{
"detail": {
"error_code": "gateway_tokenization_failed",
"retryable": true
}
}{
"detail": {
"error_code": "<string>"
}
}Create a card payment method
Create a stored card payment method without sending PAN or CVC to api.montereyfinancial.app. Send raw card requests only to secure-api.montereyfinancial.app, which forwards tokenized card data through the Basis Theory inbound proxy.
curl --request POST \
--url https://secure-api.montereyfinancial.app/v1/payment-methods/cards \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--header 'Idempotency-Key: <idempotency-key>' \
--data '
{
"account_id": "<string>",
"card": {
"number": "<string>",
"expiration_month": 6,
"expiration_year": 5999,
"cvc": "<string>"
},
"party_id": "<string>",
"cardholder_name": "<string>",
"billing_address_id": "<string>",
"nickname": "<string>",
"set_default": false
}
'import requests
url = "https://secure-api.montereyfinancial.app/v1/payment-methods/cards"
payload = {
"account_id": "<string>",
"card": {
"number": "<string>",
"expiration_month": 6,
"expiration_year": 5999,
"cvc": "<string>"
},
"party_id": "<string>",
"cardholder_name": "<string>",
"billing_address_id": "<string>",
"nickname": "<string>",
"set_default": False
}
headers = {
"Idempotency-Key": "<idempotency-key>",
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {
'Idempotency-Key': '<idempotency-key>',
Authorization: 'Bearer <token>',
'Content-Type': 'application/json'
},
body: JSON.stringify({
account_id: '<string>',
card: {
number: '<string>',
expiration_month: 6,
expiration_year: 5999,
cvc: '<string>'
},
party_id: '<string>',
cardholder_name: '<string>',
billing_address_id: '<string>',
nickname: '<string>',
set_default: false
})
};
fetch('https://secure-api.montereyfinancial.app/v1/payment-methods/cards', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://secure-api.montereyfinancial.app/v1/payment-methods/cards",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'account_id' => '<string>',
'card' => [
'number' => '<string>',
'expiration_month' => 6,
'expiration_year' => 5999,
'cvc' => '<string>'
],
'party_id' => '<string>',
'cardholder_name' => '<string>',
'billing_address_id' => '<string>',
'nickname' => '<string>',
'set_default' => false
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json",
"Idempotency-Key: <idempotency-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://secure-api.montereyfinancial.app/v1/payment-methods/cards"
payload := strings.NewReader("{\n \"account_id\": \"<string>\",\n \"card\": {\n \"number\": \"<string>\",\n \"expiration_month\": 6,\n \"expiration_year\": 5999,\n \"cvc\": \"<string>\"\n },\n \"party_id\": \"<string>\",\n \"cardholder_name\": \"<string>\",\n \"billing_address_id\": \"<string>\",\n \"nickname\": \"<string>\",\n \"set_default\": false\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Idempotency-Key", "<idempotency-key>")
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://secure-api.montereyfinancial.app/v1/payment-methods/cards")
.header("Idempotency-Key", "<idempotency-key>")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"account_id\": \"<string>\",\n \"card\": {\n \"number\": \"<string>\",\n \"expiration_month\": 6,\n \"expiration_year\": 5999,\n \"cvc\": \"<string>\"\n },\n \"party_id\": \"<string>\",\n \"cardholder_name\": \"<string>\",\n \"billing_address_id\": \"<string>\",\n \"nickname\": \"<string>\",\n \"set_default\": false\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://secure-api.montereyfinancial.app/v1/payment-methods/cards")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Idempotency-Key"] = '<idempotency-key>'
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"account_id\": \"<string>\",\n \"card\": {\n \"number\": \"<string>\",\n \"expiration_month\": 6,\n \"expiration_year\": 5999,\n \"cvc\": \"<string>\"\n },\n \"party_id\": \"<string>\",\n \"cardholder_name\": \"<string>\",\n \"billing_address_id\": \"<string>\",\n \"nickname\": \"<string>\",\n \"set_default\": false\n}"
response = http.request(request)
puts response.read_body{
"id": "<string>",
"party_id": "<string>",
"instrument_type": "<string>",
"is_active": true,
"last_four": "<string>",
"created_at": "2023-11-07T05:31:56Z",
"updated_at": "2023-11-07T05:31:56Z",
"holder_name": "<string>",
"nickname": "<string>",
"card_brand": "<string>",
"card_exp_month": 123,
"card_exp_year": 123,
"bank_name": "<string>",
"bank_account_type": "<string>",
"wallet_type": "<string>"
}{
"detail": {
"error_code": "<string>"
}
}{
"detail": {
"error_code": "<string>"
}
}{
"detail": {
"error_code": "<string>"
}
}{
"detail": {
"error_code": "<string>"
}
}{
"detail": {
"error_code": "<string>"
}
}{
"detail": {
"error_code": "<string>"
}
}{
"detail": {
"error_code": "rate_limited",
"bucket": "api",
"limit_per_minute": 123,
"burst_capacity": 123,
"retry_after_seconds": 123,
"reset_at": "<string>"
}
}{
"detail": {
"error_code": "gateway_tokenization_failed",
"retryable": true
}
}{
"detail": {
"error_code": "<string>"
}
}Authorizations
Short-lived access token minted by POST /v1/oauth/token.
Headers
Unique client-generated key for this create-card attempt. Re-use the same value only when retrying the same request.
1Body
Raw card payload accepted only on the secure card-capture hostname. At most one billing-address input may be supplied: use billing_address_id to re-use an existing party address, send billing_address to use a transient address for this card, or omit both so Monterey falls back to the selected borrower's current billing address.
Response
Card payment method created.
A stored payment instrument (card, bank account, or wallet) belonging to a borrower. Carries display-safe metadata only — never full card or account numbers.
The person (borrower) this payment method belongs to.
Kind of instrument. One of: card, bank_account, wallet.
False once the payment method has been removed. Inactive methods cannot be attached to autopay or payments.
Last four digits of the card or account number.
Name of the card or account holder.
Borrower-chosen label for this payment method.
Card network (e.g. visa, mastercard). Cards only.
Card expiration month (1-12). Cards only.
Card expiration year (four digits). Cards only.
Bank name. Bank accounts only.
Bank account type (e.g. checking, savings). Bank accounts only.
Wallet provider (e.g. apple_pay, google_pay). Wallets only.