API referenceBilling
`POST /billing/setup-intent` — start adding a card. **Owner-only** (financial root-of-trust). Provisions the org's Stripe customer on first use, then returns a SetupIntent `client_secret` the browser confirms with Stripe Elements (the card is vaulted + attached client-side; raw card never touches us).
curl -X POST "https://example.com/billing/setup-intent"{ "client_secret": "string"}`POST /auth/webauthn/start` — begin a passkey / security-key sign-in (`rh-kk6vbu`). Anonymous; the server runs Cognito's `USER_AUTH` flow with `PREFERRED_CHALLENGE=WEB_AUTHN` on the org's app client. POST
Every "no challenge" outcome — no key registered, unknown user, unknown org — is one 400 with one sentence, so this is no better an account oracle than the pool's `preventUserExistenceErrors` already allows. `Json` only, like `/auth/session` and for the same login-CSRF reason: a form post is a 415 before the handler runs.
`DELETE /billing/payment-methods/{id}` — detach a saved card from Stripe. **Owner-only**. DELETE
Next Page