Get member's wallet details
GET /api/members/{memberId}/wallet/gladstonepay
Success: 200 OK
- Products: Operator (
FOH), Consumer (CONSUMER) (any one of these products, not all) - Features: Online Bookings (
ONLINEBOOK), Online Joining (ONLINEJOIN), Front of House Generic Access (FOHGENERIC) (any one of these features, not all)
Overview
Lists every payment card held in a member's wallet at the payment provider.
Gladstone does not store card details itself. It links each member to a single wallet held by GladstonePay — Gladstone's integration with the CardStream payment gateway — and this endpoint fetches that wallet's cards from the provider. Every call goes out to the provider and asks for a freshly refreshed view rather than a stored copy, so treat it as a network round trip, not a cheap lookup.
Reach for it when you want to show a member their saved cards, and when you need the cardID values that the rest of the wallet API is defined in terms of: the id you pass to DELETE /api/members/{memberId}/wallet/gladstonepay/{cardId}, and the id you compare with rcpCardId from GET /api/members/{memberId}/rcp-card to work out which stored card is used for recurring payments.
The response body is the payment provider's own payload, passed through unchanged. The provider's wallet-cards response comes back with the same field names — no renaming, no filtering, no validation, no defaults. Gladstone holds no documentation for most of those fields, which is why most rows in the response table below are left blank rather than guessed at. None of the identifiers in the payload are Gladstone identifiers; they are the provider's own, and only cardID means anything to another Gladstone endpoint.
Treat every card entry as cardholder data. In particular, Gladstone does not document what number, token and mask actually contain for a given provider account — a masked number, a full number, or a provider token. Do not log them, do not persist them, and do not build a display or a comparison on an assumption about their contents until you have confirmed it against your own provider account and your PCI DSS scope.
What this endpoint does not do: it does not create a wallet — a member has no wallet until their first card is saved through POST /api/members/{memberId}/wallet/card, and until then this returns 404. It does not tell you which card is designated for recurring payments; that designation is held by Gladstone rather than by the provider, so neither data[].default nor the rtus… fields answer it and GET /api/members/{memberId}/rcp-card does. It accepts no paging, filtering or sorting parameters. And if a member somehow has more than one wallet linked, only the first one is used.
Endpoint
GET {base_url}/api/members/{memberId}/wallet/gladstonepay
{base_url} is the environment URL issued to your integration. See Authenticating with Gladstone APIs.
Path parameters
| Name | Type | Required | Description |
|---|---|---|---|
memberId | integer (int32) | Yes | The member whose stored cards you want. Must be the member identified by your access token, or a member linked to them; any other member is rejected with 403. The member must already have a wallet, which happens only once their first card has been saved through POST /api/members/{memberId}/wallet/card — otherwise you get 404. |
Sample request
curl -X GET '{base_url}/api/members/{memberId}/wallet/gladstonepay' \
-H 'Authorization: Bearer {accessToken}' \
-H 'X-Use-SSO: true'Response fields
| Field | Type | Description |
|---|---|---|
success | string | |
id | string | |
data | array of object | The cards stored in the member's wallet at the payment provider, one entry per card. This is the part of the response you want; the fields around it are the provider's envelope. A member with no wallet at all gets 404 rather than an empty list. |
data[].id | integer (int32) | |
data[].pid | integer (int32) | |
data[].type | string | |
data[].ptype | string | |
data[].uri | string | |
data[].puri | string | |
data[].path | string | |
data[].text | string | |
data[].cardID | integer (int32) | The provider's identifier for this stored card, and the only value in this response that another Gladstone endpoint understands. Pass it as {cardId} to DELETE /api/members/{memberId}/wallet/gladstonepay/{cardId}, and compare it with rcpCardId from GET /api/members/{memberId}/rcp-card — the same id, returned as a string there and an integer here — to identify the recurring payment card. Match on this field rather than on id: both of those endpoints are defined in terms of cardID. |
data[].cardUri | string | |
data[].cardName | string | |
data[].walletID | integer (int32) | The provider's identifier for the wallet this card sits in. Every entry in data comes from the same wallet — the one mapped to the member you asked for — so the value repeats across entries. You never need to send it anywhere: Gladstone's wallet endpoints are addressed by memberId, not by wallet id. |
data[].walletUri | string | |
data[].walletName | string | |
data[].customerID | integer (int32) | |
data[].customerUri | string | |
data[].customerName | string | |
data[].resellerID | integer (int32) | |
data[].resellerUri | string | |
data[].resellerName | string | |
data[].description | string | |
data[].typeCode | string | |
data[].typeName | string | |
data[].holder | string | The cardholder name the payment provider holds against the stored card. This is personal data, and how it is captured or normalised is not documented — so do not use it to match members, and do not treat it as an identity check. |
data[].number | string | |
data[].token | string | |
data[].mask | string | |
data[].expiryDate | string | The stored card's expiry date as the provider records it. It is returned as a string in a format that is not documented, so do not assume MM/YY, MMYY or ISO-8601 — inspect what your own provider account actually returns before parsing or comparing it. |
data[].startDate | string | |
data[].issueNumber | string | |
data[].duplicatesAllowed | string | |
data[].data | string | |
data[].default | string | Not the member's recurring payment card designation. That designation is held by Gladstone against the member's wallet and is read from GET /api/members/{memberId}/rcp-card; nothing in this payload carries it. |
data[].transactionID | integer (int32) | |
data[].transactionUri | string | |
data[].supersededByCardID | integer (int32) | |
data[].supersededByCardUri | string | |
data[].rtusEnabled | string | Part of the payment provider's own recurring-transaction settings for this card, which are not the same thing as the member's Gladstone recurring payment card — read that from GET /api/members/{memberId}/rcp-card. |
data[].rtusLastDate | string | |
data[].rtusNextDate | string | |
data[].rtusFrequency | integer (int32) | |
data[].rtusMerchantID | integer (int32) | |
data[].rtusPolicyRef | string | |
data[].rtusMerchantUri | string | |
data[].rtusMerchantName | string | |
data[].rtusUpdated | string | |
data[].rtusAcquirerResponseCode | string | |
data[].rtusSchemeResponseCode | string | |
data[].rtusResponseCode | integer (int32) | |
data[].rtusResponseMessage | string | |
data[].rtusState | string | |
data[].rtusFileID | integer (int32) | |
data[].rtusFileUri | string | |
data[].billingAddressID | integer (int32) | |
data[].billingAddressUri | string | |
data[].billingAddressName | string | |
data[].createdByUserID | integer (int32) | |
data[].createdByUserUri | string | |
data[].createdByUserName | string | |
data[].updatedByUserID | integer (int32) | |
data[].updatedByUserUri | string | |
data[].updatedByUserName | string | |
data[].createTime | string | |
data[].modifyTime | string | |
data[].status | string | |
data[].perm | integer (int32) | |
count | integer (int32) | A record count reported by the provider alongside data. The provider returns both count and total and how the two differ is not documented, so do not read either as a page size or a grand total — take the length of data when you need the number of cards you were actually given. |
total | integer (int32) | A second record count reported by the provider. How it differs from count is not documented, and this endpoint takes no paging parameters, so do not build paging on it. |
message | string | Text supplied by the provider alongside the result. It is load-bearing in one case: when the provider's wallet API answers 404, this value is the body of the 404 you receive. What, if anything, it holds on a successful response is not documented. |
Sample response
{
"success": "string",
"id": "string",
"data": [
{
"id": 12345,
"pid": 12345,
"type": "string",
"ptype": "string",
"uri": "string",
"puri": "string",
"path": "string",
"text": "string",
"cardID": 12345,
"cardUri": "string",
"cardName": "string",
"walletID": 12345,
"walletUri": "string",
"walletName": "string",
"customerID": 12345,
"customerUri": "string",
"customerName": "string",
"resellerID": 12345,
"resellerUri": "string",
"resellerName": "string",
"description": "string",
"typeCode": "string",
"typeName": "string",
"holder": "string",
"number": "string",
"token": "string",
"mask": "string",
"expiryDate": "string",
"startDate": "string",
"issueNumber": "string",
"duplicatesAllowed": "string",
"data": "string",
"default": "string",
"transactionID": 12345,
"transactionUri": "string",
"supersededByCardID": 12345,
"supersededByCardUri": "string",
"rtusEnabled": "string",
"rtusLastDate": "string",
"rtusNextDate": "string",
"rtusFrequency": 1,
"rtusMerchantID": 12345,
"rtusPolicyRef": "string",
"rtusMerchantUri": "string",
"rtusMerchantName": "string",
"rtusUpdated": "string",
"rtusAcquirerResponseCode": "string",
"rtusSchemeResponseCode": "string",
"rtusResponseCode": 1,
"rtusResponseMessage": "string",
"rtusState": "string",
"rtusFileID": 12345,
"rtusFileUri": "string",
"billingAddressID": 12345,
"billingAddressUri": "string",
"billingAddressName": "string",
"createdByUserID": 12345,
"createdByUserUri": "string",
"createdByUserName": "string",
"updatedByUserID": 12345,
"updatedByUserUri": "string",
"updatedByUserName": "string",
"createTime": "string",
"modifyTime": "string",
"status": "string",
"perm": 1
}
],
"count": 1,
"total": 1,
"message": "string"
}Errors
| Status | Meaning | When |
|---|---|---|
401 | Unauthorized | The payment provider's wallet API rejected the credentials configured for this tenant. The provider's own response body is passed straight through as the body of this error, so it may not read like a Gladstone message at all. Nothing about your request will change the outcome — the tenant's GladstonePay wallet credentials need correcting. |
404 | Not found | Either the member has no wallet — one exists only once their first card has been saved through POST /api/members/{memberId}/wallet/card — or the provider's wallet API returned 404 for the wallet id Gladstone holds for them, in which case the body is the message value from the provider's response. |
422 | Unprocessable entity | The tenant's GladstonePay wallet configuration is missing or incomplete — the wallet API URL, username or password. This is a Gladstone-side configuration fix, not something you can correct in the request. |
500 | Internal server error | Any other unexpected server-side failure, including the payment provider being unreachable and the provider returning a payload that cannot be parsed. The response has no body. |