Pre-1.0 · one maintainer · Stripe and cards only · no SDKs (client libraries) yet · no production users yet. Docs describe v0.9.1 (29 Oct 2026) · What’s new →

Detach a payment method

DELETE

/v1/customers/{customer_id}/payment-methods/{pmID}

const url = 'http://localhost:8080/v1/customers/example/payment-methods/example';
const options = {method: 'DELETE', headers: {Authorization: 'Bearer <token>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request DELETE \
  --url http://localhost:8080/v1/customers/example/payment-methods/example \
  --header 'Authorization: Bearer <token>'

Detaches the card in Stripe and marks it detached in Hardcount. If it was the default, the newest remaining card becomes the default in the same step, and that change is copied to Stripe (best effort). Both changes are written to the audit log. A Stripe error on the detach returns 500 and leaves the card attached.

Authorizations

BearerAuth

Parameters

Path Parameters

customer_id

required

string

pmID

required

string

Hardcount payment method ID.

Responses

200

The detached payment method.

application/json

object

required

string

customer_id

required

string

type

required

string

card_brand

string

card_last4

string

card_exp_month

integer

card_exp_year

integer

is_default

required

boolean

created_at

required

string format: date-time

Example

{
  "type": "card"
}

404

No such payment method for this customer.

application/json

object

error

object

type

One of invalid_request_error, authentication_error, rate_limit_error or api_error. Every error the API answers has this shape, including an unknown path (404, code route_not_found) and a method the path does not take (405, code method_not_allowed, with an Allow header). The few exceptions are listed in docs/api-surface.md.

string

code

string

message

string

request_id

string

param

The request field the error is about. Sent only when the error names one. A request body may hold only the fields its operation lists, spelled and cased as listed: any other field, or one the server sets (such as id), is refused with 422 and param naming it. An operation with no request body lists no fields: send no body, {} or null. The Stripe and Postmark webhooks and the LiteLLM callback take their sender’s body as it comes.

string

Example

{
  "error": {
    "type": "invalid_request_error"
  }
}