type VaultToken
A card or bank account held in the ClientLoop vault, referenced by an opaque token. A third party tokenizes an instrument once with 'vaultTokenizeCard' or 'vaultTokenizeBankAccount' and presents the token later in place of the account data.
A token is short-lived until it is used: one not used to create a payment or payment plan within an hour of being created is deleted, together with the instrument it holds. A token that has been used lives as long as the payment or plan needs it.
A vault token is not a stored payment method. It is optionally attached to an organization and to a contact, and carries no consent or recurring arrangement of its own; keeping an instrument on file for a contact is what 'PaymentMethod' is for. The account number itself is never returned: a token exposes the BIN, last four digits, expiration and brand of a card, or the routing number and last four digits of a bank account.
| Field | Type | Description |
|---|---|---|
id | ID! | Opaque id of the vault token. Refetch it with 'vaultToken(id:)'. |
orgId | ID | Organization the token belongs to: the one named when it was created, or an org API key's own organization. Null for a token a platform or agency key created without naming one, which belongs to that account instead. |
contactId | ID | ID of the contact the token is linked to, when one was given. |
contact | Contact | Contact the token is linked to, when one was given. |
type | VaultTokenType! | Whether the token stands for a card or a bank account. Determines which of 'card' and 'bankAccount' is populated. |
status | VaultTokenStatus! | Whether the instrument is still current: Active, or Expired once the token's expiresAt or the card's expiration date has passed. Deletion is reported by 'deletedAt', not here. |
card | VaultTokenCard | Card detail. Populated when type is Card, otherwise null. |
bankAccount | VaultTokenBankAccount | Bank account detail. Populated when type is BankAccount, otherwise null. |
billingAddress | GlobalAddress | Billing address captured alongside the instrument, when one was given. |
fingerprint | String | Stable, non-reversible identifier of the underlying card or account within the token's owner — the organization, or the platform or agency account an org-less token belongs to: the same instrument tokenized twice for that owner yields the same fingerprint, so a caller can recognise a repeat without seeing the number. |
externalRef | String | Caller-supplied reference for the token, external to the platform. Ex. an order or account id. |
expiresAt | DateTime | When the token is deleted unless it has been used to create a payment or payment plan by then: one hour after it was created. Null once the token has been used. A token past this time is removed outright rather than kept in a deleted state. |
deletedAt | DateTime | Set when the token has been deleted; null otherwise. A deleted token can no longer be used whatever its status says, and is excluded from listings unless 'includeDeleted' is set. |
createdAt | DateTime! | Date the token was created. |
updatedAt | DateTime! | Date the token was last updated. |