From e7cb96d8a542c941f928d19f3d95a038ccbd43db Mon Sep 17 00:00:00 2001
From: "kernel-internal[bot]"
 <260533166+kernel-internal[bot]@users.noreply.github.com>
Date: Mon, 9 Nov 2026 04:15:30 +0000
Subject: [PATCH 1/2] feat: Add server-to-server card ingest for Kernel wallets

Stainless-Generated-From: b1128ae3997c8cc46f2bcd3d333a47324fa78cf7
---
 src/kernel/resources/vaults/items.py          | 120 ++++++++++++------
 ...thod_vault_item_operation_request_param.py |   9 +-
 ...ment_method_vault_item_operation_result.py |   2 +-
 .../vaults/item_perform_operation_params.py   |   7 +
 .../types/vaults/vault_payment_method.py      |  47 +++++--
 tests/api_resources/vaults/test_items.py      |  22 ++++
 6 files changed, 158 insertions(+), 49 deletions(-)

diff --git a/src/kernel/resources/vaults/items.py b/src/kernel/resources/vaults/items.py
index 35c1669e..35400c02 100644
--- a/src/kernel/resources/vaults/items.py
+++ b/src/kernel/resources/vaults/items.py
@@ -518,7 +518,8 @@ def perform_operation(
         a failure, an `unknown` outcome, or a transport error.
 
         Connected Kernel wallets may advertise add_payment_method, which returns a
-        single-use hosted card_enrollment link for a card, and remove_payment_method,
+        single-use hosted card_enrollment link for a card, or with enrollment server a
+        single-use card_ingest URL for the card's issuer, and remove_payment_method,
         which removes one card without affecting the others. Both operations require
         vaults:write in addition to vaults:use on the vault for scoped API keys, and
         return 403 without both permissions.
@@ -583,7 +584,8 @@ def perform_operation(
         a failure, an `unknown` outcome, or a transport error.
 
         Connected Kernel wallets may advertise add_payment_method, which returns a
-        single-use hosted card_enrollment link for a card, and remove_payment_method,
+        single-use hosted card_enrollment link for a card, or with enrollment server a
+        single-use card_ingest URL for the card's issuer, and remove_payment_method,
         which removes one card without affecting the others. Both operations require
         vaults:write in addition to vaults:use on the vault for scoped API keys, and
         return 403 without both permissions.
@@ -653,7 +655,8 @@ def perform_operation(
         a failure, an `unknown` outcome, or a transport error.
 
         Connected Kernel wallets may advertise add_payment_method, which returns a
-        single-use hosted card_enrollment link for a card, and remove_payment_method,
+        single-use hosted card_enrollment link for a card, or with enrollment server a
+        single-use card_ingest URL for the card's issuer, and remove_payment_method,
         which removes one card without affecting the others. Both operations require
         vaults:write in addition to vaults:use on the vault for scoped API keys, and
         return 403 without both permissions.
@@ -730,7 +733,8 @@ def perform_operation(
         a failure, an `unknown` outcome, or a transport error.
 
         Connected Kernel wallets may advertise add_payment_method, which returns a
-        single-use hosted card_enrollment link for a card, and remove_payment_method,
+        single-use hosted card_enrollment link for a card, or with enrollment server a
+        single-use card_ingest URL for the card's issuer, and remove_payment_method,
         which removes one card without affecting the others. Both operations require
         vaults:write in addition to vaults:use on the vault for scoped API keys, and
         return 403 without both permissions.
@@ -791,7 +795,8 @@ def perform_operation(
         a failure, an `unknown` outcome, or a transport error.
 
         Connected Kernel wallets may advertise add_payment_method, which returns a
-        single-use hosted card_enrollment link for a card, and remove_payment_method,
+        single-use hosted card_enrollment link for a card, or with enrollment server a
+        single-use card_ingest URL for the card's issuer, and remove_payment_method,
         which removes one card without affecting the others. Both operations require
         vaults:write in addition to vaults:use on the vault for scoped API keys, and
         return 403 without both permissions.
@@ -861,7 +866,8 @@ def perform_operation(
         a failure, an `unknown` outcome, or a transport error.
 
         Connected Kernel wallets may advertise add_payment_method, which returns a
-        single-use hosted card_enrollment link for a card, and remove_payment_method,
+        single-use hosted card_enrollment link for a card, or with enrollment server a
+        single-use card_ingest URL for the card's issuer, and remove_payment_method,
         which removes one card without affecting the others. Both operations require
         vaults:write in addition to vaults:use on the vault for scoped API keys, and
         return 403 without both permissions.
@@ -942,7 +948,8 @@ def perform_operation(
         a failure, an `unknown` outcome, or a transport error.
 
         Connected Kernel wallets may advertise add_payment_method, which returns a
-        single-use hosted card_enrollment link for a card, and remove_payment_method,
+        single-use hosted card_enrollment link for a card, or with enrollment server a
+        single-use card_ingest URL for the card's issuer, and remove_payment_method,
         which removes one card without affecting the others. Both operations require
         vaults:write in addition to vaults:use on the vault for scoped API keys, and
         return 403 without both permissions.
@@ -1008,7 +1015,8 @@ def perform_operation(
         a failure, an `unknown` outcome, or a transport error.
 
         Connected Kernel wallets may advertise add_payment_method, which returns a
-        single-use hosted card_enrollment link for a card, and remove_payment_method,
+        single-use hosted card_enrollment link for a card, or with enrollment server a
+        single-use card_ingest URL for the card's issuer, and remove_payment_method,
         which removes one card without affecting the others. Both operations require
         vaults:write in addition to vaults:use on the vault for scoped API keys, and
         return 403 without both permissions.
@@ -1075,7 +1083,8 @@ def perform_operation(
         a failure, an `unknown` outcome, or a transport error.
 
         Connected Kernel wallets may advertise add_payment_method, which returns a
-        single-use hosted card_enrollment link for a card, and remove_payment_method,
+        single-use hosted card_enrollment link for a card, or with enrollment server a
+        single-use card_ingest URL for the card's issuer, and remove_payment_method,
         which removes one card without affecting the others. Both operations require
         vaults:write in addition to vaults:use on the vault for scoped API keys, and
         return 403 without both permissions.
@@ -1143,7 +1152,8 @@ def perform_operation(
         a failure, an `unknown` outcome, or a transport error.
 
         Connected Kernel wallets may advertise add_payment_method, which returns a
-        single-use hosted card_enrollment link for a card, and remove_payment_method,
+        single-use hosted card_enrollment link for a card, or with enrollment server a
+        single-use card_ingest URL for the card's issuer, and remove_payment_method,
         which removes one card without affecting the others. Both operations require
         vaults:write in addition to vaults:use on the vault for scoped API keys, and
         return 403 without both permissions.
@@ -1204,7 +1214,8 @@ def perform_operation(
         a failure, an `unknown` outcome, or a transport error.
 
         Connected Kernel wallets may advertise add_payment_method, which returns a
-        single-use hosted card_enrollment link for a card, and remove_payment_method,
+        single-use hosted card_enrollment link for a card, or with enrollment server a
+        single-use card_ingest URL for the card's issuer, and remove_payment_method,
         which removes one card without affecting the others. Both operations require
         vaults:write in addition to vaults:use on the vault for scoped API keys, and
         return 403 without both permissions.
@@ -1269,7 +1280,8 @@ def perform_operation(
         a failure, an `unknown` outcome, or a transport error.
 
         Connected Kernel wallets may advertise add_payment_method, which returns a
-        single-use hosted card_enrollment link for a card, and remove_payment_method,
+        single-use hosted card_enrollment link for a card, or with enrollment server a
+        single-use card_ingest URL for the card's issuer, and remove_payment_method,
         which removes one card without affecting the others. Both operations require
         vaults:write in addition to vaults:use on the vault for scoped API keys, and
         return 403 without both permissions.
@@ -1342,7 +1354,8 @@ def perform_operation(
         a failure, an `unknown` outcome, or a transport error.
 
         Connected Kernel wallets may advertise add_payment_method, which returns a
-        single-use hosted card_enrollment link for a card, and remove_payment_method,
+        single-use hosted card_enrollment link for a card, or with enrollment server a
+        single-use card_ingest URL for the card's issuer, and remove_payment_method,
         which removes one card without affecting the others. Both operations require
         vaults:write in addition to vaults:use on the vault for scoped API keys, and
         return 403 without both permissions.
@@ -1404,7 +1417,8 @@ def perform_operation(
         a failure, an `unknown` outcome, or a transport error.
 
         Connected Kernel wallets may advertise add_payment_method, which returns a
-        single-use hosted card_enrollment link for a card, and remove_payment_method,
+        single-use hosted card_enrollment link for a card, or with enrollment server a
+        single-use card_ingest URL for the card's issuer, and remove_payment_method,
         which removes one card without affecting the others. Both operations require
         vaults:write in addition to vaults:use on the vault for scoped API keys, and
         return 403 without both permissions.
@@ -1467,7 +1481,8 @@ def perform_operation(
         a failure, an `unknown` outcome, or a transport error.
 
         Connected Kernel wallets may advertise add_payment_method, which returns a
-        single-use hosted card_enrollment link for a card, and remove_payment_method,
+        single-use hosted card_enrollment link for a card, or with enrollment server a
+        single-use card_ingest URL for the card's issuer, and remove_payment_method,
         which removes one card without affecting the others. Both operations require
         vaults:write in addition to vaults:use on the vault for scoped API keys, and
         return 403 without both permissions.
@@ -1533,7 +1548,8 @@ def perform_operation(
         a failure, an `unknown` outcome, or a transport error.
 
         Connected Kernel wallets may advertise add_payment_method, which returns a
-        single-use hosted card_enrollment link for a card, and remove_payment_method,
+        single-use hosted card_enrollment link for a card, or with enrollment server a
+        single-use card_ingest URL for the card's issuer, and remove_payment_method,
         which removes one card without affecting the others. Both operations require
         vaults:write in addition to vaults:use on the vault for scoped API keys, and
         return 403 without both permissions.
@@ -1572,6 +1588,7 @@ def perform_operation(
         *,
         id_or_name: str,
         type: Literal["add_payment_method"],
+        enrollment: Literal["hosted", "server"] | Omit = omit,
         # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
         # The extra values given here take precedence over values defined on the client or passed to this method.
         extra_headers: Headers | None = None,
@@ -1607,12 +1624,16 @@ def perform_operation(
         a failure, an `unknown` outcome, or a transport error.
 
         Connected Kernel wallets may advertise add_payment_method, which returns a
-        single-use hosted card_enrollment link for a card, and remove_payment_method,
+        single-use hosted card_enrollment link for a card, or with enrollment server a
+        single-use card_ingest URL for the card's issuer, and remove_payment_method,
         which removes one card without affecting the others. Both operations require
         vaults:write in addition to vaults:use on the vault for scoped API keys, and
         return 403 without both permissions.
 
         Args:
+          enrollment: hosted returns a card_enrollment link for the cardholder. server returns a
+              card_ingest URL for the card's issuer to post the card to server to server.
+
           extra_headers: Send extra headers
 
           extra_query: Add additional query parameters to the request
@@ -1668,7 +1689,8 @@ def perform_operation(
         a failure, an `unknown` outcome, or a transport error.
 
         Connected Kernel wallets may advertise add_payment_method, which returns a
-        single-use hosted card_enrollment link for a card, and remove_payment_method,
+        single-use hosted card_enrollment link for a card, or with enrollment server a
+        single-use card_ingest URL for the card's issuer, and remove_payment_method,
         which removes one card without affecting the others. Both operations require
         vaults:write in addition to vaults:use on the vault for scoped API keys, and
         return 403 without both permissions.
@@ -1750,6 +1772,7 @@ def perform_operation(
         input: Dict[str, object] | Omit = omit,
         tool_ref: str | Omit = omit,
         timeout_sec: int | Omit = omit,
+        enrollment: Literal["hosted", "server"] | Omit = omit,
         payment_method_id: str | Omit = omit,
         # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
         # The extra values given here take precedence over values defined on the client or passed to this method.
@@ -1796,6 +1819,7 @@ def perform_operation(
                         "input": input,
                         "tool_ref": tool_ref,
                         "timeout_sec": timeout_sec,
+                        "enrollment": enrollment,
                         "payment_method_id": payment_method_id,
                     },
                     item_perform_operation_params.ItemPerformOperationParams,
@@ -2585,7 +2609,8 @@ async def perform_operation(
         a failure, an `unknown` outcome, or a transport error.
 
         Connected Kernel wallets may advertise add_payment_method, which returns a
-        single-use hosted card_enrollment link for a card, and remove_payment_method,
+        single-use hosted card_enrollment link for a card, or with enrollment server a
+        single-use card_ingest URL for the card's issuer, and remove_payment_method,
         which removes one card without affecting the others. Both operations require
         vaults:write in addition to vaults:use on the vault for scoped API keys, and
         return 403 without both permissions.
@@ -2650,7 +2675,8 @@ async def perform_operation(
         a failure, an `unknown` outcome, or a transport error.
 
         Connected Kernel wallets may advertise add_payment_method, which returns a
-        single-use hosted card_enrollment link for a card, and remove_payment_method,
+        single-use hosted card_enrollment link for a card, or with enrollment server a
+        single-use card_ingest URL for the card's issuer, and remove_payment_method,
         which removes one card without affecting the others. Both operations require
         vaults:write in addition to vaults:use on the vault for scoped API keys, and
         return 403 without both permissions.
@@ -2720,7 +2746,8 @@ async def perform_operation(
         a failure, an `unknown` outcome, or a transport error.
 
         Connected Kernel wallets may advertise add_payment_method, which returns a
-        single-use hosted card_enrollment link for a card, and remove_payment_method,
+        single-use hosted card_enrollment link for a card, or with enrollment server a
+        single-use card_ingest URL for the card's issuer, and remove_payment_method,
         which removes one card without affecting the others. Both operations require
         vaults:write in addition to vaults:use on the vault for scoped API keys, and
         return 403 without both permissions.
@@ -2797,7 +2824,8 @@ async def perform_operation(
         a failure, an `unknown` outcome, or a transport error.
 
         Connected Kernel wallets may advertise add_payment_method, which returns a
-        single-use hosted card_enrollment link for a card, and remove_payment_method,
+        single-use hosted card_enrollment link for a card, or with enrollment server a
+        single-use card_ingest URL for the card's issuer, and remove_payment_method,
         which removes one card without affecting the others. Both operations require
         vaults:write in addition to vaults:use on the vault for scoped API keys, and
         return 403 without both permissions.
@@ -2858,7 +2886,8 @@ async def perform_operation(
         a failure, an `unknown` outcome, or a transport error.
 
         Connected Kernel wallets may advertise add_payment_method, which returns a
-        single-use hosted card_enrollment link for a card, and remove_payment_method,
+        single-use hosted card_enrollment link for a card, or with enrollment server a
+        single-use card_ingest URL for the card's issuer, and remove_payment_method,
         which removes one card without affecting the others. Both operations require
         vaults:write in addition to vaults:use on the vault for scoped API keys, and
         return 403 without both permissions.
@@ -2928,7 +2957,8 @@ async def perform_operation(
         a failure, an `unknown` outcome, or a transport error.
 
         Connected Kernel wallets may advertise add_payment_method, which returns a
-        single-use hosted card_enrollment link for a card, and remove_payment_method,
+        single-use hosted card_enrollment link for a card, or with enrollment server a
+        single-use card_ingest URL for the card's issuer, and remove_payment_method,
         which removes one card without affecting the others. Both operations require
         vaults:write in addition to vaults:use on the vault for scoped API keys, and
         return 403 without both permissions.
@@ -3009,7 +3039,8 @@ async def perform_operation(
         a failure, an `unknown` outcome, or a transport error.
 
         Connected Kernel wallets may advertise add_payment_method, which returns a
-        single-use hosted card_enrollment link for a card, and remove_payment_method,
+        single-use hosted card_enrollment link for a card, or with enrollment server a
+        single-use card_ingest URL for the card's issuer, and remove_payment_method,
         which removes one card without affecting the others. Both operations require
         vaults:write in addition to vaults:use on the vault for scoped API keys, and
         return 403 without both permissions.
@@ -3075,7 +3106,8 @@ async def perform_operation(
         a failure, an `unknown` outcome, or a transport error.
 
         Connected Kernel wallets may advertise add_payment_method, which returns a
-        single-use hosted card_enrollment link for a card, and remove_payment_method,
+        single-use hosted card_enrollment link for a card, or with enrollment server a
+        single-use card_ingest URL for the card's issuer, and remove_payment_method,
         which removes one card without affecting the others. Both operations require
         vaults:write in addition to vaults:use on the vault for scoped API keys, and
         return 403 without both permissions.
@@ -3142,7 +3174,8 @@ async def perform_operation(
         a failure, an `unknown` outcome, or a transport error.
 
         Connected Kernel wallets may advertise add_payment_method, which returns a
-        single-use hosted card_enrollment link for a card, and remove_payment_method,
+        single-use hosted card_enrollment link for a card, or with enrollment server a
+        single-use card_ingest URL for the card's issuer, and remove_payment_method,
         which removes one card without affecting the others. Both operations require
         vaults:write in addition to vaults:use on the vault for scoped API keys, and
         return 403 without both permissions.
@@ -3210,7 +3243,8 @@ async def perform_operation(
         a failure, an `unknown` outcome, or a transport error.
 
         Connected Kernel wallets may advertise add_payment_method, which returns a
-        single-use hosted card_enrollment link for a card, and remove_payment_method,
+        single-use hosted card_enrollment link for a card, or with enrollment server a
+        single-use card_ingest URL for the card's issuer, and remove_payment_method,
         which removes one card without affecting the others. Both operations require
         vaults:write in addition to vaults:use on the vault for scoped API keys, and
         return 403 without both permissions.
@@ -3271,7 +3305,8 @@ async def perform_operation(
         a failure, an `unknown` outcome, or a transport error.
 
         Connected Kernel wallets may advertise add_payment_method, which returns a
-        single-use hosted card_enrollment link for a card, and remove_payment_method,
+        single-use hosted card_enrollment link for a card, or with enrollment server a
+        single-use card_ingest URL for the card's issuer, and remove_payment_method,
         which removes one card without affecting the others. Both operations require
         vaults:write in addition to vaults:use on the vault for scoped API keys, and
         return 403 without both permissions.
@@ -3336,7 +3371,8 @@ async def perform_operation(
         a failure, an `unknown` outcome, or a transport error.
 
         Connected Kernel wallets may advertise add_payment_method, which returns a
-        single-use hosted card_enrollment link for a card, and remove_payment_method,
+        single-use hosted card_enrollment link for a card, or with enrollment server a
+        single-use card_ingest URL for the card's issuer, and remove_payment_method,
         which removes one card without affecting the others. Both operations require
         vaults:write in addition to vaults:use on the vault for scoped API keys, and
         return 403 without both permissions.
@@ -3409,7 +3445,8 @@ async def perform_operation(
         a failure, an `unknown` outcome, or a transport error.
 
         Connected Kernel wallets may advertise add_payment_method, which returns a
-        single-use hosted card_enrollment link for a card, and remove_payment_method,
+        single-use hosted card_enrollment link for a card, or with enrollment server a
+        single-use card_ingest URL for the card's issuer, and remove_payment_method,
         which removes one card without affecting the others. Both operations require
         vaults:write in addition to vaults:use on the vault for scoped API keys, and
         return 403 without both permissions.
@@ -3471,7 +3508,8 @@ async def perform_operation(
         a failure, an `unknown` outcome, or a transport error.
 
         Connected Kernel wallets may advertise add_payment_method, which returns a
-        single-use hosted card_enrollment link for a card, and remove_payment_method,
+        single-use hosted card_enrollment link for a card, or with enrollment server a
+        single-use card_ingest URL for the card's issuer, and remove_payment_method,
         which removes one card without affecting the others. Both operations require
         vaults:write in addition to vaults:use on the vault for scoped API keys, and
         return 403 without both permissions.
@@ -3534,7 +3572,8 @@ async def perform_operation(
         a failure, an `unknown` outcome, or a transport error.
 
         Connected Kernel wallets may advertise add_payment_method, which returns a
-        single-use hosted card_enrollment link for a card, and remove_payment_method,
+        single-use hosted card_enrollment link for a card, or with enrollment server a
+        single-use card_ingest URL for the card's issuer, and remove_payment_method,
         which removes one card without affecting the others. Both operations require
         vaults:write in addition to vaults:use on the vault for scoped API keys, and
         return 403 without both permissions.
@@ -3600,7 +3639,8 @@ async def perform_operation(
         a failure, an `unknown` outcome, or a transport error.
 
         Connected Kernel wallets may advertise add_payment_method, which returns a
-        single-use hosted card_enrollment link for a card, and remove_payment_method,
+        single-use hosted card_enrollment link for a card, or with enrollment server a
+        single-use card_ingest URL for the card's issuer, and remove_payment_method,
         which removes one card without affecting the others. Both operations require
         vaults:write in addition to vaults:use on the vault for scoped API keys, and
         return 403 without both permissions.
@@ -3639,6 +3679,7 @@ async def perform_operation(
         *,
         id_or_name: str,
         type: Literal["add_payment_method"],
+        enrollment: Literal["hosted", "server"] | Omit = omit,
         # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
         # The extra values given here take precedence over values defined on the client or passed to this method.
         extra_headers: Headers | None = None,
@@ -3674,12 +3715,16 @@ async def perform_operation(
         a failure, an `unknown` outcome, or a transport error.
 
         Connected Kernel wallets may advertise add_payment_method, which returns a
-        single-use hosted card_enrollment link for a card, and remove_payment_method,
+        single-use hosted card_enrollment link for a card, or with enrollment server a
+        single-use card_ingest URL for the card's issuer, and remove_payment_method,
         which removes one card without affecting the others. Both operations require
         vaults:write in addition to vaults:use on the vault for scoped API keys, and
         return 403 without both permissions.
 
         Args:
+          enrollment: hosted returns a card_enrollment link for the cardholder. server returns a
+              card_ingest URL for the card's issuer to post the card to server to server.
+
           extra_headers: Send extra headers
 
           extra_query: Add additional query parameters to the request
@@ -3735,7 +3780,8 @@ async def perform_operation(
         a failure, an `unknown` outcome, or a transport error.
 
         Connected Kernel wallets may advertise add_payment_method, which returns a
-        single-use hosted card_enrollment link for a card, and remove_payment_method,
+        single-use hosted card_enrollment link for a card, or with enrollment server a
+        single-use card_ingest URL for the card's issuer, and remove_payment_method,
         which removes one card without affecting the others. Both operations require
         vaults:write in addition to vaults:use on the vault for scoped API keys, and
         return 403 without both permissions.
@@ -3817,6 +3863,7 @@ async def perform_operation(
         input: Dict[str, object] | Omit = omit,
         tool_ref: str | Omit = omit,
         timeout_sec: int | Omit = omit,
+        enrollment: Literal["hosted", "server"] | Omit = omit,
         payment_method_id: str | Omit = omit,
         # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
         # The extra values given here take precedence over values defined on the client or passed to this method.
@@ -3863,6 +3910,7 @@ async def perform_operation(
                         "input": input,
                         "tool_ref": tool_ref,
                         "timeout_sec": timeout_sec,
+                        "enrollment": enrollment,
                         "payment_method_id": payment_method_id,
                     },
                     item_perform_operation_params.ItemPerformOperationParams,
diff --git a/src/kernel/types/vaults/add_payment_method_vault_item_operation_request_param.py b/src/kernel/types/vaults/add_payment_method_vault_item_operation_request_param.py
index ad7bde5d..39057fbe 100644
--- a/src/kernel/types/vaults/add_payment_method_vault_item_operation_request_param.py
+++ b/src/kernel/types/vaults/add_payment_method_vault_item_operation_request_param.py
@@ -9,7 +9,14 @@
 
 class AddPaymentMethodVaultItemOperationRequestParam(TypedDict, total=False):
     """
-    Start hosted enrollment of a card in a connected Kernel wallet, including its first card, only when the wallet advertises add_payment_method. Returns a new payment method in pending_enrollment with a single-use card_enrollment URL for the cardholder. Card details go directly to the card vault and are never accepted by this API. Each call creates a separate link that expires after 30 minutes; a failed or expired enrollment does not affect the wallet's other payment methods. Scoped API keys require vaults:write in addition to vaults:use on this vault; otherwise the operation returns 403.
+    Start enrollment of a card in a connected Kernel wallet, including its first card, only when the wallet advertises add_payment_method. Returns a new payment method in pending_enrollment with a single-use action. Card details go directly to the card vault and are never accepted by this API. With enrollment hosted (the default) the action is a card_enrollment URL for the cardholder, which expires after 30 minutes. With enrollment server the action is a card_ingest URL that the card's issuer posts the card to from its backend, which expires after 5 minutes; server enrollment returns 409 when it is not configured for the organization's card backend. A failed or expired enrollment does not affect the wallet's other payment methods. Scoped API keys require vaults:write in addition to vaults:use on this vault; otherwise the operation returns 403.
     """
 
     type: Required[Literal["add_payment_method"]]
+
+    enrollment: Literal["hosted", "server"]
+    """hosted returns a card_enrollment link for the cardholder.
+
+    server returns a card_ingest URL for the card's issuer to post the card to
+    server to server.
+    """
diff --git a/src/kernel/types/vaults/add_payment_method_vault_item_operation_result.py b/src/kernel/types/vaults/add_payment_method_vault_item_operation_result.py
index a858ed3d..0803b61e 100644
--- a/src/kernel/types/vaults/add_payment_method_vault_item_operation_result.py
+++ b/src/kernel/types/vaults/add_payment_method_vault_item_operation_result.py
@@ -11,7 +11,7 @@
 class AddPaymentMethodVaultItemOperationResult(BaseModel):
     """The payment method created in pending_enrollment.
 
-    Deliver action.url to the cardholder; it is a single-use capability and must not be logged. Observe completion through the wallet's payment_methods expansion.
+    Deliver a card_enrollment action.url to the cardholder; it is a single-use capability and must not be logged. A card_ingest action.url is posted to by the card's issuer. Observe completion through the wallet's payment_methods expansion.
     """
 
     payment_method: VaultPaymentMethod
diff --git a/src/kernel/types/vaults/item_perform_operation_params.py b/src/kernel/types/vaults/item_perform_operation_params.py
index 96977cc4..094c3aa9 100644
--- a/src/kernel/types/vaults/item_perform_operation_params.py
+++ b/src/kernel/types/vaults/item_perform_operation_params.py
@@ -314,6 +314,13 @@ class AddPaymentMethodVaultItemOperationRequest(TypedDict, total=False):
 
     type: Required[Literal["add_payment_method"]]
 
+    enrollment: Literal["hosted", "server"]
+    """hosted returns a card_enrollment link for the cardholder.
+
+    server returns a card_ingest URL for the card's issuer to post the card to
+    server to server.
+    """
+
 
 class RemovePaymentMethodVaultItemOperationRequest(TypedDict, total=False):
     id_or_name: Required[str]
diff --git a/src/kernel/types/vaults/vault_payment_method.py b/src/kernel/types/vaults/vault_payment_method.py
index 6b0d6dc1..5591e8f5 100644
--- a/src/kernel/types/vaults/vault_payment_method.py
+++ b/src/kernel/types/vaults/vault_payment_method.py
@@ -33,15 +33,20 @@ class Display(BaseModel):
 
 
 class Action(BaseModel):
-    name: Literal["card_enrollment"]
+    """The open enrollment of a pending payment method.
+
+    card_enrollment is a single-use hosted link for the cardholder. card_ingest is a single-use URL on a Kernel ingest hostname served by the card vault, which the card's issuer posts the card to from its backend; Kernel never receives the card number or CVC.
+    """
+
+    name: Literal["card_enrollment", "card_ingest"]
 
     url: str
 
     capture_token: Optional[str] = None
     """Secret bearer capability for embedded card capture with @onkernel/vault-react.
 
-    Present only for Kernel wallets; never for AgentCard. Treat it like the
-    enrollment URL and do not log or persist it in browser storage.
+    Present only on card_enrollment for Kernel wallets; never for AgentCard. Treat
+    it like the enrollment URL and do not log or persist it in browser storage.
     """
 
 
@@ -71,20 +76,40 @@ class VaultPaymentMethod(BaseModel):
     """Provider-neutral payment-method type normalized to lowercase."""
 
     action: Optional[Action] = None
+    """The open enrollment of a pending payment method.
+
+    card_enrollment is a single-use hosted link for the cardholder. card_ingest is a
+    single-use URL on a Kernel ingest hostname served by the card vault, which the
+    card's issuer posts the card to from its backend; Kernel never receives the card
+    number or CVC.
+    """
 
     expires_at: Optional[datetime] = None
-    """Expiry of a pending enrollment link."""
+    """Expiry of a pending enrollment link or ingest URL."""
+
+    issuer_reference: Optional[str] = None
+    """Kernel wallets only.
+
+    The issuer's reference for a card it pushed with a card_ingest URL.
+    """
 
     status: Optional[Literal["pending_enrollment", "active", "removal_pending", "recovery_required"]] = None
     """Kernel wallets only.
 
-    pending_enrollment means a card_enrollment link is open; active means the card
-    is stored and can pay when capabilities.single_use_card.eligible is true;
-    removal_pending means removal started but the provider outcome is unknown, so
-    retry remove_payment_method; recovery_required means either an enrollment
-    outcome is unknown (remove the method), or the stored card cannot be read
-    (contact support; removal is refused with 409). Consult status_reason to
-    distinguish these cases. Absent for other providers.
+    pending_enrollment means a card_enrollment link or card_ingest URL is open;
+    active means the card is stored and can pay when
+    capabilities.single_use_card.eligible is true; removal_pending means removal
+    started but the provider outcome is unknown, so retry remove_payment_method;
+    recovery_required means either an enrollment outcome is unknown (remove the
+    method), or the stored card cannot be read (contact support; removal is refused
+    with 409). Consult status_reason to distinguish these cases. Absent for other
+    providers.
     """
 
     status_reason: Optional[str] = None
+
+    valid_until: Optional[datetime] = None
+    """Kernel wallets only.
+
+    When a card pushed with a card_ingest URL stops being usable, as its issuer set.
+    """
diff --git a/tests/api_resources/vaults/test_items.py b/tests/api_resources/vaults/test_items.py
index 36bd1d18..4a474b16 100644
--- a/tests/api_resources/vaults/test_items.py
+++ b/tests/api_resources/vaults/test_items.py
@@ -1947,6 +1947,17 @@ def test_method_perform_operation_overload_17(self, client: Kernel) -> None:
         )
         assert_matches_type(VaultItemOperationResponse, item, path=["response"])
 
+    @pytest.mark.skip(reason="Mock server tests are disabled")
+    @parametrize
+    def test_method_perform_operation_with_all_params_overload_17(self, client: Kernel) -> None:
+        item = client.vaults.items.perform_operation(
+            key="key",
+            id_or_name="id_or_name",
+            type="add_payment_method",
+            enrollment="hosted",
+        )
+        assert_matches_type(VaultItemOperationResponse, item, path=["response"])
+
     @pytest.mark.skip(reason="Mock server tests are disabled")
     @parametrize
     def test_raw_response_perform_operation_overload_17(self, client: Kernel) -> None:
@@ -4630,6 +4641,17 @@ async def test_method_perform_operation_overload_17(self, async_client: AsyncKer
         )
         assert_matches_type(VaultItemOperationResponse, item, path=["response"])
 
+    @pytest.mark.skip(reason="Mock server tests are disabled")
+    @parametrize
+    async def test_method_perform_operation_with_all_params_overload_17(self, async_client: AsyncKernel) -> None:
+        item = await async_client.vaults.items.perform_operation(
+            key="key",
+            id_or_name="id_or_name",
+            type="add_payment_method",
+            enrollment="hosted",
+        )
+        assert_matches_type(VaultItemOperationResponse, item, path=["response"])
+
     @pytest.mark.skip(reason="Mock server tests are disabled")
     @parametrize
     async def test_raw_response_perform_operation_overload_17(self, async_client: AsyncKernel) -> None:

From 4d56021ed18b7ffde53c1788dde8c564a626a2d3 Mon Sep 17 00:00:00 2001
From: "kernel-internal[bot]"
 <260533166+kernel-internal[bot]@users.noreply.github.com>
Date: Mon, 9 Nov 2026 04:19:30 +0000
Subject: [PATCH 2/2] release: 0.144.0

---
 .release-please-manifest.json | 2 +-
 CHANGELOG.md                  | 7 +++++++
 pyproject.toml                | 2 +-
 src/kernel/_version.py        | 2 +-
 4 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index 176e8d6e..ac481180 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "0.143.0"
+  ".": "0.144.0"
 }
\ No newline at end of file
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 03b49058..d2c65f1d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.144.0](https://github.com/kernel/kernel-python-sdk/compare/v0.143.0...v0.144.0) (2026-11-09)
+
+
+### Features
+
+* Add server-to-server card ingest for Kernel wallets ([e7cb96d](https://github.com/kernel/kernel-python-sdk/commit/e7cb96d8a542c941f928d19f3d95a038ccbd43db))
+
 ## [0.143.0](https://github.com/kernel/kernel-python-sdk/compare/v0.142.0...v0.143.0) (2026-11-07)
 
 
diff --git a/pyproject.toml b/pyproject.toml
index 701abbd7..a1655c12 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "kernel"
-version = "0.143.0"
+version = "0.144.0"
 description = "The official Python library for the kernel API"
 dynamic = ["readme"]
 license = "Apache-2.0"
diff --git a/src/kernel/_version.py b/src/kernel/_version.py
index d1a0f054..d0bc22fa 100644
--- a/src/kernel/_version.py
+++ b/src/kernel/_version.py
@@ -1,4 +1,4 @@
 # File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
 
 __title__ = "kernel"
-__version__ = "0.143.0"  # x-release-please-version
+__version__ = "0.144.0"  # x-release-please-version