> This page is for Developer.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.bigcommerce.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.bigcommerce.com/_mcp/server.

# List Stored Instruments

GET https://api.bigcommerce.com/stores/{store_hash}/v3/customers/{customerId}/stored-instruments

Lists all available stored instruments for a customer. This list will include all types of stored instruments namely card, account and bank_account instruments

Reference: https://docs.bigcommerce.com/developer/api-reference/rest/admin/management/customers/v3/stored-instruments/get-customer-stored-instruments

## Authentication

- `X-Auth-Token` header (required) — ### OAuth scopes | UI Name | Permission | Parameter | |:--------|:-----------|:----------| | Customers | modify | `store_v2_customers` | | Customers | read-only | `store_v2_customers_read_only` | | Stored Payment Instruments | modify | `store_stored_payment_instruments` | | Stored Payment Instruments | read-only | `store_stored_payment_instruments_read_only` | ### Authentication header | Header | Argument | Description | |:-------|:---------|:------------| | `X-Auth-Token` | `access_token` | For more about API accounts that generate `access_token`s, see our [Guide to API Accounts](/developer/docs/overview/api-fundamentals/api-accounts#api-accounts). | ### Further reading For example requests and more information about authenticating BigCommerce APIs, see [Authentication and Example Requests](/developer/docs/overview/api-fundamentals/api-accounts#x-auth-token-header-example-requests). For more about BigCommerce OAuth scopes, see our [Guide to API Accounts](/developer/docs/overview/api-fundamentals/api-accounts#oauth-scopes). For a list of API status codes, see [API Status Codes](/developer/api-reference/rest/overview#rest-http-status-codes).

## Request

### Path parameters

- `customerId` (integer, required) — The ID of the customer.
- `store_hash` (string, required) — Permanent ID of the BigCommerce store.

## Response

### 200

OK

- `list of CustomersCustomerIdStoredInstrumentsGetResponsesContentApplicationJsonSchemaItems`

## Errors

### 401 Unauthorized Error

Unauthorized

- `status` (integer, optional) — The HTTP status code.
- `title` (string, optional) — The error title describing the particular error.
- `type` (string, optional) — A link to a list of BigCommerce API status codes.
- `instance` (string, optional)
- `errors` (ErrorResponseErrors, optional)

### 403 Forbidden Error

Missing scope - the v3 Auth token is valid but does not have proper permissions to access this endpoint.

- `status` (integer, optional) — The HTTP status code.
- `title` (string, optional) — The error title describing the particular error.
- `type` (string, optional) — A link to a list of BigCommerce API status codes.
- `instance` (string, optional)
- `errors` (ErrorResponseErrors, optional)

## Types

### CustomersCustomerIdStoredInstrumentsGetResponsesContentApplicationJsonSchemaItems

- `type`: `stored_card` (Card Instrument)
  - `billing_address` (BillingAddress, optional)
  - `brand` (string, optional) — Card brand.
  - `expiry_month` (integer, optional) — Expiry month for this card.
  - `expiry_year` (integer, optional) — Expiry year for this card.
  - `is_default` (boolean, optional) — Identifies whether this stored instrument is default for the customer.
  - `issuer_identification_number` (string, optional) — Issuer identification number for this card.
  - `last_4` (string, optional) — Last four digits of this card.
  - `token` (string, optional) — An identifier representing this stored instrument.
- `type`: `stored_paypal_account` (PayPal Account Instrument)
  - `email` (string, optional) — PayPal email address.
  - `is_default` (boolean, optional) — Identifies whether this stored instrument is default for the customer.
  - `token` (string, optional) — An identifier representing this stored instrument.
- `type`: `stored_bank_account` (Bank Account Instrument)
  - `is_default` (boolean, optional) — Identifies whether this stored instrument is default for the customer.
  - `issuer` (string, optional) — Issuer identifier for the account.
  - `masked_account_number` (string, optional) — A masked bank account number.
  - `token` (string, optional) — An identifier representing this stored instrument.

### ErrorResponseErrors

### BillingAddress

- `first_name` (string, optional) — First name of the card holder.
- `last_name` (string, optional) — Last name of the card holder.
- `email` (string, optional)
- `company` (string, optional) — Company of the card holder.
- `address1` (string, optional)
- `address2` (string, optional)
- `city` (string, optional)
- `postal_code` (string, optional)
- `state_or_province` (string, optional) — Represents state or province.
- `state_or_province_code` (string, optional)
- `country_code` (string, optional) — ISO-3166-1 2 letter country code.
- `phone` (string, optional)

## Examples

**Response**

```json
[
  {
    "type": "stored_card",
    "billing_address": {
      "first_name": "Tester",
      "last_name": "Tester",
      "email": "example@email.com",
      "company": "Test Company",
      "address1": "1 Sample Street",
      "address2": "Apt 1",
      "city": "Las Vegas",
      "postal_code": "90854",
      "state_or_province": "Nevada",
      "state_or_province_code": "NV",
      "country_code": "US",
      "phone": "101-192-0293"
    },
    "brand": "VISA",
    "expiry_month": 1,
    "expiry_year": 0,
    "is_default": true,
    "issuer_identification_number": "411111",
    "last_4": "1111",
    "token": "84596bea275fa254da820056bdc3e495bdf01fd11c51b0336347d447ee16200c"
  }
]
```

**SDK Code**

```python example-1
import requests

url = "https://api.bigcommerce.com/stores/store_hash/v3/customers/1/stored-instruments"

headers = {"X-Auth-Token": "<apiKey>"}

response = requests.get(url, headers=headers)

print(response.json())
```

```javascript example-1
const url = 'https://api.bigcommerce.com/stores/store_hash/v3/customers/1/stored-instruments';
const options = {method: 'GET', headers: {'X-Auth-Token': '<apiKey>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}
```

```go example-1
package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.bigcommerce.com/stores/store_hash/v3/customers/1/stored-instruments"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("X-Auth-Token", "<apiKey>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(res)
	fmt.Println(string(body))

}
```

```ruby example-1
require 'uri'
require 'net/http'

url = URI("https://api.bigcommerce.com/stores/store_hash/v3/customers/1/stored-instruments")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["X-Auth-Token"] = '<apiKey>'

response = http.request(request)
puts response.read_body
```

```java example-1
import com.mashape.unirest.http.HttpResponse;
import com.mashape.unirest.http.Unirest;

HttpResponse<String> response = Unirest.get("https://api.bigcommerce.com/stores/store_hash/v3/customers/1/stored-instruments")
  .header("X-Auth-Token", "<apiKey>")
  .asString();
```

```php example-1
<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('GET', 'https://api.bigcommerce.com/stores/store_hash/v3/customers/1/stored-instruments', [
  'headers' => [
    'X-Auth-Token' => '<apiKey>',
  ],
]);

echo $response->getBody();
```

```csharp example-1
using RestSharp;

var client = new RestClient("https://api.bigcommerce.com/stores/store_hash/v3/customers/1/stored-instruments");
var request = new RestRequest(Method.GET);
request.AddHeader("X-Auth-Token", "<apiKey>");
IRestResponse response = client.Execute(request);
```

```swift example-1
import Foundation

let headers = ["X-Auth-Token": "<apiKey>"]

let request = NSMutableURLRequest(url: NSURL(string: "https://api.bigcommerce.com/stores/store_hash/v3/customers/1/stored-instruments")! as URL,
                                        cachePolicy: .useProtocolCachePolicy,
                                    timeoutInterval: 10.0)
request.httpMethod = "GET"
request.allHTTPHeaderFields = headers

let session = URLSession.shared
let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in
  if (error != nil) {
    print(error as Any)
  } else {
    let httpResponse = response as? HTTPURLResponse
    print(httpResponse)
  }
})

dataTask.resume()
```