API Reference›LMS API›Payment instruments›Add a customer payment instrument

Add a customer payment instrument

POSThttps://sandbox.api.lendeasy.ai/v1/customers/{customerId}/payment-instruments Bearer token · CREATE_LMS_PAYMENT_INSTRUMENT

Attaches a processor-tokenized customer instrument. providerTokenRef must be a vault token; raw account, routing, or card numbers are rejected. The server resolves the token to derive the masked display, rail capabilities, and type. New instruments start UNVERIFIED; verification completes through provider events, never through a public route.

Request

curl -X POST https://sandbox.api.lendeasy.ai/v1/customers/$CUSTOMER_ID/payment-instruments \
  -H "Authorization: Bearer $TOKEN" \
  -H "Idempotency-Key: $IDEMPOTENCY_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "instrumentType": "ACH_BANK",
  "providerTokenRef": "vault:ach:tok_sandbox_bank_44",
  "authorizationRef": "evd_BANK_AUTH_11"
}'

await fetch(`https://sandbox.api.lendeasy.ai/v1/customers/${customerId}/payment-instruments`, {
  method: "POST",
  headers: { Authorization: `Bearer ${token}`, "Idempotency-Key": idempotencyKey, "Content-Type": "application/json" },
  body: JSON.stringify({
  "instrumentType": "ACH_BANK",
  "providerTokenRef": "vault:ach:tok_sandbox_bank_44",
  "authorizationRef": "evd_BANK_AUTH_11"
}),
});

requests.post(
  f"https://sandbox.api.lendeasy.ai/v1/customers/{customer_id}/payment-instruments",
  headers={"Authorization": f"Bearer {token}", "Idempotency-Key": idempotency_key},
  json={
  "instrumentType": "ACH_BANK",
  "providerTokenRef": "vault:ach:tok_sandbox_bank_44",
  "authorizationRef": "evd_BANK_AUTH_11"
},
)

{
  "resourceId": 704
}

{
  "developerMessage": "Request was understood but rejected; inspect errors for field-level causes.",
  "httpStatusCode": "400",
  "defaultUserMessage": "The request could not be applied.",
  "userMessageGlobalisationCode": "validation.msg.validation.errors.exist",
  "errors": []
}

{
  "developerMessage": "Request was understood but rejected; inspect errors for field-level causes.",
  "httpStatusCode": "401",
  "defaultUserMessage": "The request could not be applied.",
  "userMessageGlobalisationCode": "error.msg.not.authenticated",
  "errors": []
}

{
  "developerMessage": "Request was understood but rejected; inspect errors for field-level causes.",
  "httpStatusCode": "403",
  "defaultUserMessage": "The request could not be applied.",
  "userMessageGlobalisationCode": "error.msg.not.authorized",
  "errors": []
}

{
  "developerMessage": "Request was understood but rejected; inspect errors for field-level causes.",
  "httpStatusCode": "404",
  "defaultUserMessage": "The request could not be applied.",
  "userMessageGlobalisationCode": "error.msg.resource.not.found",
  "errors": []
}

{
  "developerMessage": "Request was understood but rejected; inspect errors for field-level causes.",
  "httpStatusCode": "409",
  "defaultUserMessage": "The request could not be applied.",
  "userMessageGlobalisationCode": "idempotency.request.in.flight",
  "errors": []
}

Path & query parameters

Field	Type	Description
LendEasy-Tenant required in header	string	Tenant selector: lowercase letters, digits, and hyphens, 1-64 characters. Exactly one instance; the only tenant selector honored.
customerId required in path	string	Stable opaque customer identifier.
Idempotency-Key optional in header	string	Optional stable key (1-50 chars) for this one logical mutation. Replays of a completed request return the original result with x-served-from-cache: true; an in-flight duplicate returns 409 with Retry-After. Omitted keys are server-generated per attempt.

Body parameters

Field	Type	Description
instrumentType required	string
providerTokenRef required	string
authorizationRef required	string

Request

curl -X POST https://sandbox.api.lendeasy.ai/v1/customers/$CUSTOMER_ID/payment-instruments \
  -H "Authorization: Bearer $TOKEN" \
  -H "Idempotency-Key: $IDEMPOTENCY_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "instrumentType": "ACH_BANK",
  "providerTokenRef": "vault:ach:tok_sandbox_bank_44",
  "authorizationRef": "evd_BANK_AUTH_11"
}'

await fetch(`https://sandbox.api.lendeasy.ai/v1/customers/${customerId}/payment-instruments`, {
  method: "POST",
  headers: { Authorization: `Bearer ${token}`, "Idempotency-Key": idempotencyKey, "Content-Type": "application/json" },
  body: JSON.stringify({
  "instrumentType": "ACH_BANK",
  "providerTokenRef": "vault:ach:tok_sandbox_bank_44",
  "authorizationRef": "evd_BANK_AUTH_11"
}),
});

requests.post(
  f"https://sandbox.api.lendeasy.ai/v1/customers/{customer_id}/payment-instruments",
  headers={"Authorization": f"Bearer {token}", "Idempotency-Key": idempotency_key},
  json={
  "instrumentType": "ACH_BANK",
  "providerTokenRef": "vault:ach:tok_sandbox_bank_44",
  "authorizationRef": "evd_BANK_AUTH_11"
},
)

{
  "resourceId": 704
}

{
  "developerMessage": "Request was understood but rejected; inspect errors for field-level causes.",
  "httpStatusCode": "400",
  "defaultUserMessage": "The request could not be applied.",
  "userMessageGlobalisationCode": "validation.msg.validation.errors.exist",
  "errors": []
}

{
  "developerMessage": "Request was understood but rejected; inspect errors for field-level causes.",
  "httpStatusCode": "401",
  "defaultUserMessage": "The request could not be applied.",
  "userMessageGlobalisationCode": "error.msg.not.authenticated",
  "errors": []
}

{
  "developerMessage": "Request was understood but rejected; inspect errors for field-level causes.",
  "httpStatusCode": "403",
  "defaultUserMessage": "The request could not be applied.",
  "userMessageGlobalisationCode": "error.msg.not.authorized",
  "errors": []
}

{
  "developerMessage": "Request was understood but rejected; inspect errors for field-level causes.",
  "httpStatusCode": "404",
  "defaultUserMessage": "The request could not be applied.",
  "userMessageGlobalisationCode": "error.msg.resource.not.found",
  "errors": []
}

{
  "developerMessage": "Request was understood but rejected; inspect errors for field-level causes.",
  "httpStatusCode": "409",
  "defaultUserMessage": "The request could not be applied.",
  "userMessageGlobalisationCode": "idempotency.request.in.flight",
  "errors": []
}