> This page is for Developer.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.bigcommerce.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.bigcommerce.com/_mcp/server.

# List Instruments

GET https://api.bigcommerce.com/stores/{store_hash}/v3/payments/stored-instruments

Lists all available stored instruments for a store. This list will include all types of stored instruments namely card, account, and bank_account instruments.

Reference: https://docs.bigcommerce.com/developer/api-reference/rest/admin/payments/stored-instruments/manage-instruments/list-instruments-for-store

## Authentication

- `X-Auth-Token` header (required) — ### OAuth scopes | UI Name | Permission | Parameter | |:--------|:-----------|:----------| | Create Payments | create | `store_payments_access_token_create` | | Get Payment Methods | read-only | `store_payments_methods_read` | ### Authentication header | Header | Argument | Description | |:-------|:---------|:------------| | `X-Auth-Token` | `access_token` | For more about API accounts that generate `access_token`s, see our [Guide to API Accounts](/developer/docs/overview/api-fundamentals/api-accounts#api-accounts). | ### Further reading For example requests and more information about authenticating BigCommerce APIs, see [Authentication and Example Requests](/developer/docs/overview/api-fundamentals/api-accounts#x-auth-token-header-example-requests). For more about BigCommerce OAuth scopes, see our [Guide to API Accounts](/developer/docs/overview/api-fundamentals/api-accounts#oauth-scopes). For a list of API status codes, see [API Status Codes](/developer/api-reference/rest/overview#rest-http-status-codes).

## Request

### Path parameters

- `store_hash` (string, required) — Permanent ID of the BigCommerce store.

### Query parameters

- `page` (integer, optional) — The requested page.
- `limit` (integer, optional) — The maximum number of results.
- `after` (string, optional) — The cursor reference of the last entry for the previous page. Use the `end_cursor` value from the last response to get the next page (`end_cursor` is only returned on the first page or when the request contains query parameter `before` or `after`). For example `after=ODc%3D`.
- `before` (string, optional) — The cursor reference of the first entry for the next page. Use the `start_cursor` value from the last response to get the previous page (`start_cursor` is only returned on the first page or when the request contains query parameter `before` or `after`). For example `before=ODg%3D`.

### Headers

- `Accept` (string, required, default: application/json) — The [MIME type](https://developer.mozilla.org/en-US/docs/Web/HTTP/Basics_of_HTTP/MIME_types) of the response body.

## Response

### 200

OK

- `data` (list of GetStoredInstrumentsResponseDataItems, optional)
- `meta` (Meta, optional) — Data about the response, including pagination and collection totals. Both `pagination` and `cursor_pagination` would be returned on the first page. Only `pagination` will be returned when you provide the `page` parameter, which is greater than the first page. Only `cursor_pagination` would be returned when you provide the `before` or `after` parameters in the request that are greater than the first page.

## Errors

### 401 Unauthorized Error

Invalid X-Auth-Token

- `status` (integer, optional) — The HTTP status code.
- `title` (string, optional) — The error title describing the particular error.
- `type` (string, optional)
- `errors` (detailed_error, optional)

## Types

### GetStoredInstrumentsResponseDataItems

### Meta

Data about the response, including pagination and collection totals. Both `pagination` and `cursor_pagination` would be returned on the first page. Only `pagination` will be returned when you provide the `page` parameter, which is greater than the first page. Only `cursor_pagination` would be returned when you provide the `before` or `after` parameters in the request that are greater than the first page.

- `pagination` (Pagination, optional) — Data about the response, including pagination and collection totals.
- `cursor_pagination` (CursorPagination, optional) — Data about cursor pagination.

### detailed_error

### CardInstrument

Details about a stored card instrument which includes details around billing, last four digits, issuer, etc.

- `customer_id` (integer, optional) — The ID of the customer.
- `token` (string, optional) — An identifier representing this stored instrument.
- `type` (string, optional) — Type of instrument.
- `is_default` (boolean, optional) — Identifies whether this stored instrument is default for the customer.
- `brand` (string, optional) — The card brand.
- `expiry_month` (integer, optional) — The expiry month for this card.
- `expiry_year` (integer, optional) — The expiry year for this card.
- `iin` (string, optional) — The issuer identification number.
- `last_4` (string, optional) — The last four digits of this card.
- `billing_address` (BillingAddress, optional)

### PayPalAccountInstrument

A PayPal account stored instrument

- `customer_id` (integer, optional) — The ID of the customer.
- `token` (string, optional) — An identifier representing this stored instrument.
- `type` (string, optional) — Instrument type
- `is_default` (boolean, optional) — Identifies whether this stored instrument is default for the customer.
- `email` (string, optional) — The PayPal email address.

### BankAccountInstrument

A bank account stored instrument

- `customer_id` (integer, optional) — The ID of the customer.
- `token` (string, optional) — An identifier representing this stored instrument.
- `type` (string, optional) — Instrument type
- `is_default` (boolean, optional) — Identifies whether this stored instrument is default for the customer.
- `issuer` (string, optional) — Account issuer number
- `masked_account_number` (string, optional) — Masked account number

### Pagination

Data about the response, including pagination and collection totals.

- `total` (integer, optional) — Total number of items in the result set.
- `count` (integer, optional) — Total number of items in the collection response.
- `per_page` (integer, optional) — The amount of items returned in the collection per page, controlled by the limit parameter.
- `current_page` (integer, optional) — The page you are currently on within the collection.
- `total_pages` (integer, optional) — The total number of pages in the collection.
- `links` (Links, optional) — Pagination links for the previous and next parts of the whole collection.

### CursorPagination

Data about cursor pagination.

- `count` (integer, optional) — Total number of items in the collection response.
- `per_page` (integer, optional) — The amount of items returned in the collection per page, controlled by the limit parameter.
- `start_cursor` (string, optional) — A string representing the cursor reference to the starting item of the current page in the collection.
- `end_cursor` (string, optional) — A string representing the cursor reference to the last item of the current page in the collection.
- `links` (Links, optional) — Pagination links for the previous and next parts of the whole collection.

### BillingAddress

- `first_name` (string, optional) — The first name of the cardholder.
- `last_name` (string, optional) — The last name of the cardholder.
- `email` (string, optional)
- `company` (string, optional) — The company of the cardholder.
- `address1` (string, optional)
- `address2` (string, optional)
- `city` (string, optional)
- `state_or_province` (string, optional) — Represents the state or province.
- `state_or_province_code` (string, optional)
- `country_code` (string, optional) — The ISO-3166-1 2 letter country code.
- `phone` (string, optional)
- `postal_code` (string, optional)

### Links

Pagination links for the previous and next parts of the whole collection.

- `previous` (string, optional) — The link to the previous page is returned in the response.
- `current` (string, optional) — The link to the current page is returned in the response.
- `next` (string, optional) — The link to the next page is returned in the response.

## Examples

### credit_card_example

**Response**

```json
{
  "data": [
    {
      "billing_address": {
        "address1": "1 Sample Street",
        "address2": "",
        "city": "",
        "company": "",
        "country_code": "US",
        "email": "example@email.com",
        "first_name": "Tester",
        "last_name": "Tester",
        "phone": "101-192-0293",
        "postal_code": "55555",
        "state_or_province": "Nevada",
        "state_or_province_code": "NV"
      },
      "brand": "visa",
      "customer_id": 1,
      "expiry_month": 1,
      "expiry_year": 1,
      "iin": "411111",
      "is_default": true,
      "last_4": "1111",
      "token": "84596bea275fa254da820056bdc3e495bdf01fd11c51b0336347d447ee16200c",
      "type": "credit_card"
    }
  ],
  "meta": {
    "pagination": {
      "total": 1,
      "count": 1,
      "per_page": 1,
      "current_page": 1,
      "total_pages": 1,
      "links": {
        "previous": "",
        "current": "",
        "next": ""
      }
    },
    "cursor_pagination": {
      "count": 1,
      "per_page": 1,
      "start_cursor": "",
      "end_cursor": "",
      "links": {
        "previous": "",
        "next": ""
      }
    }
  }
}
```

**SDK Code**

```python credit_card_example
import requests

url = "https://api.bigcommerce.com/stores/store_hash/v3/payments/stored-instruments"

headers = {
    "Accept": "application/json",
    "X-Auth-Token": "<apiKey>"
}

response = requests.get(url, headers=headers)

print(response.json())
```

```javascript credit_card_example
const url = 'https://api.bigcommerce.com/stores/store_hash/v3/payments/stored-instruments';
const options = {
  method: 'GET',
  headers: {Accept: 'application/json', 'X-Auth-Token': '<apiKey>'}
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}
```

```go credit_card_example
package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.bigcommerce.com/stores/store_hash/v3/payments/stored-instruments"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Accept", "application/json")
	req.Header.Add("X-Auth-Token", "<apiKey>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(res)
	fmt.Println(string(body))

}
```

```ruby credit_card_example
require 'uri'
require 'net/http'

url = URI("https://api.bigcommerce.com/stores/store_hash/v3/payments/stored-instruments")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Accept"] = 'application/json'
request["X-Auth-Token"] = '<apiKey>'

response = http.request(request)
puts response.read_body
```

```java credit_card_example
import com.mashape.unirest.http.HttpResponse;
import com.mashape.unirest.http.Unirest;

HttpResponse<String> response = Unirest.get("https://api.bigcommerce.com/stores/store_hash/v3/payments/stored-instruments")
  .header("Accept", "application/json")
  .header("X-Auth-Token", "<apiKey>")
  .asString();
```

```php credit_card_example
<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('GET', 'https://api.bigcommerce.com/stores/store_hash/v3/payments/stored-instruments', [
  'headers' => [
    'Accept' => 'application/json',
    'X-Auth-Token' => '<apiKey>',
  ],
]);

echo $response->getBody();
```

```csharp credit_card_example
using RestSharp;

var client = new RestClient("https://api.bigcommerce.com/stores/store_hash/v3/payments/stored-instruments");
var request = new RestRequest(Method.GET);
request.AddHeader("Accept", "application/json");
request.AddHeader("X-Auth-Token", "<apiKey>");
IRestResponse response = client.Execute(request);
```

```swift credit_card_example
import Foundation

let headers = [
  "Accept": "application/json",
  "X-Auth-Token": "<apiKey>"
]

let request = NSMutableURLRequest(url: NSURL(string: "https://api.bigcommerce.com/stores/store_hash/v3/payments/stored-instruments")! as URL,
                                        cachePolicy: .useProtocolCachePolicy,
                                    timeoutInterval: 10.0)
request.httpMethod = "GET"
request.allHTTPHeaderFields = headers

let session = URLSession.shared
let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in
  if (error != nil) {
    print(error as Any)
  } else {
    let httpResponse = response as? HTTPURLResponse
    print(httpResponse)
  }
})

dataTask.resume()
```

### paypal_account_example

**Response**

```json
{
  "data": [
    {
      "customer_id": 1,
      "email": "bc-buyer-paypal-express@bigcommerce.com",
      "is_default": true,
      "token": "84596bea275fa254da820056bdc3e495bdf01fd11c51b0336347d447ee16200c",
      "type": "paypal_account"
    }
  ],
  "meta": {
    "pagination": {
      "total": 1,
      "count": 1,
      "per_page": 1,
      "current_page": 1,
      "total_pages": 1,
      "links": {
        "previous": "",
        "current": "",
        "next": ""
      }
    },
    "cursor_pagination": {
      "count": 1,
      "per_page": 1,
      "start_cursor": "",
      "end_cursor": "",
      "links": {
        "previous": "",
        "next": ""
      }
    }
  }
}
```

**SDK Code**

```python paypal_account_example
import requests

url = "https://api.bigcommerce.com/stores/store_hash/v3/payments/stored-instruments"

headers = {
    "Accept": "application/json",
    "X-Auth-Token": "<apiKey>"
}

response = requests.get(url, headers=headers)

print(response.json())
```

```javascript paypal_account_example
const url = 'https://api.bigcommerce.com/stores/store_hash/v3/payments/stored-instruments';
const options = {
  method: 'GET',
  headers: {Accept: 'application/json', 'X-Auth-Token': '<apiKey>'}
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}
```

```go paypal_account_example
package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.bigcommerce.com/stores/store_hash/v3/payments/stored-instruments"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Accept", "application/json")
	req.Header.Add("X-Auth-Token", "<apiKey>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(res)
	fmt.Println(string(body))

}
```

```ruby paypal_account_example
require 'uri'
require 'net/http'

url = URI("https://api.bigcommerce.com/stores/store_hash/v3/payments/stored-instruments")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Accept"] = 'application/json'
request["X-Auth-Token"] = '<apiKey>'

response = http.request(request)
puts response.read_body
```

```java paypal_account_example
import com.mashape.unirest.http.HttpResponse;
import com.mashape.unirest.http.Unirest;

HttpResponse<String> response = Unirest.get("https://api.bigcommerce.com/stores/store_hash/v3/payments/stored-instruments")
  .header("Accept", "application/json")
  .header("X-Auth-Token", "<apiKey>")
  .asString();
```

```php paypal_account_example
<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('GET', 'https://api.bigcommerce.com/stores/store_hash/v3/payments/stored-instruments', [
  'headers' => [
    'Accept' => 'application/json',
    'X-Auth-Token' => '<apiKey>',
  ],
]);

echo $response->getBody();
```

```csharp paypal_account_example
using RestSharp;

var client = new RestClient("https://api.bigcommerce.com/stores/store_hash/v3/payments/stored-instruments");
var request = new RestRequest(Method.GET);
request.AddHeader("Accept", "application/json");
request.AddHeader("X-Auth-Token", "<apiKey>");
IRestResponse response = client.Execute(request);
```

```swift paypal_account_example
import Foundation

let headers = [
  "Accept": "application/json",
  "X-Auth-Token": "<apiKey>"
]

let request = NSMutableURLRequest(url: NSURL(string: "https://api.bigcommerce.com/stores/store_hash/v3/payments/stored-instruments")! as URL,
                                        cachePolicy: .useProtocolCachePolicy,
                                    timeoutInterval: 10.0)
request.httpMethod = "GET"
request.allHTTPHeaderFields = headers

let session = URLSession.shared
let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in
  if (error != nil) {
    print(error as Any)
  } else {
    let httpResponse = response as? HTTPURLResponse
    print(httpResponse)
  }
})

dataTask.resume()
```

### bank_account_example

**Response**

```json
{
  "data": [
    {
      "customer_id": 1,
      "is_default": true,
      "issuer": "011000015",
      "masked_account_number": "0000",
      "token": "84596bea275fa254da820056bdc3e495bdf01fd11c51b0336347d447ee16200c",
      "type": "bank_account"
    }
  ],
  "meta": {
    "pagination": {
      "total": 1,
      "count": 1,
      "per_page": 1,
      "current_page": 1,
      "total_pages": 1,
      "links": {
        "previous": "",
        "current": "",
        "next": ""
      }
    },
    "cursor_pagination": {
      "count": 1,
      "per_page": 1,
      "start_cursor": "",
      "end_cursor": "",
      "links": {
        "previous": "",
        "next": ""
      }
    }
  }
}
```

**SDK Code**

```python bank_account_example
import requests

url = "https://api.bigcommerce.com/stores/store_hash/v3/payments/stored-instruments"

headers = {
    "Accept": "application/json",
    "X-Auth-Token": "<apiKey>"
}

response = requests.get(url, headers=headers)

print(response.json())
```

```javascript bank_account_example
const url = 'https://api.bigcommerce.com/stores/store_hash/v3/payments/stored-instruments';
const options = {
  method: 'GET',
  headers: {Accept: 'application/json', 'X-Auth-Token': '<apiKey>'}
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}
```

```go bank_account_example
package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.bigcommerce.com/stores/store_hash/v3/payments/stored-instruments"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Accept", "application/json")
	req.Header.Add("X-Auth-Token", "<apiKey>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(res)
	fmt.Println(string(body))

}
```

```ruby bank_account_example
require 'uri'
require 'net/http'

url = URI("https://api.bigcommerce.com/stores/store_hash/v3/payments/stored-instruments")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Accept"] = 'application/json'
request["X-Auth-Token"] = '<apiKey>'

response = http.request(request)
puts response.read_body
```

```java bank_account_example
import com.mashape.unirest.http.HttpResponse;
import com.mashape.unirest.http.Unirest;

HttpResponse<String> response = Unirest.get("https://api.bigcommerce.com/stores/store_hash/v3/payments/stored-instruments")
  .header("Accept", "application/json")
  .header("X-Auth-Token", "<apiKey>")
  .asString();
```

```php bank_account_example
<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('GET', 'https://api.bigcommerce.com/stores/store_hash/v3/payments/stored-instruments', [
  'headers' => [
    'Accept' => 'application/json',
    'X-Auth-Token' => '<apiKey>',
  ],
]);

echo $response->getBody();
```

```csharp bank_account_example
using RestSharp;

var client = new RestClient("https://api.bigcommerce.com/stores/store_hash/v3/payments/stored-instruments");
var request = new RestRequest(Method.GET);
request.AddHeader("Accept", "application/json");
request.AddHeader("X-Auth-Token", "<apiKey>");
IRestResponse response = client.Execute(request);
```

```swift bank_account_example
import Foundation

let headers = [
  "Accept": "application/json",
  "X-Auth-Token": "<apiKey>"
]

let request = NSMutableURLRequest(url: NSURL(string: "https://api.bigcommerce.com/stores/store_hash/v3/payments/stored-instruments")! as URL,
                                        cachePolicy: .useProtocolCachePolicy,
                                    timeoutInterval: 10.0)
request.httpMethod = "GET"
request.allHTTPHeaderFields = headers

let session = URLSession.shared
let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in
  if (error != nil) {
    print(error as Any)
  } else {
    let httpResponse = response as? HTTPURLResponse
    print(httpResponse)
  }
})

dataTask.resume()
```