Store saved card

Store a tokenized card as the account payment card. Do not send raw card numbers to this API. Create paymentMethodToken with the supported client-side card tokenization flow, then POST it here. makeDefault is not accepted because the stored card automatically becomes the active card.

Billing & Orders Billing

Authentication

Required API scope: write:payment_methods

Use Authorization: Bearer <token> for API keys. Dashboard sessions may also use hostup_session.

Context

Related endpoints

GET /api/v2/billing/cards List saved cards DELETE /api/v2/billing/cards/{id} Delete saved card GET /api/v2/billing/activity List billing activity

Headers

Accept Example

Content-Type Example

Body

required

application/json

paymentMethodToken string required · Example: pm_01hxa3b4c5d6e7f8g9h0j1k2m3

last4 string · Example: 4242

expMonth integer · Example: 12

expYear integer · Example: 2028

brand string · Example: visa

Responses

201 Saved card stored.

id string required · Example: card_01hxa3b4c5d6e7f8g9h0j1k2m3

brand string required · Example: visa

last4 stringnull required · Example: 4242

expMonth numbernull required · Example: 12

expYear numbernull required · Example: 2028

cardholderName stringnull required · Example: null

isPrimary boolean required · Example: true

addedAt stringnull required · Example: 2026-04-27T12:00:00.000Z

400 Invalid request. The response body is an RFC 7807 Problem Details document.

type string · Example: https://developer.hostup.se/errors/invalid_request

title string · Example: Validation failed

status integer · Example: 400

detail string · Example: The request body failed validation.

code string · Example: invalid_request

Stable machine-readable code. Branch on this field, not on `detail`.

instance string · Example: /api/v2/orders

requestId string · Example: req_01hxa3b4c5d6e7f8g9h0j1k2m3

timestamp string · Example: 2026-04-27T12:34:56.000Z

errors array<object>

Field-level validation errors when `code` is `invalid_request`.

errors[].pointer string required · Example: /items/0/eppCode

errors[].detail string required · Example: `eppCode` is required for this transfer.

errors[].code string required · Example: missing_required

extensions object

401 Unauthorized. Authentication is required.

type string · Example: https://developer.hostup.se/errors/invalid_request

title string · Example: Validation failed

status integer · Example: 400

detail string · Example: The request body failed validation.

code string · Example: invalid_request

Stable machine-readable code. Branch on this field, not on `detail`.

instance string · Example: /api/v2/orders

requestId string · Example: req_01hxa3b4c5d6e7f8g9h0j1k2m3

timestamp string · Example: 2026-04-27T12:34:56.000Z

errors array<object>

Field-level validation errors when `code` is `invalid_request`.

errors[].pointer string required · Example: /items/0/eppCode

errors[].detail string required · Example: `eppCode` is required for this transfer.

errors[].code string required · Example: missing_required

extensions object

403 Forbidden. The caller lacks a required scope or does not own the resource.

type string · Example: https://developer.hostup.se/errors/invalid_request

title string · Example: Validation failed

status integer · Example: 400

detail string · Example: The request body failed validation.

code string · Example: invalid_request

Stable machine-readable code. Branch on this field, not on `detail`.

instance string · Example: /api/v2/orders

requestId string · Example: req_01hxa3b4c5d6e7f8g9h0j1k2m3

timestamp string · Example: 2026-04-27T12:34:56.000Z

errors array<object>

Field-level validation errors when `code` is `invalid_request`.

errors[].pointer string required · Example: /items/0/eppCode

errors[].detail string required · Example: `eppCode` is required for this transfer.

errors[].code string required · Example: missing_required

extensions object

404 Not found. The resource does not exist or is not owned by the caller.

type string · Example: https://developer.hostup.se/errors/invalid_request

title string · Example: Validation failed

status integer · Example: 400

detail string · Example: The request body failed validation.

code string · Example: invalid_request

Stable machine-readable code. Branch on this field, not on `detail`.

instance string · Example: /api/v2/orders

requestId string · Example: req_01hxa3b4c5d6e7f8g9h0j1k2m3

timestamp string · Example: 2026-04-27T12:34:56.000Z

errors array<object>

Field-level validation errors when `code` is `invalid_request`.

errors[].pointer string required · Example: /items/0/eppCode

errors[].detail string required · Example: `eppCode` is required for this transfer.

errors[].code string required · Example: missing_required

extensions object

429 Rate limited. Retry after the limit resets. 429 responses include `Retry-After` seconds plus `X-RateLimit-*` headers.

type string · Example: https://developer.hostup.se/errors/invalid_request

title string · Example: Validation failed

status integer · Example: 400

detail string · Example: The request body failed validation.

code string · Example: invalid_request

Stable machine-readable code. Branch on this field, not on `detail`.

instance string · Example: /api/v2/orders

requestId string · Example: req_01hxa3b4c5d6e7f8g9h0j1k2m3

timestamp string · Example: 2026-04-27T12:34:56.000Z

errors array<object>

Field-level validation errors when `code` is `invalid_request`.

errors[].pointer string required · Example: /items/0/eppCode

errors[].detail string required · Example: `eppCode` is required for this transfer.

errors[].code string required · Example: missing_required

extensions object

500 Internal error. Retry later or contact support if the issue persists.

type string · Example: https://developer.hostup.se/errors/invalid_request

title string · Example: Validation failed

status integer · Example: 400

detail string · Example: The request body failed validation.

code string · Example: invalid_request

Stable machine-readable code. Branch on this field, not on `detail`.

instance string · Example: /api/v2/orders

requestId string · Example: req_01hxa3b4c5d6e7f8g9h0j1k2m3

timestamp string · Example: 2026-04-27T12:34:56.000Z

errors array<object>

Field-level validation errors when `code` is `invalid_request`.

errors[].pointer string required · Example: /items/0/eppCode

errors[].detail string required · Example: `eppCode` is required for this transfer.

errors[].code string required · Example: missing_required

extensions object

POST https://cloud.hostup.se/api/v2/billing/cards

For AI assistants

View as Markdown

cURL

curl -X POST "https://cloud.hostup.se/api/v2/billing/cards" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{
    "paymentMethodToken": "pm_01hxa3b4c5d6e7f8g9h0j1k2m3",
    "last4": "4242",
    "expMonth": 12,
    "expYear": 2028,
    "brand": "visa"
  }'

Response

{
  "id": "card_01hxa3b4c5d6e7f8g9h0j1k2m3",
  "brand": "visa",
  "last4": "4242",
  "expMonth": 12,
  "expYear": 2028,
  "cardholderName": null,
  "isPrimary": true,
  "addedAt": "2026-04-27T12:00:00.000Z"
}

{
  "type": "object",
  "properties": {
    "id": {
      "type": "string"
    },
    "brand": {
      "type": "string"
    },
    "last4": {
      "type": [
        "string",
        "null"
      ]
    },
    "expMonth": {
      "type": [
        "number",
        "null"
      ]
    },
    "expYear": {
      "type": [
        "number",
        "null"
      ]
    },
    "cardholderName": {
      "type": [
        "string",
        "null"
      ]
    },
    "isPrimary": {
      "type": "boolean"
    },
    "addedAt": {
      "type": [
        "string",
        "null"
      ]
    }
  }
}

Request Body Store card token

{
  "paymentMethodToken": "pm_01hxa3b4c5d6e7f8g9h0j1k2m3",
  "last4": "4242",
  "expMonth": 12,
  "expYear": 2028,
  "brand": "visa"
}