Store payment card

POST

/v1/actions/hospitality.action.store_payment_card/apply

curl --request POST \
  --url https://api.aerandil.com/v1/actions/hospitality.action.store_payment_card/apply \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "branch": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0", "params": { "activation_date": "2026-04-15", "brand": "visa", "capture_kind": "terminal", "card_format": "physical", "cardholder_name": "example", "expiry_month": 1, "expiry_year": 1, "funded_amount": { "amount": "example", "currency": "example" }, "funding": "credit", "issuing_country": "example", "last4": "example", "network_fingerprint": "example", "off_session_consent": true, "person_ref": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0", "provider": "example", "provider_card_ref": "example", "reservation_ref": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0", "retain_until": "2026-04-15", "source": "guest_device_page", "wallet": "apple_pay" }, "return_modified": false }'

• Production API

Record a card the PSP has already tokenised, bound to the person who holds it or the reservation it guarantees. Validators reject: a PAN-shaped token (PCI-DSS 4.0 — tokenise upstream), a last4 that is not four digits, an expiry month outside 1-12, an expiry already in the past, a physical card with no cardholder, a virtual card with no reservation or with a cardholder it cannot have, and a second card carrying a token already stored against the same binding. A virtual card may carry the channel’s activation_date and funded_amount; the card then records activation_at, the house’s midnight on that date, which the virtual-card charge automation sweeps (charge_virtual_card). The processor Customer the card hangs off and the merchant account that may draw on it are not this verb’s to say: the card rail records them, read off the processor (record_saved_payment_card), so a card stored here names neither.

Effects: create hospitality.payment_card; link hospitality.link.payment_card_for_person; link hospitality.link.payment_card_for_reservation.

Authorizations

• aerandil_oauth
  actions:apply
• aerandil_oauth
  actions:hospitality.action.store_payment_card:apply

Request Body^required

Media typeapplication/json

object

branch

Apply against an open branch’s overlay view instead of the canonical (main) plane. The action’s writes land in the branch’s copy-on-first-write overlay, its events in the branch’s own stream, and the invocation is journaled for merge-by-replay. Branch writes are action-only, so this is the write-side entry point to a branch (POST /v1/branches forks one).

string format: uuid

params

required

object

activation_date

A `virtual` card's activation date — the first day the channel lets the house charge it (the house's calendar)

string format: date

brand

required

Card scheme as the PSP reports it

string

Allowed values: visa mastercard amex discover diners jcb unionpay cartes_bancaires eftpos_au interac maestro unknown

capture_kind

required

How the card reached the PSP — decides card-present interchange, chargeback liability, and whether the cardholder's presence satisfied SCA

string

Allowed values: terminal keyed_by_staff guest_device imported

card_format

`physical` (a person's card, the default) or `virtual` (an OTA single-booking card)

string

Allowed values: physical virtual

cardholder_name

The payer's name as the pay page took it, for a page card with no cardholder person

string

expiry_month

required

Expiry month, 1-12

integer

expiry_year

required

Expiry year, four digits

integer

funded_amount

What the channel loaded a `virtual` card with — the most the house may charge it

object

amount

required

string format: decimal

currency

required

string format: iso-4217

funding

What the card draws on, as the scheme reports it

string

Allowed values: credit debit prepaid unknown

issuing_country

Issuing country (ISO 3166-1 alpha-2)

string

last4

required

Last four glyphs of the card number

string

network_fingerprint

PSP-issued stable identifier for the underlying card number

string

off_session_consent

required

True when the cardholder authenticated with the stated intent that the property may charge this card later

boolean

person_ref

The cardholder. Required for a `physical` card; a `virtual` card has none.

string format: uuid

provider

required

PSP holding the card (`stripe`, `adyen`)

string

provider_card_ref

required

The PSP's token for this card (Stripe PaymentMethod id, Adyen recurringDetailReference). Never a PAN.

string

reservation_ref

The booking this card guarantees. Required for a `virtual` card; optional for a guest's own card.

string format: uuid

retain_until

required

Storage-limitation clock (set per jurisdiction and purpose)

string format: date

source

Where the off-session consent was given, when narrower than the cardholder's: `guest_device_page` (a booking's pay page — its terms cover the bookings the card is bound to). A `physical` page card may then omit `person_ref` when it names `reservation_ref`: its payer is not the booking's guest

string

Allowed values: guest_device_page

wallet

Wallet the card was presented through, when it was

string

Allowed values: apple_pay google_pay samsung_pay link click_to_pay other

return_modified

When true, the response carries modified_objects and modified_links projections — the engine reads the event log inside the same transaction so the projection observes the handler’s own writes.

boolean

Responses

200

Action applied. modified_objects and modified_links populated when return_modified: true was supplied.

Media typeapplication/json

ApplyActionResponse

Envelope returned by the Aerandil action engine. correlation_id ties every event emitted by this invocation; modified_objects and modified_links project the events the handler emitted (per the action’s declared effects); warnings carries any non-blocking soft-validator observations.

object

correlation_id

required

Per-invocation correlation id; matches events.correlation_id for every event this action appended.

string format: uuid

modified_links

required

Links established or removed by this invocation. Empty when the caller did not request return_modified.

Array<object>

object

from_id

required

string format: uuid

from_type

required

string

kind

required

Allowed values: linked

link_type

required

Allowed values: hospitality.link.payment_card_for_person hospitality.link.payment_card_for_reservation

to_id

required

string format: uuid

to_type

required

string

modified_objects

required

Objects created, modified, or soft-deleted by this invocation. Empty when the caller did not request return_modified.

Array<object>

object

id

required

string format: uuid

kind

required

Allowed values: created

object_type

required

Allowed values: hospitality.payment_card

warnings

Non-blocking soft-validator observations emitted during this invocation (e.g. comp-authority over-limit, recipe pour-cost over sell-price). Absent when no warnings were emitted.

Array<object>

object

message

required

Human-readable summary, suitable for logging or operator-UI surfacing.

string

object_type

required

Object type the warning was raised against.

string

property

Property the warning anchors to, when a single field is the locus. Absent for multi-field rules.

string

rule

required

Stable kebab-case rule identifier (e.g. comp-authority-over-limit).

string

Example

{
  "modified_links": [
    {
      "kind": "linked",
      "link_type": "hospitality.link.payment_card_for_person"
    }
  ],
  "modified_objects": [
    {
      "kind": "created",
      "object_type": "hospitality.payment_card"
    }
  ]
}

409

Conflict — concurrent modification or unique constraint violation.

422

Validation error — parameter validation or business-rule violation.