# List a customer's payment methods

> The payment_methods.list operation: GET /api/v1/customers/{customerId}/payment_methods in the REST API and the payment_methods_list tool in the MCP server.

Lists the payment methods a customer saved (from a subscription checkout or a setup checkout), newest first:
the card's brand, last four digits, expiry and country, and which one is the default that subscriptions charge.
Card numbers never reach Ownrecord. Detached methods are listed only with `includeDetached`.

Paginate with `limit` (1–100, default 10) and `starting_after` (the `next_cursor` of the previous page).

## At a glance

- **REST:** `GET /api/v1/customers/{customerId}/payment_methods`
- **MCP tool:** `payment_methods_list`
- **Operation ID:** `payment_methods.list`
- **Scope:** Brand
- **Permission:** `customers:read`
- **Risk tier:** `read`
- **Dry run:** Not supported
- **Idempotency:** Not needed (read only)
- **Modes:** Test and live
- **Pagination:** `limit` (at most 100) and `starting_after`
- **Authentication:** API key with the `customers:read` scope
- **Since:** M5

## Request

### Path parameters

| Field        | Type       | Description |
| ------------ | ---------- | ----------- |
| `customerId` | `cus_…` ID |             |

### Query parameters

| Field             | Type                              | Required | Description                 |
| ----------------- | --------------------------------- | -------- | --------------------------- |
| `includeDetached` | boolean or one of `true`, `false` | No       | Also list detached methods. |
| `limit`           | integer (1 to 100)                | No       |                             |
| `starting_after`  | `pm_…` ID                         | No       |                             |

## Response

`200 OK` with a JSON object, a page of the list (newest first):

| Field                                 | Type                              | Description                                                        |
| ------------------------------------- | --------------------------------- | ------------------------------------------------------------------ |
| `object`                              | `"list"`                          |                                                                    |
| `data`                                | array of object                   |                                                                    |
| `data[].id`                           | `pm_…` ID                         |                                                                    |
| `data[].object`                       | `"payment_method"`                |                                                                    |
| `data[].livemode`                     | boolean                           |                                                                    |
| `data[].brandId`                      | `brd_…` ID                        |                                                                    |
| `data[].customerId`                   | `cus_…` ID                        |                                                                    |
| `data[].processor`                    | one of `stripe`, `mollie`, `fake` |                                                                    |
| `data[].processorConnectionId`        | `pcon_…` ID                       |                                                                    |
| `data[].processorRef`                 | object                            |                                                                    |
| `data[].processorRef.paymentMethodId` | string                            | The processor's ID of the method (Stripe `pm_…`).                  |
| `data[].type`                         | string                            | `card`, `sepa_debit`, … as the processor reports it.               |
| `data[].card`                         | object or null                    |                                                                    |
| `data[].isDefault`                    | boolean                           | Charged for the customer's subscriptions unless one names another. |
| `data[].source`                       | one of `checkout`, `setup`        |                                                                    |
| `data[].createdAt`                    | date-time                         |                                                                    |
| `data[].detachedAt`                   | date-time or null                 |                                                                    |
| `has_more`                            | boolean                           |                                                                    |
| `next_cursor`                         | `pm_…` ID or null                 |                                                                    |

## Examples

### A customer's cards

```http
GET /api/v1/customers/cus_01m4tx5nj8emwbyf7y9vcf47z4/payment_methods
Authorization: Bearer or_test_…
```

Response (`200`):

```json
{
  "object": "list",
  "data": [
    {
      "id": "pm_01m4tx5nj8emwbyf7y9vcf47zd",
      "object": "payment_method",
      "livemode": false,
      "brandId": "brd_01m4tx5nj8emwbyf7y9vcf47x4",
      "customerId": "cus_01m4tx5nj8emwbyf7y9vcf47z4",
      "processor": "stripe",
      "processorConnectionId": "pcon_01m4tx5nj8emwbyf7y9vcf47zf",
      "processorRef": {
        "paymentMethodId": "pm_1QExampleCard"
      },
      "type": "card",
      "card": {
        "brand": "visa",
        "last4": "4242",
        "expMonth": 12,
        "expYear": 2029,
        "country": "DE"
      },
      "isDefault": true,
      "source": "checkout",
      "createdAt": "2026-10-13T12:00:00.000Z",
      "detachedAt": null
    }
  ],
  "has_more": false,
  "next_cursor": null
}
```

## Errors

| Code                                                                                     | HTTP status | When                                                                    | What to do                                                                                           |
| ---------------------------------------------------------------------------------------- | ----------- | ----------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- |
| [`resource_not_found`](https://ownrecord.io/docs/reference/errors.md#resource_not_found) | 404         | No payment method (or customer) with this ID is visible to the request. | Check the ID and that your credentials are scoped to the right organization, entity, brand and mode. |
| [`permission_denied`](https://ownrecord.io/docs/reference/errors.md#permission_denied)   | 403         | You can't see this brand's customers (`customers:read`).                | Ask an organization owner or admin for a role or scope that allows this action.                      |

It can also return these [common errors](https://ownrecord.io/docs/reference.md#common-errors): [`validation_failed`](https://ownrecord.io/docs/reference/errors.md#validation_failed), [`api_version_unsupported`](https://ownrecord.io/docs/reference/errors.md#api_version_unsupported), [`authentication_required`](https://ownrecord.io/docs/reference/errors.md#authentication_required), [`api_key_invalid`](https://ownrecord.io/docs/reference/errors.md#api_key_invalid), [`scope_required`](https://ownrecord.io/docs/reference/errors.md#scope_required), [`dry_run_not_supported`](https://ownrecord.io/docs/reference/errors.md#dry_run_not_supported), [`rate_limited`](https://ownrecord.io/docs/reference/errors.md#rate_limited), [`internal_error`](https://ownrecord.io/docs/reference/errors.md#internal_error).