API key issued at onboarding. Passed as a Bearer token in the Authorization header: Authorization: Bearer <api-key>. Identifies the caller and determines organization scope. Invalid or revoked keys return 401 with error type authentication_error.
Ed25519 or RSA-SHA256 asymmetric signature over the request payload (ADR-0015). Provides request integrity and non-repudiation. The signature covers the HTTP method, path, query string, request body, and timestamp. Invalid signatures return 401 with error type authentication_error.
Unix timestamp (seconds) of when the request was signed. Server rejects requests where the timestamp drifts beyond +/-60 seconds from server time to prevent replay attacks. Must match the timestamp used in the signature computation.
Unique identifier of the counterparty (cpt_ prefix). Counterparty resource identifier.
^cpt_[A-Za-z0-9]+$"cpt_01953e1a5f4b7004"
Maximum number of items to return. Default 50, max 200.
1 <= x <= 200Cursor for forward pagination. Return items created after the item with this ID. Mutually exclusive with ending_before.
Payment method list.
A reusable payment method attached to a counterparty. Discriminated on type for rail-specific fields. Replaces V2's inline rail details. Fields present depend on the type — see each field's description for which types include it.
{
"id": "pm_01953e1a5f4b7300",
"counterpartyId": "cpt_01953e1a5f4b7004",
"type": "us_bank",
"status": "active",
"currency": "USD",
"label": "Globex USD Operating",
"accountHolderName": "Globex Corporation",
"bankName": "Chase",
"routingNumber": "021000021",
"accountNumberLast4": "7890",
"bankAccountType": "checking",
"validationResult": "verified",
"validatedAt": "2026-02-23T12:00:00Z",
"createdAt": "2026-02-23T12:00:00Z"
}Cursor-based pagination metadata. Returned on all list endpoints.