> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pilotstatus.com.br/llms.txt
> Use this file to discover all available pages before exploring further.

# Start a card save (Stripe Elements)

> Creates a Stripe SetupIntent on the workspace's customer, for a card form on your own page. Mount the Payment Element with `clientSecret`, load Stripe.js with `publishableKey`, call `stripe.confirmSetup()`, then `POST /v1/billing/card/setup-intent/{id}/sync`. No body (any field → `400 UNKNOWN_FIELDS`). Owner only (`billing:payment_method:manage`) with an account key or OAuth token. Card data goes from the payer's browser straight to Stripe (Payment Element) and never reaches Pilot Status. The `clientSecret` lets whoever holds it confirm the intent: do not cache or log it. Sent with `Cache-Control: no-store`.

**Requires a tenant-scoped key** — a workspace key, or an account key with `x-workspace-id`.

> [!WARNING]
>
> The `clientSecret` is meant for Stripe.js on your page. See [Transparent checkout](https://docs.pilotstatus.com.br/guides/transparent-checkout.md).


## OpenAPI

````yaml openapi.json POST /v1/billing/card/setup-intent
openapi: 3.1.0
info:
  title: Pilot Status API
  version: 1.0.0
  license:
    name: Pilot Status Terms of Service
    url: https://pilotstatus.com.br/terms
  description: >-
    Public REST API for Pilot Status. Authenticate with the `x-api-key: ps_...`
    header (or `x-api-key-id`). Base URL: https://pilotstatus.com.br
servers:
  - url: https://pilotstatus.com.br
security:
  - apiKey: []
  - apiKeyId: []
paths:
  /v1/billing/card/setup-intent:
    post:
      tags:
        - Billing
      summary: Start a card save (Stripe Elements)
      description: >-
        Creates a Stripe SetupIntent on the workspace's customer, for a card
        form on your own page. Mount the Payment Element with `clientSecret`,
        load Stripe.js with `publishableKey`, call `stripe.confirmSetup()`, then
        `POST /v1/billing/card/setup-intent/{id}/sync`. No body (any field →
        `400 UNKNOWN_FIELDS`). Owner only (`billing:payment_method:manage`) with
        an account key or OAuth token. Card data goes from the payer's browser
        straight to Stripe (Payment Element) and never reaches Pilot Status. The
        `clientSecret` lets whoever holds it confirm the intent: do not cache or
        log it. Sent with `Cache-Control: no-store`.


        **Requires a tenant-scoped key** — a workspace key, or an account key
        with `x-workspace-id`.
      operationId: post_billing_card_setup_intent
      parameters:
        - name: x-workspace-id
          in: header
          required: false
          schema:
            type: string
          description: >-
            Only with an account key (`ps_account_`): the workspace to act on,
            from `GET /v1/workspaces`. Without it an account key gets `400
            WORKSPACE_ID_REQUIRED`.
          example: cmh2a9z8y0002ws8example1q
      responses:
        '200':
          description: The intent
          content:
            application/json:
              example:
                clientSecret: seti_1QabcDEF_secret_xyz
                setupIntentId: seti_1QabcDEF
                publishableKey: pk_live_...
          headers:
            Cache-Control:
              schema:
                type: string
              example: no-store
        '400':
          description: '`INVALID_BODY` or `UNKNOWN_FIELDS`'
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: string
                  code:
                    type: string
              example:
                error: >-
                  Unknown field(s): customerId. Accepted: (none). | Campo(s)
                  desconhecido(s): customerId. Aceitos: (nenhum).
                code: UNKNOWN_FIELDS
        '401':
          description: Missing, invalid or revoked API key
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: string
                  code:
                    type: string
              example:
                error: Invalid API key
        '403':
          description: >-
            Number-scoped key (`NUMBER_SCOPE_NOT_ALLOWED`), the user's role does
            not allow it (`PERMISSION_DENIED`), or an account key outside its
            workspaces (`WORKSPACE_MEMBERSHIP_REQUIRED`)
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: string
                  code:
                    type: string
              example:
                error: This endpoint requires a tenant-scoped API key
                code: NUMBER_SCOPE_NOT_ALLOWED
        '503':
          description: Card payments are not available right now
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: string
                  code:
                    type: string
              example:
                error: >-
                  Card payments are not available right now. | Pagamentos com
                  cartão não estão disponíveis no momento.
                code: PAYMENTS_NOT_CONFIGURED
components:
  securitySchemes:
    apiKey:
      type: apiKey
      in: header
      name: x-api-key
      description: Your ps_ API key
    apiKeyId:
      type: apiKey
      in: header
      name: x-api-key-id
      description: API key id (alternative to x-api-key)

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.