# CustomerStoredPaymentMethod

A model the API reference uses in a request or a response. The operation pages link every field typed as this model here.

## Fields
- `id` (string(uuid)): (read only)
- `paymentMethodType` ([CustomerStoredPaymentMethodType](https://devportal.demo.winkpg.io/docs/api/models/CustomerStoredPaymentMethodType.md)): Specifies the type of a stored payment method associated with a customer.
  Values:
  - `Card`
  - `Check`
- `paymentTokenId` (string(uuid)): (nullable)
- `cardData` ([CardData](https://devportal.demo.winkpg.io/docs/api/models/CardData.md)): Required: When PaymentMethodType == Card.
  Fields:
  - `cardNumber` (string): The card account number. Conditional: When IsStoredPayment is not true. (nullable)
  - `last4CardNumber` (integer(int32)): The last 4 digits of the card number as an integer. (nullable, read only)
  - `expirationMonth` (integer(int32)): The expiration month of the card as an integer in the range `1` to `12`.
  - `expirationYear` (integer(int32)): The expiration year of the card. Either a two-digit year (e.g. `29`) or a  four-digit year (e.g. `2029`); two-digit years resolve to the 2000s.
  - `expirationDate` (string(date-time)): The expiration date of the card. Conditional: When IsStoredPayment is not true. (nullable)
  - `binData` ([BinData](https://devportal.demo.winkpg.io/docs/api/models/BinData.md)): The BIN (Bank Identification Number) data associated with the card.
  - `cvv` (integer(int32)): Deprecated: send `cardVerificationValue` instead. The CVV (Card Verification  Value) of the card as an integer. Conditional: When IsStoredPayment is not true. Range: 100 to 9999. (nullable, deprecated)
  - `cardVerificationValue` (string): The card verification value (CVV, CVC or CID) exactly as printed on the card: three digits,  or four for American Express. Send it as a string so a leading zero is kept. Conditional: When IsStoredPayment is not true. (nullable)
  - `nameOnCard` (string): The name on the card. Conditional: When IsStoredPayment is not true. Max length: 25. (nullable, min length 0, max length 25)
  - `pin` (string): The PIN (Personal Identification Number) of the card. (nullable)
  - `keySerialNumber` (string): The Key Serial Number associated with the card. (nullable)
  - `emvData` (string): The EMV (Europay, Mastercard, and Visa) data associated with the card. (nullable)
  - `trackData` (string): The track data of the card. (nullable)
  - `encryptedTrack1Data` (string): The encrypted track 1 data of the card. (nullable)
  - `encryptedTrack2Data` (string): The encrypted track 2 data of the card. (nullable)
  - `encryptedTrack3Data` (string): The encrypted track 3 data of the card. (nullable)
  - `dynamicCardVerificationData` (string): A reader-generated dynamic card verification value captured at the moment the card was  read. Card readers that support it derive this value from physical characteristics of the  magnetic stripe, which differ between an original card and a copy, so the decryption  service that fronts the processor can score whether the presented card is genuine. (nullable)
  - `dynamicCardVerificationStatus` (string): Status metadata the reader reported alongside  `dynamicCardVerificationData` (for example whether the reader considered the  dynamic verification read successful). Non-secret: it describes the read, it is not the  verification value itself, so it is persisted as submitted. (nullable)
  - `iin` (string): The IIN (Issuer Identification Number) of the card. (nullable)
  - `arqc` (string): The ARQC (Authorization Request Cryptogram) of the card. (nullable)
  - `entryMode` ([EntryModes](https://devportal.demo.winkpg.io/docs/api/models/EntryModes.md)): The entry mode of the card.
    Values:
    - `Unknown`: The entry mode is unknown.
    - `NotApplicable`: The entry mode is not applicable for this transaction.
    - `Manual`: The transaction details were entered manually.
    - `UnencryptedCardReaderSwipe`: The card was swiped through an unencrypted card reader.
    - `EncryptedCardReaderSwipe`: The card was swiped through an encrypted card reader.
    - `Icc`: The transaction was processed using an ICC (Integrated Circuit Card) or chip card.
    - `Proximity`: The transaction was processed using a proximity or contactless payment method.
    - `Fallback`: The transaction was processed using a fallback method when the primary method failed.
    - `TechnicalFallback`: The transaction was processed using a fallback method when the primary method failed.
    - `EmptyCandidateFallback`: The transaction was processed using a fallback method when the primary method failed.
    - `DigitalWallet`: The transaction was processed using a digital wallet.
  - `cvPresence` ([CvPresence](https://devportal.demo.winkpg.io/docs/api/models/CvPresence.md)): The CV (Card Verification) presence status.
    Values:
    - `None`: The CV status is not specified or unknown.
    - `NotSubmitted`: The CV has not been submitted.
    - `Submitted`: The CV has been successfully submitted.
    - `Illegible`: The submitted CV is illegible or cannot be read.
    - `NotPresent`: The CV is not present or missing from the submission.
  - `billingAddress` ([Address](https://devportal.demo.winkpg.io/docs/api/models/Address.md)): The billing address associated with the card.  Optional by default (no nested validation enforced). Conditional: When IsStoredPayment is not true.
  - `phone` (string): The phone number associated with the card. Conditional: When IsStoredPayment is not true. Max length: 15. Pattern: ^[0-9+()\-\s]*$. (nullable, min length 0, max length 15)
  - `email` (string): The email address associated with the card. Conditional: When IsStoredPayment is not true. Must be a valid email. Max length: 50. (nullable, min length 0, max length 50)
  - `hasEmvData` (boolean): Indicates whether EMV data was provided in the original request.  The raw `emvData` value is not stored. (nullable)
  - `hasTrackData` (boolean): Indicates whether track data was provided in the original request.  The raw `trackData` value is not stored. (nullable)
  - `hasEncryptedTrackData` (boolean): Indicates whether any encrypted track data (track 1, 2, or 3) was provided in the original request.  The raw encrypted track values are not stored. (nullable)
  - `hasCvv` (boolean): Indicates whether a CVV was provided in the original request, in either  `cardVerificationValue` or `cvv`. The raw value is not stored. (nullable)
  - `hasPin` (boolean): Indicates whether a PIN was provided in the original request.  The raw `pin` value is not stored. (nullable)
  - `hasDynamicCardVerificationData` (boolean): Indicates whether reader-generated dynamic card verification data was provided in the  original request. The raw `dynamicCardVerificationData` value is not stored. (nullable)
  - `emvAid` (string): (nullable)
  - `isDebitRouting` (boolean): (nullable)
  - `tenderType` ([CardTenderType](https://devportal.demo.winkpg.io/docs/api/models/CardTenderType.md)): The card-rail tender the caller is attempting to use. Drives deterministic  processor routing. `null` (or absent JSON) is treated as  `CreditDebit` for backward compatibility: see  `EffectiveTenderType`. (nullable)
    Values:
    - `CreditDebit`: Standard credit/debit card. The current card-rail behaviour. isDebitRouting modulates whether the request prefers debit-network routing within this rail.
    - `EbtSnap`: EBT SNAP (food benefits). Routes through the EBT SNAP processor lane and requires PIN + card-present per program rules.
    - `EbtCash`: EBT Cash (cash benefits). Distinct rail from SNAP; supports cashback where SNAP does not. PIN + card-present required.
    - `Ewic`: eWIC (Women, Infants, and Children). Distinct rail from EBT, with item-level eligibility / voucher-select flow handled in the eWIC follow-up epic.
  - `isStoredPayment` (boolean): When `true`, this card data originates from a stored payment method and  client-side field validation is not applicable. The server resolves actual  card data from the payment token. (nullable)
  - `terminalCapability` ([TerminalCapability](https://devportal.demo.winkpg.io/docs/api/models/TerminalCapability.md)): The static hardware capability of the terminal. Selects the POS capability subfields on  the processor wire message. Resolved once in `ProcessorSelectionApplier`: request  value wins over the processor-profile default, which wins over `Unspecified`. (nullable)
    Values:
    - `Unspecified`: No capability declared. The handler emits its current default POS capability fields, preserving existing wire behavior exactly.
    - `MagneticStripe`: Magnetic stripe reader only (implies keyed entry).
    - `MagneticStripeWithPin`: Magnetic stripe reader with PIN pad (implies keyed entry).
    - `Chip`: Contact chip reader (EMV ICC).
    - `ChipWithPin`: Contact chip reader with PIN pad.
    - `ChipContactless`: Contactless chip reader (EMV contactless / NFC).
    - `ChipContactlessWithPin`: Contactless chip reader with PIN pad.
  - `cryptogram` (string): The payment network cryptogram recovered from wallet-token decryption  (the online payment cryptogram for Apple Pay / Google Pay DPAN  transactions). Sensitive: masked from logs. (nullable)
  - `eciIndicator` (string): The Electronic Commerce Indicator (ECI) describing the authentication  context of a tokenized / wallet transaction (e.g. `"05"` for a  3DS-authenticated transaction). Drives the liability-shift indicators  processors include in the network message. (nullable)
  - `isTokenized` (boolean): Indicates the credential is a tokenized account number (DPAN / network  token) rather than a raw PAN. `null` means unknown, which is treated the same as not  tokenized. (nullable)
  - `tokenTransactionId` (string): The provider-specific transaction identifier returned alongside a wallet  token (Apple Pay `transactionIdentifier`, network-token  transaction id). Used for dispute matching against the wallet provider. (nullable)
- `checkData` ([CheckData](https://devportal.demo.winkpg.io/docs/api/models/CheckData.md)): Required: When PaymentMethodType == Check.
  Fields:
  - `nameOnCheck` (string): The name printed on the check. Required: When IsStoredPayment is not true. (nullable)
  - `routingNumber` (string): The routing number of the bank. Required: When IsStoredPayment is not true. Conditional: When IsStoredPayment is true. (nullable)
  - `routingNumberLast4` (string): The last 4 digits of `routingNumber` as a string, preserving leading zeros, or  `null` when no digits are available. (nullable, read only)
  - `accountNumber` (string): The account number associated with the check. Required: When IsStoredPayment is not true. Conditional: When IsStoredPayment is true. (nullable)
  - `accountNumberLast4` (string): The last 4 digits of `accountNumber` as a string, preserving leading zeros, or  `null` when no digits are available. (nullable, read only)
  - `checkNumber` (string): The check number. (nullable)
  - `micr` (string): The Magnetic Ink Character Recognition (MICR) data. (nullable)
  - `driversLicense` (string): The driver's license number of the check writer. (nullable)
  - `state` (string): The state of issuance for the driver's license. (nullable)
  - `ssn` (string): The Social Security Number of the check writer. (nullable)
  - `dateOfBirth` (string): The date of birth of the check writer. (nullable)
  - `checkType` ([CheckType](https://devportal.demo.winkpg.io/docs/api/models/CheckType.md)): The type of check.
    Values:
    - `Personal`: Represents a personal check. This is typically issued by an individual from their personal account.
    - `Business`: Represents a business check. This is typically issued by a company or organization from their business account.
  - `accountType` ([CheckAccountType](https://devportal.demo.winkpg.io/docs/api/models/CheckAccountType.md)): The type of account associated with the check. Conditional: When IsStoredPayment is not true.
    Values:
    - `Checking`: Represents a checking account.
    - `Savings`: Represents a savings account.
  - `rawMicr` (string): The raw MICR data. (nullable)
  - `branchCity` (string): The city of the bank branch. (nullable)
  - `emailAddress` (string): The email address of the check writer. Conditional: When IsStoredPayment is not true. Must be a valid email. (nullable)
  - `telephoneNumber` (string): The telephone number of the check writer. Conditional: When IsStoredPayment is not true. Pattern: ^[0-9+()\-\s]*$. (nullable)
  - `address` ([Address](https://devportal.demo.winkpg.io/docs/api/models/Address.md)): The address associated with the check.  Optional by default (no nested validation enforced). Conditional: When IsStoredPayment is not true.
  - `secCode` ([SecCode](https://devportal.demo.winkpg.io/docs/api/models/SecCode.md)): The Standard Entry Class (SEC) code for the transaction. (nullable)
    Values:
    - `Ccd`: Corporate Credit or Debit (CCD) - Used for business-to-business transactions.
    - `Ppd`: Prearranged Payment and Deposit (PPD) - Used for consumer transactions.
    - `Web`: Internet-Initiated/Mobile Entry (WEB) - Used for internet or mobile-initiated transactions.
    - `Arc`: Accounts Receivable Conversion (ARC) - Used for converting eligible checks to ACH debits.
    - `Tel`: Telephone-Initiated Entry (TEL) - Used for telephone-initiated transactions.
  - `isStoredPayment` (boolean): When `true`, this check data originates from a stored payment method and  client-side field validation is not applicable. The server resolves actual  account data from the payment token. (nullable)
- `isDefault` (boolean)
- `displayName` (string): (nullable, read only)
- `isDeleted` (boolean): Indicates whether this entity has been deleted. (nullable)
- `customName` (string): Optional user-defined name for this stored payment method (e.g., "Marriott Chase",  "Bank of America Checkcard"). When set, takes priority over the computed display name. (nullable)
- `initialSchemeTransactionId` (string): The initial (first-in-series) network / scheme transaction id captured from the processor's  authorization response on the cardholder-initiated credential-on-file transaction that stored  this credential. Lets any later transaction (CIT-COF or MIT, any card brand) resolve and echo  the original network transaction id from just the stored token / payment method, without  depending on a StoredCredentialConsent lookup. (nullable)
- `lastSchemeTransactionId` (string): The most-recent-in-series network / scheme transaction id. At tokenization this equals  `initialSchemeTransactionId`. Card-network rules (Visa 11.1.5, Mastercard 13.1.1)  allow the most recent value in a series to be sent when the original is unavailable, so a later  story can advance this on each subsequent authorization response without losing the first-in-  series anchor. Nullable / non-sensitive as for `initialSchemeTransactionId`. (nullable)
- `schemeTransactionIdBrand` (string): The card brand at the moment the network transaction id was captured (e.g. "Visa",  "Mastercard", "Discover", "Amex"). Retained because a co-branded card can switch networks  after storage; Mastercard's AltNetTranID handling requires the brand-at-capture to detect the  case where a stored Visa id must be sent in a Mastercard field. Emitting AltNetTranID is out of  scope here: this only preserves the data so the downstream echo work is not precluded.  Nullable / non-sensitive. (nullable)
- `schemeTransactionIdProcessor` (string): The processor the network transaction id originated from ("tsys" / "fiserv"). The two  processors' response formats differ (TSYS a single 15-char Transaction Identifier; Fiserv  per-brand, whose Visa value can exceed 15 chars including the trailing Validation Code), so the  id is stored opaquely and tagged with its originating processor. Nullable / non-sensitive. (nullable)
- `publicReference` (string): The externally-emitted, chargeable `PublicReference` of the backing `PaymentToken`  (the opaque `pt_`-prefixed handle) captured when this stored method was minted. Persisted  here so the tokenize-on-payment path can surface it on the transaction response / webhook  without re-reading the token, and so a later charge can round-trip the merchant-facing handle.  Distinct from `paymentTokenId`, which is the internal vault Guid (PAN-correlated,  never emitted). May be `null` on a stored method created before this field existed, until  a one-time platform backfill copies the backing token's handle onto it; the backfill only ever  fills a null and never rewrites an assigned handle. Non-sensitive (an opaque random handle,  not a PAN). (nullable)
- `origin` ([StoredPaymentMethodOrigin](https://devportal.demo.winkpg.io/docs/api/models/StoredPaymentMethodOrigin.md)): The surface / add-channel this stored payment method was captured through (manual admin,  hosted payment page, virtual terminal, or API). Stamped once at creation and not changed  afterward. (nullable)
  Values:
  - `Unknown`: The add-channel was not recorded. Assigned to methods that predate this field (materialized from a null value) and to any path that did not classify its origin.
  - `ManualAdmin`: Added by an operator through a Customer admin surface that mints the stored method on the customer document directly (the customer edit form's payment-methods dialog, and the create-customer / create-contract-from-transaction dialogs). Note: the contract add-payment dialog submits through the HTTP add endpoint and is therefore recorded as Api, since origin on that boundary is server-authoritative and cannot be caller-supplied.
  - `HostedPaymentPage`: Vaulted from a hosted payment page: either tokenize-on-payment or the direct ACH vault flow.
  - `VirtualTerminal`: Vaulted from a Virtual Terminal save-on-payment.
  - `Api`: Added through the HTTP add-stored-payment-method endpoint. Covers external API token registration and any in-process operator surface that submits through that same gated endpoint (e.g. the contract add-payment dialog): origin on this boundary is stamped server-side and is never caller-supplied.
- `readerTokenFingerprint` (string): Dedupe fingerprint for a reader-token-backed (PAN-less) stored method: a one-way SHA-256  digest of the processor reader token that this method's backing vault token carries. Set  only for the reader-token shape (decrypt-and-forward processors such as MagTek DAF, where  the gateway never sees the PAN); `null` for every PAN- or account-backed method. (nullable)
- `checkFingerprint` (string): Dedupe fingerprint for a check / ACH stored method: a keyed, non-reversible HMAC-SHA-256  digest of the routing number combined with the account number's last four digits. Set only  for the Check shape; `null` for card and reader-token methods. (nullable)

## See also

- [All documentation](https://devportal.demo.winkpg.io/llms.txt): the machine-readable index of every public page on this site.