curl --request POST \
  --url https://api.sandbox.z2pay.com/v1/customers/{customerId}/cards \
  --header 'Content-Type: application/json' \
  --header 'x-api-key: <api-key>' \
  --data '
{
  "token": "<string>"
}
'

const options = {
  method: 'POST',
  headers: {'x-api-key': '<api-key>', 'Content-Type': 'application/json'},
  body: JSON.stringify({token: '<string>'})
};

fetch('https://api.sandbox.z2pay.com/v1/customers/{customerId}/cards', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://api.sandbox.z2pay.com/v1/customers/{customerId}/cards"

payload = { "token": "<string>" }
headers = {
    "x-api-key": "<api-key>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

{
  "id": "crd_hqx4mkpi8dcxbrb2nzynxnjky",
  "customerId": "cust_j43n74fbt2geb8c1y86ssf6iw",
  "brand": "visa",
  "firstDigits": "411111",
  "lastDigits": "1111",
  "holderName": "JOAO DA SILVA",
  "expirationMonth": "12",
  "expirationYear": "2030",
  "status": "active",
  "createdAt": "2026-07-02T19:26:17.000Z",
  "updatedAt": "2026-07-02T19:26:17.000Z"
}

{
  "error": {
    "code": "VALIDATION_ERROR",
    "message": "Validation failed",
    "issues": [
      {
        "path": "status",
        "message": "Status inválido. Valores aceitos: pending, waiting_payment, paid, refused, canceled, refunded"
      },
      {
        "path": "startDate",
        "message": "Data deve ser ISO 8601 com timezone (ex.: 2026-06-24T00:00:00Z)"
      }
    ]
  }
}

{
  "error": {
    "code": "UNAUTHORIZED",
    "message": "Invalid API key"
  }
}

{
  "error": {
    "code": "NOT_FOUND",
    "message": "Card not found"
  }
}

{
  "error": "A request with this idempotency key is already being processed"
}

{
  "error": "Idempotency key already used with a different request body"
}