# Lists a customer's payment methods

Lists saved card and ACH payment methods on file for a customer, with support for filtering, sorting, and pagination.

GET {{baseURL}}/v2/payment-methods
This endpoint lists a customer's payment methods for the merchant.
Results are returned in pages of `pageSize` items, with a default of 20 and a maximum of 100 per page.
The `pageIndex` parameter selects which page to return, starting at 0.
The `customerId` parameter narrows the results to one customer.
Omitting `customerId` includes orphan payment methods with no linked customer.
The `search` parameter matches partially against a payment method's name.
The `createdFrom` and `createdTo` parameters filter by creation date range.
This endpoint requires a merchant API token.
A partner API token will result in a permissions error including possibly a 403 response.
See Also:
To add a new card payment method, see POST /v2/payment-methods/cards.
To add a new ACH payment method, see POST /v2/payment-methods/ach.
To retrieve a payment method, see GET /v2/payment-methods/{{paymentMethodId}}.
To update a payment method, see PATCH /v2/payment-methods/{{paymentMethodId}}.

Endpoint: GET /v2/payment-methods
Version: V2 Beta
Security: Bearer

## Security:

  - `Bearer` (unknown)
    http bearer JWT

## Query parameters:

  - `pageIndex` (integer)
    Specifies the page number of the returned search results.

A page is considered each set of the `pageSize` values.

The page count is zero-based.
The maximum for `pageIndex`, or the page number, is the `pageSize` divided by the `total` count rounded down.
For example, the `pageSize` is 50 and the `total` is 130.
That means there are three pages, but the `pageIndex` value is in the inclusive range from zero to two.

Value restrictions include:
* A value less than zero is not permitted.<br>
* Values equal to or greater than `totalPages` end successfully but will not return any items.

For page size information, see `pageSize`.

Example: 0

  - `pageSize` (integer)
    Specifies the number of items for each page of the returned search results.

A page is considered each set of the `pageSize` values.

The page count is zero-based.
The maximum for `pageIndex`, or the page number, is the `pageSize` divided by the `total` count rounded down.
For example, the `pageSize` is 50 and the `total` is 130.
That means there are three pages, but the `pageIndex` value is in the inclusive range from zero to two.

For page numbering information, see `pageIndex`.

Example: 50

  - `asc` (boolean)
    Specifies the sort order

The sort field is specified by the `orderBy` value.

If `true`, the sort order is ascending.<br>
If `false`, the sort order is descending.

Example: true

  - `sortBy` (string)
    Specifies a field name to sort the results by.

If null or omitted, results come back newest first.

The sort order is specified by the `sortOrder` value.

The following fields may be used to sort results:<br>
name<br>
createdOn

Example: createdOn

  - `sortOrder` (string)
    Specifies the sort order.

The sort order is specified by the `sortOrder` value.<br>
The field that gets sorted by is specified by the `sortBy` value.

Valid values are:

| Value  | Description                                               |
| ------ | --------------------------------------------------------- |
| asc    | Sorts results in ascending order, from the lowest value to the highest, or from the oldest timestamp to the most recent. |
| desc   | Sorts results in descending order, from the highest value to the lowest, or from the most recent timestamp to the oldest. |

  - `search` (string)
    Filters using a search string.

This performs a case-insensitive search that matches exactly or partially.

The field does not have to be specified.
If the results are to be sorted, use the `sortBy` field to specify the sort field.

The search includes the following field:<br>
name

Example:<br>
Peppared Street Cafe (example name)<br>
Conners Electric (example name)

  - `createdFrom` (string)
    Filters by the earliest inclusive created date (in an ISO 8601 date-time UTC format).

If only `createdFrom` is specified, the search returns all available items from the `createdFrom` value to the present.
The fields `createdFrom` and `createdTo` may be used together to create an inclusive range.
We recommend creating an inclusive range to avoid a potentially excessive number of returns.

Example: 2026-02-19T20:24:52.934Z

  - `createdTo` (string)
    Filters by the latest inclusive created date (in an ISO 8601 date-time UTC format).

If only `createdFrom` is specified, the search returns all available items from the `createdFrom` value to the present.
The fields `createdFrom` and `createdTo` may be used together to create an inclusive range.
We recommend creating an inclusive range to avoid a potentially excessive number of returns.

Example: 2026-03-06T14:24:52.934Z

  - `customerId` (string)
    Filters by a customer's identifier.

If null or omitted, the response includes orphan payment methods with customer-linked payment methods.

Example: c4b210e9-be39-4ebc-8195-0c422de87f90

## Response 200:

  - `200` (unknown)
    OK

## Response 200 fields (application/json):

  - `items` (array)

  - `items.paymentMethodId` (string)
    Indicates the payment method identifier.

This is the identifier of a previously saved ACH account to charge.

Example: 39a95e35-6d50-45ec-884b-c2417edf005d
    Example: 39a95e35-6d50-45ec-884b-c2417edf005d

  - `items.customerId` (string)
    Identifies the customer to link this payment method to.

This value may be null when this payment method is an orphan owned by the merchant directly.
An orphan payment method is a payment method in the merchant's vault but has no customer record associated with it.

Example: 8fa8e727-73c6-436e-b56f-6f55aabf3b1c
    Example: 8fa8e727-73c6-436e-b56f-6f55aabf3b1c

  - `items.name` (string)
    Indicates the name for the payment method.

This is a free-formed name that is convenient for the merchant to recognize.

Example: Peppared Street Cafe's Preferred Payment
    Example: Peppared Street Cafe's Preferred Payment

  - `items.type` (string)
    Identifies the payment method type.
Valid values are:
| Type | Description |
|  --- | --- |
| ACH | Payment made through an ACH bank transfer. |
| Card | Payment made with a credit or debit card. |
| Cash | Payment made with physical currency. |

Example: Card
    Enum: "Card", "ACH", "Cash"

  - `items.isDefault` (boolean)
    Indicates this payment method is the default payment method.
If `true`, this is the default payment method.
If `false`, this is not the default payment method.
Example: true
    Example: true

  - `items.createdOn` (string)
    Indicates the date-time (in an ISO 8601 UTC date-time format) the payment method was created on.

Example: 2026-01-15T10:30:56.264Z
    Example: 2026-01-15T10:30:56.264Z

  - `items.card` (object)
    Indicates an object detailing the card used for this transaction.

  - `items.card.cardMask` (string)
    Indicates the PAN (primary account number).
This value may be partially obscured as additional security.
This value can be safely displayed to clients without revealing the actual or full account number.
Example: ************3655
    Example: ************3655

  - `items.card.expirationMonth` (integer)
    Identifies the expiration month (in a two-digit number format) of the card.
Examples:
07
12
    Example: 12

  - `items.card.expirationYear` (integer)
    Identifies the expiration year (in a four-digit number) of the card.

Example: 2032
    Example: 2032

  - `items.card.cardTokenType` (string)
    Indicates the type of the token.
Valid values are:
| Type | Meaning |
|  --- | --- |
| Local | Tokenized and stored within Flute's own vault |
| Network | Tokenized through a card network, such as Visa or Mastercard, using their network tokenization services |

Example: Local
    Enum: "Local", "Network"

  - `items.ach` (object)
    Indicates the ACH (automated clearing house) used for this transaction.

  - `items.ach.accountNumber` (string)
    Indicates the bank account number for the ACH (automated clearing house) transaction.
This value may be partially obscured as additional security.
It can then be safely displayed to clients without revealing the actual or full account number.
Examples:
1234567890
******7890
    Example: ******7890

  - `items.ach.routingNumber` (string)
    Indicates the ACH (automated clearing house) account routing number.

Example: 021000021
    Example: 021000021

  - `items.ach.accountType` (string)
    Identifies the type of the account.
Valid values are:
| Type | Description |
|  --- | --- |
| Checking | Account used for regular daily transactions. |
| Savings | Account used to hold and grow funds over time. |

Example: Checking
    Enum: "Checking", "Savings"

  - `items.ach.accountHolderType` (string)
    Identifies the holder type of the account.
Valid values are:
| Type | Description |
|  --- | --- |
| Business | Card issued to a business or company account. |
| Personal | Card issued to an individual for personal use. |

Example: Business
    Enum: "Business", "Personal"

  - `items.ach.taxId` (string)
    Indicates the tax identifier.
This value may be partially obscured as additional security.
This value can be safely displayed to clients without revealing the actual or full value.
Example: **-***6789
    Example: **-***6789

  - `items.ach.companyName` (string)
    Indicates the name of the customer's company or organization.
This is the ACH (automated clearing house) legal-entity name.
Set on business orphan payment methods at create time so it is available at transaction time when `ContactInfo.CompanyName` is omitted on the request.
Example: Peppared Street Cafe
    Example: Peppared Street Cafe

  - `pageInfo` (object)
    Indicates an object describing the pagination status.
If additional pages to review are needed, repeat the exact same search but include a new pageIndex value.
Typically, this will increment the current `pageIndex` by one.
However, any valid value may be used.
Value restrictions include:
* A value less than zero is not permitted.
* Values equal to or greater than `totalPages` end successfully but will not return any items.

  - `pageInfo.pageIndex` (integer)
    Indicates the page number from the search results.
The pageIndex value is zero-based.
Valid values range from zero to `totalPages` less one.
For example, if `totalPages` = 10, then the valid range is zero to nine.
Example: 0
    Example: 0

  - `pageInfo.pageSize` (integer)
    Indicates the number of items returned per page.

Example: 20
    Example: 20

  - `pageInfo.totalItems` (integer)
    Indicates the total number of items across all pages.

Example: 1012
    Example: 1012

  - `pageInfo.totalPages` (integer)
    Indicates the total number of pages available.

Example: 51
    Example: 51

  - `pageInfo.hasMore` (boolean)
    Indicates additional pages are available after the current one.
If `true`, additional pages are available after the current one.
If `false`, additional pages are not available after the current one.
Example: true
    Example: true

## Response 400:

  - `400` (unknown)
    Bad Request

## Response 400 fields (application/json):

  - `details` (string)
    Indicates details about the error.

Example: Unauthorized
    Example: Unauthorized

  - `statusCode` (integer)
    Specifies the HTTP response status code.
This is the HTTP status code returned by the attempted delivery.
The following is a list of HTTP response status codes that include but are not limited to:
| HTTP Response | Meaning |
|  --- | --- |
| 200 | Delivery succeeded |
| 400 | Bad request |
| 401 | Unauthorized |
| 404 | Endpoint not found |
| 429 | Rate limited |

Example: 401
    Example: 401

  - `source` (string)
    Indicates the source of the error.
Example: <Service>
    Example: <Service>

  - `exceptionType` (string)
    Indicates the error's exception type.

Example: FluentValidation.ValidationException
    Example: FluentValidation.ValidationException

  - `correlationId` (string)
    Indicates the correlation identifier.

This is a unique identifier, a trace identifier, Flute attaches to a request/response pair so a single transaction can be traced end-to-end across systems and logs. 

Its intent is to support troubleshooting.
We recommend including this value when contacting support.

Example: aa6cfcd0-0295-4a4c-b074-8c901f114fef
    Example: aa6cfcd0-0295-4a4c-b074-8c901f114fef

  - `entityId` (string)
    Indicates the entity identifier.
This is a field on Flute's standard error response object, alongside values such as `correlationId`, `errorCode`, or `statusCode`.
It's the identifier of the specific resource the failed request was about.
Error messages may specify "Entity with ID b31fbe9f-eebb-45ce-9cae-92265389f47f does not exist or has been deleted."
When a 404 (or similar entity-specific error, like a conflict) comes back,
check `entityId` to get the exact identifier of the record that couldn't be found or matched.
This is useful for confirming which resource reference was wrong, especially if the request touched multiple identifiers at once.
Example: null

  - `errorCode` (string)
    Indicates the error code.
Example:
null

  - `title` (string)
    Indicates a short, human-readable summary of the error category.

Example: Resource not found
    Example: Resource not found

  - `cause` (string)
    Indicates the reason the error occurred.

Example: The requested resource does not exist or has been deleted.
    Example: The requested resource does not exist or has been deleted.

  - `resolution` (string)
    Indicates the recommended action for resolving the error.

Example: Verify the resource ID is correct or retrieve a list of available resources.
    Example: Verify the resource ID is correct or retrieve a list of available resources.

  - `documentationUrl` (string)
    https://developer.flute.com/

## Response 401:

  - `401` (unknown)
    Unauthorized

## Response 401 fields (application/json):

  - `details` (string)
    Indicates details about the error.

Example: Unauthorized
    Example: Unauthorized

  - `statusCode` (integer)
    Specifies the HTTP response status code.
This is the HTTP status code returned by the attempted delivery.
The following is a list of HTTP response status codes that include but are not limited to:
| HTTP Response | Meaning |
|  --- | --- |
| 200 | Delivery succeeded |
| 400 | Bad request |
| 401 | Unauthorized |
| 404 | Endpoint not found |
| 429 | Rate limited |

Example: 401
    Example: 401

  - `source` (string)
    Indicates the source of the error.
Example: <Service>
    Example: <Service>

  - `exceptionType` (string)
    Indicates the error's exception type.

Example: FluentValidation.ValidationException
    Example: FluentValidation.ValidationException

  - `correlationId` (string)
    Indicates the correlation identifier.

This is a unique identifier, a trace identifier, Flute attaches to a request/response pair so a single transaction can be traced end-to-end across systems and logs. 

Its intent is to support troubleshooting.
We recommend including this value when contacting support.

Example: aa6cfcd0-0295-4a4c-b074-8c901f114fef
    Example: aa6cfcd0-0295-4a4c-b074-8c901f114fef

  - `entityId` (string)
    Indicates the entity identifier.
This is a field on Flute's standard error response object, alongside values such as `correlationId`, `errorCode`, or `statusCode`.
It's the identifier of the specific resource the failed request was about.
Error messages may specify "Entity with ID b31fbe9f-eebb-45ce-9cae-92265389f47f does not exist or has been deleted."
When a 404 (or similar entity-specific error, like a conflict) comes back,
check `entityId` to get the exact identifier of the record that couldn't be found or matched.
This is useful for confirming which resource reference was wrong, especially if the request touched multiple identifiers at once.
Example: null

  - `errorCode` (string)
    Indicates the error code.
Example:
null

  - `title` (string)
    Indicates a short, human-readable summary of the error category.

Example: Resource not found
    Example: Resource not found

  - `cause` (string)
    Indicates the reason the error occurred.

Example: The requested resource does not exist or has been deleted.
    Example: The requested resource does not exist or has been deleted.

  - `resolution` (string)
    Indicates the recommended action for resolving the error.

Example: Verify the resource ID is correct or retrieve a list of available resources.
    Example: Verify the resource ID is correct or retrieve a list of available resources.

  - `documentationUrl` (string)
    https://developer.flute.com/

## Response 403:

  - `403` (unknown)
    Forbidden

## Response 403 fields (application/json):

  - `details` (string)
    Indicates details about the error.

Example: Validation failed: -- Email: 'Email' is not a valid email address. Severity: Error
    Example: Validation failed: -- Email: 'Email' is not a valid email address. Severity: Error

  - `statusCode` (integer)
    Specifies the HTTP response status code.
This is the HTTP status code returned by the attempted delivery.
The following is a list of HTTP response status codes that include but are not limited to:
| HTTP Status | Meaning |
|  --- | --- |
| 200 | Delivery succeeded |
| 400 | Bad request |
| 401 | Unauthorized |
| 404 | Endpoint not found |
| 429 | Rate limited |

Example: 401
    Example: 401

  - `source` (string)
    Indicates the source of the error.
Example: <Service>
    Example: <Service>

  - `exceptionType` (string)
    Indicates the error's exception type.

Example: FluentValidation.ValidationException
    Example: FluentValidation.ValidationException

  - `correlationId` (string)
    Indicates the correlation identifier.

Example: aa6cfcd0-0295-4a4c-b074-8c901f114fef
    Example: aa6cfcd0-0295-4a4c-b074-8c901f114fef

  - `entityId` (string)
    Indicates the entity identifier.
Example:
null

  - `errorCode` (string)
    Indicates the error code.
Example:
null

  - `title` (string)

  - `cause` (string)

  - `resolution` (string)

  - `documentationUrl` (string)
    https://developer.flute.com/

  - `errors` (object)

## Response 404:

  - `404` (unknown)
    Not Found

## Response 404 fields (application/json):

  - `details` (string)
    Indicates details about the error.

Example: Unauthorized
    Example: Unauthorized

  - `statusCode` (integer)
    Specifies the HTTP response status code.
This is the HTTP status code returned by the attempted delivery.
The following is a list of HTTP response status codes that include but are not limited to:
| HTTP Response | Meaning |
|  --- | --- |
| 200 | Delivery succeeded |
| 400 | Bad request |
| 401 | Unauthorized |
| 404 | Endpoint not found |
| 429 | Rate limited |

Example: 401
    Example: 401

  - `source` (string)
    Indicates the source of the error.
Example: <Service>
    Example: <Service>

  - `exceptionType` (string)
    Indicates the error's exception type.

Example: FluentValidation.ValidationException
    Example: FluentValidation.ValidationException

  - `correlationId` (string)
    Indicates the correlation identifier.

This is a unique identifier, a trace identifier, Flute attaches to a request/response pair so a single transaction can be traced end-to-end across systems and logs. 

Its intent is to support troubleshooting.
We recommend including this value when contacting support.

Example: aa6cfcd0-0295-4a4c-b074-8c901f114fef
    Example: aa6cfcd0-0295-4a4c-b074-8c901f114fef

  - `entityId` (string)
    Indicates the entity identifier.
This is a field on Flute's standard error response object, alongside values such as `correlationId`, `errorCode`, or `statusCode`.
It's the identifier of the specific resource the failed request was about.
Error messages may specify "Entity with ID b31fbe9f-eebb-45ce-9cae-92265389f47f does not exist or has been deleted."
When a 404 (or similar entity-specific error, like a conflict) comes back,
check `entityId` to get the exact identifier of the record that couldn't be found or matched.
This is useful for confirming which resource reference was wrong, especially if the request touched multiple identifiers at once.
Example: null

  - `errorCode` (string)
    Indicates the error code.
Example:
null

  - `title` (string)
    Indicates a short, human-readable summary of the error category.

Example: Resource not found
    Example: Resource not found

  - `cause` (string)
    Indicates the reason the error occurred.

Example: The requested resource does not exist or has been deleted.
    Example: The requested resource does not exist or has been deleted.

  - `resolution` (string)
    Indicates the recommended action for resolving the error.

Example: Verify the resource ID is correct or retrieve a list of available resources.
    Example: Verify the resource ID is correct or retrieve a list of available resources.

  - `documentationUrl` (string)
    https://developer.flute.com/

## Response 429:

  - `429` (unknown)
    Too Many Requests

## Response 429 fields (application/json):

  - `details` (string)
    Indicates details about the error.

Example: Unauthorized
    Example: Unauthorized

  - `statusCode` (integer)
    Specifies the HTTP response status code.
This is the HTTP status code returned by the attempted delivery.
The following is a list of HTTP response status codes that include but are not limited to:
| HTTP Response | Meaning |
|  --- | --- |
| 200 | Delivery succeeded |
| 400 | Bad request |
| 401 | Unauthorized |
| 404 | Endpoint not found |
| 429 | Rate limited |

Example: 401
    Example: 401

  - `source` (string)
    Indicates the source of the error.
Example: <Service>
    Example: <Service>

  - `exceptionType` (string)
    Indicates the error's exception type.

Example: FluentValidation.ValidationException
    Example: FluentValidation.ValidationException

  - `correlationId` (string)
    Indicates the correlation identifier.

This is a unique identifier, a trace identifier, Flute attaches to a request/response pair so a single transaction can be traced end-to-end across systems and logs. 

Its intent is to support troubleshooting.
We recommend including this value when contacting support.

Example: aa6cfcd0-0295-4a4c-b074-8c901f114fef
    Example: aa6cfcd0-0295-4a4c-b074-8c901f114fef

  - `entityId` (string)
    Indicates the entity identifier.
This is a field on Flute's standard error response object, alongside values such as `correlationId`, `errorCode`, or `statusCode`.
It's the identifier of the specific resource the failed request was about.
Error messages may specify "Entity with ID b31fbe9f-eebb-45ce-9cae-92265389f47f does not exist or has been deleted."
When a 404 (or similar entity-specific error, like a conflict) comes back,
check `entityId` to get the exact identifier of the record that couldn't be found or matched.
This is useful for confirming which resource reference was wrong, especially if the request touched multiple identifiers at once.
Example: null

  - `errorCode` (string)
    Indicates the error code.
Example:
null

  - `title` (string)
    Indicates a short, human-readable summary of the error category.

Example: Resource not found
    Example: Resource not found

  - `cause` (string)
    Indicates the reason the error occurred.

Example: The requested resource does not exist or has been deleted.
    Example: The requested resource does not exist or has been deleted.

  - `resolution` (string)
    Indicates the recommended action for resolving the error.

Example: Verify the resource ID is correct or retrieve a list of available resources.
    Example: Verify the resource ID is correct or retrieve a list of available resources.

  - `documentationUrl` (string)
    https://developer.flute.com/

## Response 500:

  - `500` (unknown)
    Internal Server Error

## Response 500 fields (application/json):

  - `details` (string)
    Indicates details about the error.

Example: Unauthorized
    Example: Unauthorized

  - `statusCode` (integer)
    Specifies the HTTP response status code.
This is the HTTP status code returned by the attempted delivery.
The following is a list of HTTP response status codes that include but are not limited to:
| HTTP Response | Meaning |
|  --- | --- |
| 200 | Delivery succeeded |
| 400 | Bad request |
| 401 | Unauthorized |
| 404 | Endpoint not found |
| 429 | Rate limited |

Example: 401
    Example: 401

  - `source` (string)
    Indicates the source of the error.
Example: <Service>
    Example: <Service>

  - `exceptionType` (string)
    Indicates the error's exception type.

Example: FluentValidation.ValidationException
    Example: FluentValidation.ValidationException

  - `correlationId` (string)
    Indicates the correlation identifier.

This is a unique identifier, a trace identifier, Flute attaches to a request/response pair so a single transaction can be traced end-to-end across systems and logs. 

Its intent is to support troubleshooting.
We recommend including this value when contacting support.

Example: aa6cfcd0-0295-4a4c-b074-8c901f114fef
    Example: aa6cfcd0-0295-4a4c-b074-8c901f114fef

  - `entityId` (string)
    Indicates the entity identifier.
This is a field on Flute's standard error response object, alongside values such as `correlationId`, `errorCode`, or `statusCode`.
It's the identifier of the specific resource the failed request was about.
Error messages may specify "Entity with ID b31fbe9f-eebb-45ce-9cae-92265389f47f does not exist or has been deleted."
When a 404 (or similar entity-specific error, like a conflict) comes back,
check `entityId` to get the exact identifier of the record that couldn't be found or matched.
This is useful for confirming which resource reference was wrong, especially if the request touched multiple identifiers at once.
Example: null

  - `errorCode` (string)
    Indicates the error code.
Example:
null

  - `title` (string)
    Indicates a short, human-readable summary of the error category.

Example: Resource not found
    Example: Resource not found

  - `cause` (string)
    Indicates the reason the error occurred.

Example: The requested resource does not exist or has been deleted.
    Example: The requested resource does not exist or has been deleted.

  - `resolution` (string)
    Indicates the recommended action for resolving the error.

Example: Verify the resource ID is correct or retrieve a list of available resources.
    Example: Verify the resource ID is correct or retrieve a list of available resources.

  - `documentationUrl` (string)
    https://developer.flute.com/