Pre-1.0 · one maintainer · Stripe and cards only · no SDKs (client libraries) yet · no production users yet. Docs describe v0.9.1 (29 Oct 2026) · What’s new →

Make a payment method the default

POST

/v1/customers/{customer_id}/payment-methods/{pmID}/default

const url = 'http://localhost:8080/v1/customers/example/payment-methods/example/default';
const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request POST \
  --url http://localhost:8080/v1/customers/example/payment-methods/example/default \
  --header 'Authorization: Bearer <token>'

Makes this card the one Hardcount charges and clears the flag on the others. The change is copied to the Stripe customer (best effort; a Stripe failure is recorded on the audit row and does not fail the call).

Authorizations

BearerAuth

Parameters

Path Parameters

customer_id

required

string

pmID

required

string

Hardcount payment method ID.

Header Parameters

Idempotency-Key

string

Makes the call safe to retry. Send a unique value (a UUID works) and the same value on every retry. For 24 hours, a repeat with the same key, method, path and body gets the first response again, with an Idempotent-Replayed: true header, instead of running again. The error cases are in docs/api-surface.md. The usage routes do not take it: each usage event carries its own idempotency_key.

Responses

200

The new default payment method.

application/json

object

required

string

customer_id

required

string

type

required

string

card_brand

string

card_last4

string

card_exp_month

integer

card_exp_year

integer

is_default

required

boolean

created_at

required

string format: date-time

Example

{
  "type": "card"
}

404

No such active payment method for this customer.

application/json

object

error

object

type

One of invalid_request_error, authentication_error, rate_limit_error or api_error. Every error the API answers has this shape, including an unknown path (404, code route_not_found) and a method the path does not take (405, code method_not_allowed, with an Allow header). The few exceptions are listed in docs/api-surface.md.

string

code

string

message

string

request_id

string

param

The request field the error is about. Sent only when the error names one. A request body may hold only the fields its operation lists, spelled and cased as listed: any other field, or one the server sets (such as id), is refused with 422 and param naming it. An operation with no request body lists no fields: send no body, {} or null. The Stripe and Postmark webhooks and the LiteLLM callback take their sender’s body as it comes.

string

Example

{
  "error": {
    "type": "invalid_request_error"
  }
}