> ## Documentation Index > Fetch the complete documentation index at: https://www.kernel.sh/docs/llms.txt > Use this file to discover all available pages before exploring further. # Push a card into a Kernel wallet > Server-to-server enrollment of a card by its issuer. Post only to the card_ingest action URL that add_payment_method with enrollment server returned, never to the API host: that URL is served by the card vault, which replaces card.number and card.cvc with aliases before forwarding the request here, so Kernel never receives them. Requests that did not pass through the vault are refused. Authorization is Bearer with an API key of the wallet's organization that may add payment methods to the wallet. The URL is single use and expires after 5 minutes. Retrying the request that enrolled the card (same card and the same last4, network, issuer_reference and valid_until) returns 200 with the payment method, until the card's CVC is gone; after that the retry is refused and the card needs a new enrollment. The card's CVC funds only its first purchase, which can pay without a cardholder CVC page; Kernel keeps it for at most an hour, or until valid_until if sooner, so the push, the authorization and the fill must all happen within that window. Kernel does not bind the card to a merchant or an amount: any API key that may use the vault can spend it while its CVC is valid, so the issuer sets the card's limits. Request bodies are never logged. ## OpenAPI ````yaml https://api.onkernel.com/spec.json post /vault/card-ingest/{payment_method_id} openapi: 3.1.0 info: description: Developer tools and cloud infrastructure for AI agents to use web browsers title: Kernel API version: 0.1.0 servers: - description: API Server url: https://api.onkernel.com security: - bearerAuth: [] tags: - description: Search the web and retrieve content for selected results. name: Search - description: Create and manage browser sessions. name: Browsers - description: Control mouse, keyboard, and screen on the browser instance. name: Browser Computer Controls - description: >- Execute Playwright code against the browser instance and manage the executors it runs in. name: Browser Playwright - description: Execute JavaScript in the browser instance's persistent Browser REPL. name: Browser REPL - description: Discover and invoke native page tools across the browser instance. name: Browser WebMCP - description: Read, write, and manage files on the browser instance. name: Browser Filesystem - description: Execute and manage processes on the browser instance. name: Browser Processes - description: Record and manage browser session video replays. name: Browser Replays - description: Stream logs from the browser instance. name: Browser Logs - description: >- Stream live telemetry events from a browser session, and manage the destinations sessions export them to. name: Browser Telemetry - description: Create, list, retrieve, and delete browser profiles. name: Profiles - description: Create and manage proxy configurations for routing browser traffic. name: Proxies - description: Create, list, retrieve, and delete browser extensions. name: Extensions - description: Create and manage browser pools for acquiring and releasing browsers. name: Browser Pools - description: Inspect the identity and authorization context for the current request. name: Authentication - description: >- Create and manage auth connections for automated credential capture and login. name: Managed Auth - description: Create and manage credentials for authentication. name: Credentials - description: Configure external credential providers like 1Password. name: Credential Providers - description: List applications and versions. name: Apps - description: Create and manage app deployments and stream deployment events. name: Deployments - description: Invoke actions and stream or query invocation status and events. name: Invocations - description: Read and manage organization-level limits. name: Organization - description: Create and manage projects for resource isolation within an organization. name: Projects - description: Create and manage API keys for organization and project-scoped access. name: API Keys - description: Read audit log records for the authenticated organization. name: Audit Logs - description: Resolve browser and proxy recommendations for bot-protected sites. name: Config Registry paths: /vault/card-ingest/{payment_method_id}: post: tags: - Vaults summary: Push a card into a Kernel wallet description: >- Server-to-server enrollment of a card by its issuer. Post only to the card_ingest action URL that add_payment_method with enrollment server returned, never to the API host: that URL is served by the card vault, which replaces card.number and card.cvc with aliases before forwarding the request here, so Kernel never receives them. Requests that did not pass through the vault are refused. Authorization is Bearer with an API key of the wallet's organization that may add payment methods to the wallet. The URL is single use and expires after 5 minutes. Retrying the request that enrolled the card (same card and the same last4, network, issuer_reference and valid_until) returns 200 with the payment method, until the card's CVC is gone; after that the retry is refused and the card needs a new enrollment. The card's CVC funds only its first purchase, which can pay without a cardholder CVC page; Kernel keeps it for at most an hour, or until valid_until if sooner, so the push, the authorization and the fill must all happen within that window. Kernel does not bind the card to a merchant or an amount: any API key that may use the vault can spend it while its CVC is valid, so the issuer sets the card's limits. Request bodies are never logged. operationId: postVaultCardIngest parameters: - in: path name: payment_method_id required: true schema: type: string requestBody: content: application/json: examples: ingest: value: card: cvc: '123' exp_month: '09' exp_year: '2029' number: '4111111111111111' issuer_reference: ref_7781 last4: '1111' network: visa valid_until: '2026-11-02T18:00:00Z' schema: additionalProperties: false properties: card: additionalProperties: false properties: cvc: description: The card's CVC. The vault replaces it with an alias. type: string exp_month: pattern: ^(0[1-9]|1[0-2])$ type: string exp_year: pattern: ^[0-9]{4}$ type: string number: description: The card number. The vault replaces it with an alias. type: string required: - number - cvc - exp_month - exp_year type: object issuer_reference: description: The issuer's reference for the card pattern: ^[A-Za-z0-9._:-]{1,128}$ returned on the payment method.: null type: string last4: pattern: ^[0-9]{4}$ type: string network: description: Card network pattern: ^[a-z][a-z_-]{0,31}$ such as visa or mastercard.: null type: string valid_until: description: When the card stops being usable. Must be in the future. format: date-time type: string required: - card - network - last4 - valid_until type: object required: true responses: '200': content: application/json: examples: ingested: value: payment_method: capabilities: single_use_card: eligible: true reasons: [] display: brand: visa last4: '1111' id: q8w2h0a5n4e9zk3o1x7c6v2b is_default: false issuer_reference: ref_7781 provider: kernel status: active type: card valid_until: '2026-11-02T18:00:00Z' schema: properties: payment_method: $ref: '#/components/schemas/VaultPaymentMethod' required: - payment_method type: object description: The card is stored and the payment method is active. '401': content: application/json: schema: properties: code: enum: - unauthorized - enrollment_not_found - forbidden - enrollment_used - invalid_card - conflict - internal_error type: string message: type: string required: - code - message type: object description: unauthorized. The API key is missing or invalid. '403': content: application/json: schema: properties: code: enum: - unauthorized - enrollment_not_found - forbidden - enrollment_used - invalid_card - conflict - internal_error type: string message: type: string required: - code - message type: object description: >- forbidden. The request did not pass through the card vault, or the API key may not add payment methods to the wallet. '404': content: application/json: schema: properties: code: enum: - unauthorized - enrollment_not_found - forbidden - enrollment_used - invalid_card - conflict - internal_error type: string message: type: string required: - code - message type: object description: >- enrollment_not_found. The URL is unknown, expired or another organization's, or card ingest is not configured. '409': content: application/json: schema: properties: code: enum: - unauthorized - enrollment_not_found - forbidden - enrollment_used - invalid_card - conflict - internal_error type: string message: type: string required: - code - message type: object description: >- enrollment_used (the URL already enrolled a different card, or its card's CVC was used or expired, so the card needs a new enrollment), or conflict (the wallet cannot take the card now). '422': content: application/json: schema: properties: code: enum: - unauthorized - enrollment_not_found - forbidden - enrollment_used - invalid_card - conflict - internal_error type: string message: type: string required: - code - message type: object description: >- invalid_card. The request is not JSON, a field is missing or invalid, or a card value is not in the vault's alias format. '500': content: application/json: schema: properties: code: enum: - unauthorized - enrollment_not_found - forbidden - enrollment_used - invalid_card - conflict - internal_error type: string message: type: string required: - code - message type: object description: internal_error. The card could not be stored; retry the request. security: - bearerAuth: [] components: schemas: VaultPaymentMethod: additionalProperties: false properties: action: $ref: '#/components/schemas/VaultPaymentMethodAction' capabilities: $ref: '#/components/schemas/VaultPaymentMethodCapabilities' display: $ref: '#/components/schemas/VaultPaymentMethodDisplay' expires_at: description: Expiry of a pending enrollment link or ingest URL. format: date-time type: string id: type: string is_default: description: >- For Kernel wallets, true for the default card, ID card, which a Kernel card item that omits payment_method_id selects. Wallets created with payment methods enabled have no default card. type: boolean issuer_reference: description: >- Kernel wallets only. The issuer's reference for a card it pushed with a card_ingest URL. type: string provider: description: Provider that issued this payment-method ID. type: string status: description: >- Kernel wallets only. pending_enrollment means a card_enrollment link or card_ingest URL is open; active means the card is stored and can pay when capabilities.single_use_card.eligible is true; removal_pending means removal started but the provider outcome is unknown, so retry remove_payment_method; recovery_required means either an enrollment outcome is unknown (remove the method), or the stored card cannot be read (contact support; removal is refused with 409). Consult status_reason to distinguish these cases. Absent for other providers. enum: - pending_enrollment - active - removal_pending - recovery_required type: string status_reason: type: string type: description: Provider-neutral payment-method type normalized to lowercase. type: string valid_until: description: >- Kernel wallets only. When a card pushed with a card_ingest URL stops being usable, as its issuer set. format: date-time type: string required: - id - provider - type - is_default - display - capabilities type: object VaultPaymentMethodAction: additionalProperties: false description: >- The open enrollment of a pending payment method. card_enrollment is a single-use hosted link for the cardholder. card_ingest is a single-use URL on a Kernel ingest hostname served by the card vault, which the card's issuer posts the card to from its backend; Kernel never receives the card number or CVC. properties: capture_token: description: >- Secret bearer capability for embedded card capture with @onkernel/vault-react. Present only on card_enrollment for Kernel wallets; never for AgentCard. Treat it like the enrollment URL and do not log or persist it in browser storage. type: string name: enum: - card_enrollment - card_ingest type: string x-enum-varnames: - PaymentMethodActionCardEnrollment - PaymentMethodActionCardIngest url: format: uri type: string required: - name - url type: object VaultPaymentMethodCapabilities: additionalProperties: false description: >- Provider-reported advisory capabilities. A missing capability is unknown, not ineligible; only eligible=false is an explicit negative signal. properties: single_use_card: $ref: '#/components/schemas/VaultPaymentMethodCapability' type: object VaultPaymentMethodDisplay: additionalProperties: false properties: brand: type: string label: type: string last4: type: string type: object VaultPaymentMethodCapability: additionalProperties: false properties: eligible: type: boolean reasons: items: type: string type: array required: - eligible - reasons type: object securitySchemes: bearerAuth: scheme: bearer type: http ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.