---
title: "List the organization's saved payment instruments"
method: GET
path: "/billing/payment-methods"
tags: ["Billing"]
---

# List the organization's saved payment instruments

`GET /billing/payment-methods`

## Request

- Base URL: `https://api.mnemom.ai/v1`
- URL: `https://api.mnemom.ai/v1/billing/payment-methods`
- Auth: HTTP bearer

Returns kind, brand, last four, expiry, verification status and default flag ONLY. A full card or bank account number is never returned by this API. Owner/admin only; the organization is resolved from the session (an explicit org_id must be one the caller is a member of).

## Query parameters

- `org_id` string

## Response `200`

Saved payment instruments, tokenized fields only.

- PaymentMethodList: The organization's saved instruments. An empty array means genuinely nothing on file — a failure is a 4xx/5xx, never an empty list, so an outage can never read as 'you have no payment method'.
  - `paymentMethods` PaymentMethod[], required
    - `id` string, required: Provider instrument id (e.g. Stripe `pm_…`).
    - `kind` string, required: Instrument kind — `card`, `us_bank_account`, `sepa_debit`, `link`, … Unrecognized kinds are passed through verbatim rather than dropped, so a newly-supported instrument still renders as *something* rather than disappearing.
    - `brand` string: Card network (`visa`, `mastercard`, `amex`, …) or, for a bank account, the bank name.
    - `last4` string: Last four digits only — never more.
    - `expMonth` integer: Card expiry month. Absent for non-card instruments.
    - `expYear` integer: Card expiry year. Absent for non-card instruments.
    - `bankAccountStatus` 'blocked': Present and equal to `blocked` when a bank-account instrument has been blocked by the bank or network and can no longer be charged. Absent for cards, and absent for a bank account with nothing reported — absent does NOT mean 'verified'. (The payment provider exposes no micro-deposit verification state on a saved instrument, so none is claimed here.)
    - `isDefault` boolean, required: Whether future invoices are charged to this instrument.

## Other responses

- `400`: Bad request
- `401`: Authentication required
- `403`: Forbidden
- `404`: Resource not found
- `429`: Rate-limit exceeded. The global per-IP limiter (100 requests/minute, applied to every `/v1/*` route) rejected this request. Back off until the window resets — `Retry-After` carries the cooldown in seconds and `X-RateLimit-Reset` the absolute reset time.
- `500`: Server error — request was well-formed but the server failed to fulfill it. Typically a downstream dependency (DB / RPC / external API) returned an unexpected error.

---

[API](https://skmtc.dev/mnemom/apis/mnemom-api.md) · [All operations](https://skmtc.dev/mnemom/apis/mnemom-api/llms.txt) · [OpenAPI document](https://skmtc.dev/mnemom/apis/mnemom-api/revisions/274b7a6ea182?raw)