find_apisBrowse and filter every API in the catalog.
get_api_artifactsOne API's artifacts, grouped by type.
get_openapiThe primary OpenAPI for this API.
find_similar_apisAPIs that look like this one.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This API

curl "https://apis.io/api/v1/apis/getmyhotels-com:getmyhotels-com-payment-methods-api"

All apis

curl "https://apis.io/api/v1/apis?limit=25"

Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

openapi: 3.2.0
info:
  title: GetMyHotels REST Payment Methods API
  version: 1.0.0
  description: REST surface for the native GetMyHotels apps. Every route is a thin transport over the shared tRPC routers — inputs are validated with the same Zod schemas the web client uses, and responses are returned verbatim. Authentication uses Better Auth bearer session tokens issued by the /api/auth/* endpoints (not part of this spec). Native clients send X-GMH-App-Version and X-GMH-Platform on every request; versions below the configured floor receive a typed 426 UpgradeRequiredError.
servers:
- url: https://api.getmyhotels.com
  description: Production API
tags:
- name: Payment Methods
paths:
  /v1/payment-methods:
    get:
      tags:
      - Payment Methods
      summary: List my saved cards
      description: 'Runs `user.listPaymentMethods`. Returns `{ paymentMethods: [{ publicId, type, brand, last4, expiryMonth, expiryYear, isDefault, holderName }] }` for active cards; no provider token ever leaves the server. `brand` is Stripe''s lowercase name (`visa`, `mastercard`, `amex`, ...). The billing address is the profile address on `GET`/`PATCH /v1/account/profile`.'
      security:
      - bearerAuth: []
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                description: Verbatim JSON output of the `user.listPaymentMethods` tRPC procedure. Response shapes are intentionally not modeled in this spec; the native client types them by hand.
        '400':
          description: Request validation failed or the router rejected the input
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
        '401':
          description: Missing or invalid bearer session token
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
        '426':
          description: Reported X-GMH-App-Version is below the supported minimum — the app must update
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UpgradeRequiredError'
        '500':
          description: Unexpected server error (opaque; details stay in logs)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
      operationId: getV1PaymentMethods
      x-operation-id-source: derived
    post:
      tags:
      - Payment Methods
      summary: Save a card confirmed through a SetupIntent
      description: 'Runs `user.attachStripePaymentMethod`. Send the `pm_` id Stripe returned after confirming the SetupIntent from `POST /v1/payment-methods/setup-intent`. Brand, last 4 and expiry are read from Stripe, not the client. Card payment methods only (400 otherwise). The card must be unattached (it is then attached to the user''s Stripe customer) or already on that customer; a card on any other customer is a 400. Saving the same card twice returns the existing row with `alreadySaved: true`. `isDefault` (default false) makes it the default card. Returns `{ publicId, alreadySaved }`.'
      security:
      - bearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                stripePaymentMethodId:
                  type: string
                  pattern: ^pm_
                isDefault:
                  type: boolean
                  default: false
              required:
              - stripePaymentMethodId
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                description: Verbatim JSON output of the `user.attachStripePaymentMethod` tRPC procedure. Response shapes are intentionally not modeled in this spec; the native client types them by hand.
        '400':
          description: Request validation failed or the router rejected the input
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
        '401':
          description: Missing or invalid bearer session token
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
        '426':
          description: Reported X-GMH-App-Version is below the supported minimum — the app must update
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UpgradeRequiredError'
        '500':
          description: Unexpected server error (opaque; details stay in logs)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
      operationId: postV1PaymentMethods
      x-operation-id-source: derived
  /v1/payment-methods/setup-intent:
    post:
      tags:
      - Payment Methods
      summary: Start saving a card
      description: Runs `user.createSetupIntent`. Returns `{ clientSecret }` for a Stripe SetupIntent on the user's Stripe customer (created on first use). Confirm it with the Stripe SDK — the card number never touches our servers — then send the resulting `pm_` id to `POST /v1/payment-methods`. Redirect-based methods are excluded, so no return URL is needed. Takes no input, so this route accepts no request body.
      security:
      - bearerAuth: []
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                description: Verbatim JSON output of the `user.createSetupIntent` tRPC procedure. Response shapes are intentionally not modeled in this spec; the native client types them by hand.
        '400':
          description: Request validation failed or the router rejected the input
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
        '401':
          description: Missing or invalid bearer session token
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
        '426':
          description: Reported X-GMH-App-Version is below the supported minimum — the app must update
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UpgradeRequiredError'
        '500':
          description: Unexpected server error (opaque; details stay in logs)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
      operationId: postV1PaymentMethodsSetupIntent
      x-operation-id-source: derived
  /v1/payment-methods/{publicId}:
    delete:
      tags:
      - Payment Methods
      summary: Remove a saved card
      description: 'Runs `user.removePaymentMethod`; owner-only. Detaches the card from Stripe and hides it from checkout. A card the caller does not own answers 404. Returns `{ success: true }`.'
      security:
      - bearerAuth: []
      parameters:
      - schema:
          type: string
          minLength: 1
          maxLength: 36
        required: true
        name: publicId
        in: path
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                description: Verbatim JSON output of the `user.removePaymentMethod` tRPC procedure. Response shapes are intentionally not modeled in this spec; the native client types them by hand.
        '400':
          description: Request validation failed or the router rejected the input
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
        '401':
          description: Missing or invalid bearer session token
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
        '404':
          description: Resource not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
        '426':
          description: Reported X-GMH-App-Version is below the supported minimum — the app must update
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UpgradeRequiredError'
        '500':
          description: Unexpected server error (opaque; details stay in logs)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
      operationId: deleteV1PaymentMethodsByPublicId
      x-operation-id-source: derived
components:
  schemas:
    UpgradeRequiredError:
      type: object
      properties:
        error:
          type: object
          properties:
            code:
              type: string
              enum:
              - UPGRADE_REQUIRED
            message:
              type: string
            minVersion:
              type: string
              example: 1.2.0
            platform:
              type:
              - string
              - 'null'
          required:
          - code
          - message
          - minVersion
          - platform
      required:
      - error
    ApiError:
      type: object
      properties:
        error:
          type: object
          properties:
            code:
              type: string
              example: NOT_FOUND
            message:
              type: string
              example: Booking not found
            domainCode:
              type: string
              example: NON_REFUNDABLE_CONSENT_REQUIRED
            issues:
              type: array
              items:
                type: object
                properties:
                  path:
                    type: string
                  message:
                    type: string
                required:
                - path
                - message
          required:
          - code
          - message
      required:
      - error
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: 'Better Auth session token. Obtain it from the native /api/auth/* endpoints (Better Auth bearer plugin — out of scope for this spec, see #922).'
x-provenance:
  method: harvested
  publisher: GetMyHotels
  source: https://api.getmyhotels.com/v1/openapi.json
  note: split by refine-openapis from the provider's own published document, verified by fetch (openapi/_original/*.fetch.json);
    stamped by stamp-openapi-provenance.py (roadmap#793)