curl https://api.onepay.la/v1/customers/session/payment-methods \
  -X POST \
  -H "Authorization: Bearer sk_test_xxx" \
  -H "X-Customer-Token: 12|a1b2c3d4e5f6..." \
  -H "Content-Type: application/json" \
  -d '{
    "token": "tok_1a2b3c4d5e6f"
  }'

const response = await fetch('https://api.onepay.la/v1/customers/session/payment-methods', {
  method: 'POST',
  headers: {
    'Authorization': 'Bearer sk_test_xxx',
    'X-Customer-Token': '12|a1b2c3d4e5f6...',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    token: 'tok_1a2b3c4d5e6f'
  })
});

const card = await response.json();

import requests

response = requests.post(
    'https://api.onepay.la/v1/customers/session/payment-methods',
    headers={
        'Authorization': 'Bearer sk_test_xxx',
        'X-Customer-Token': '12|a1b2c3d4e5f6...',
        'Content-Type': 'application/json'
    },
    json={
        'token': 'tok_1a2b3c4d5e6f'
    }
)

card = response.json()

{
  "id": "bb02b2fd-154c-4c90-9fdf-cec3a0b25cf5",
  "brand": "visa",
  "last_four": "4242",
  "label": "Visa ····4242"
}

{
  "message": "El campo token es obligatorio.",
  "errors": {
    "token": [
      "El campo token es obligatorio."
    ]
  }
}

{
  "message": "Token de sesión inválido o expirado."
}