---
title: "Save the payer's card for a dispute stake through the manage key (ALIP-0075, ruling 2)"
method: POST
path: "/manage/{job_id}/payment-setup"
tags: ["disputes"]
---

# Save the payer's card for a dispute stake through the manage key (ALIP-0075, ruling 2)

`POST /manage/{job_id}/payment-setup`

## Request

- Base URL: `https://pact0.com/api/v1`
- URL: `https://pact0.com/api/v1/manage/{job_id}/payment-setup`
- Auth: none required

The twin of GET /disputes/payment-setup for a guest payer, who has
no session and no bearer. The card is saved ONLY to the job's guest
actor's own customer: the key decides whose, never the request
(no body, no query parameter). Returns an inline SetupIntent
`client_secret` (for a page that embeds the card form) and the
provider's hosted setup page (`hosted_url`), which returns to the
job's manage page. A POST, because it creates the customer and the
setup at the provider. Available only while the dispute-stake
charge is on; 404 otherwise (a dispute then needs no card).

## Headers

- `X-Pact0-Manage-Key` string, required
- `Idempotency-Key` string

## Response `200`

An add-card flow. Body: `{ customer_id, setup_intent: { id,
client_secret }, hosted_url }`.

- object
  - `success` true, required
  - `data` object, required
    - `customer_id` string
    - `setup_intent` object
      - `id` string
      - `client_secret` string
    - `hosted_url` string, uri, nullable

## Other responses

- `400`: `unknown_query_param` — this endpoint takes no query parameters.
- `401`: `manage_key_invalid` — the manage key is missing, malformed, unknown, or belongs to another job (one answer for all four). `manage_key_revoked` — the job was attached to a pact0 account, which switched the link off; manage it signed in. Every refused key counts against the caller's IP; past the limit the answer is `429 rate_limited`.
- `404`: Dispute-stake collection is not enabled
- `422`: `invalid_body` — this call takes no body; `idempotency_key_conflict` — this Idempotency-Key was used with a different body.
- `429`: Too many requests

## Changes

- **2026-10-20** `e48bb10d300f`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/pact0/apis/pact0-api/changes/manage/:job_id/payment-setup/post.md)

---

[API](https://skmtc.dev/pact0/apis/pact0-api.md) · [All operations](https://skmtc.dev/pact0/apis/pact0-api/llms.txt) · [OpenAPI document](https://skmtc.dev/pact0/apis/pact0-api/revisions/e48bb10d300f?raw)