Payment Methods
Vault a payment card
Stores a customer's card and returns a reusable paymentToken to send as
payment.paymentToken when placing an order with CARD_ON_FILE.
Submitting card data
Card data is never accepted in the clear. card.number and card.cvc must be submitted
through the secure capture endpoint configured with your Gett representative during
onboarding, which encrypts both fields in transit before they reach Gett. A request carrying
a readable card number is rejected with CARD_NOT_ENCRYPTED — the card is not stored.
bin, lastFour and cardType travel as ordinary plaintext fields alongside the protected
ones, and your onboarding configuration supplies them. lastFour must be exactly four digits
(0-9); any other value is rejected with 400 INVALID_REQUEST and the card is not stored.
Customer
customer.partnerUserId is your own stable identifier for this customer. The same value on a
later order binds the order to the same customer record, so a card vaulted once is usable on
every subsequent order for that customer.
Idempotency
The Idempotency-Key header (UUID v4) is REQUIRED. Replays with the same key return the
original response and create no duplicate card (24h TTL).
A replay is matched on the customer and the card's descriptive fields — bin, lastFour,
cardType, expiry, cardholder name and billing address — not on the protected number
and cvc. Those are re-protected on every submission and so differ between two sends of the
same card, which is why they cannot identify a retry. Reusing a key for a genuinely different
card or a different billing address is rejected as a conflict.
Use a fresh key for each distinct card.
Headers
Idempotency-KeyRequired unique key (UUID v4) so the card is vaulted at most once. A replay with the same key returns the original token.
Vault a payment card › Request Body
A postal address used across the order API.
On a request, supply the street fields; LatLong is ignored — the server geocodes coordinates from the street fields. On a response, the street fields are echoed alongside the server-geocoded LatLong.
Card details for addPartnerPaymentMethod.
Number and Cvc are protected fields: they must be submitted through the secure capture endpoint configured during onboarding, which protects them before they reach Gett. A request carrying either of them in readable form is rejected and no card is stored. Bin, LastFour and CardType are ordinary fields that travel alongside the protected ones. Supply them directly — they are never inferred from Number.
Customer contact information for the public order API.
Vault a payment card › Responses
The card was vaulted.
cardTypeexpirationLast day of the card's expiry month.
lastFourpaymentTokenOpaque, reusable token for this card. Treat it as an opaque string — its internal structure is not part of the contract and may change.