# Update a card

Update a linked card and/or resubmit it for verification.

If a value is provided for CVV, a new verification ($0 authorization) will be submitted for the card. Updating the expiration date or address will update the information stored on file for the card but will not be verified.

Read our [accept card payments guide](https://docs.moov.io/guides/sources/cards/accept-card-payments/#reverify-a-card) to learn more.

Only use this endpoint if you have provided Moov with a copy of your PCI attestation of compliance.

To access this endpoint using an [access token](https://docs.moov.io/api/authentication/access-tokens/) you'll need to specify the `/accounts/{accountID}/cards.write` scope.

## PATCH

/accounts/{accountID}/cards/{cardID}

```shell
curl -X PATCH "https://api.moov.io/accounts/{accountID}/cards/{cardID}" \
  -H "Authorization: Bearer {token}" \
  -H "X-Moov-Version: v2026.07.00" \
  -d '{
  "cardCvv": "456"
}'
```

```go
mc, _ := moov.NewClient()

var accountID string
var cardID string

mc.UpdateCard(ctx, accountID, cardID,
  moov.WithCardOnFile(true),
)
```

```typescript
import { Moov } from "@moovio/sdk";

const moov = new Moov({
  security: {
    username: "",
    password: "",
  },
});

async function run() {
  const result = await moov.cards.update({
    accountID: "7104688e-8434-482e-9556-4784be3ad3fe",
    cardID: "01234567-89ab-cdef-0123-456789abcdef",
    updateCard: {
      cardCvv: "456",
    },
  });

console.log(result);
}

run();
```

```php
declare(strict_types=1);

require 'vendor/autoload.php';

use Moov	o;MoovPhp;
use Moov	o;MoovPhp.Models.Components;

$sdk = MoovPhp	o;Moov::builder()
    ->setSecurity(
        new Components	o;Security(
            username: '',
            password: '',
        )
    )
    ->build();

$updateCard = new Components	o;UpdateCard(
    cardCvv: '456',
);

$response = $sdk->cards->update(
    accountID: '7104688e-8434-482e-9556-4784be3ad3fe',
    cardID: '01234567-89ab-cdef-0123-456789abcdef',
    updateCard: $updateCard
);

if ($response->card !== null) {
    // handle response
}
```

```java
package hello.world;

import io.moov.sdk.Moov;
import io.moov.sdk.models.components.Security;
import io.moov.sdk.models.components.UpdateCard;
import io.moov.sdk.models.errors.GenericError;
import io.moov.sdk.models.errors.UpdateCardError;
import io.moov.sdk.models.operations.UpdateCardResponse;
import java.lang.Exception;

public class Application {
    public static void main(String[] args) throws GenericError, UpdateCardError, Exception {
        Moov sdk = Moov.builder()
                .security(Security.builder()
                    .username("")
                    .password("")
                    .build())
            .build();

UpdateCardResponse res = sdk.cards().update()
                .accountID("7104688e-8434-482e-9556-4784be3ad3fe")
                .cardID("01234567-89ab-cdef-0123-456789abcdef")
                .updateCard(UpdateCard.builder()
                    .cardCvv("456")
                    .build())
                .call();

if (res.card().isPresent()) {
            System.out.println(res.card().get());
        }
    }
}
```

```python
from moovio_sdk import Moov
from moovio_sdk.models import components

with Moov(
    security=components.Security(
        username="",
        password="",
    ),
) as moov:

res = moov.cards.update(account_id="7104688e-8434-482e-9556-4784be3ad3fe", card_id="01234567-89ab-cdef-0123-456789abcdef", e2ee={
        "token": "eyJhbGciOiJFQ0RILUVTK0EyNTZLVyIsImVuYyI6IkEyNTZHQ00iLCJlcGsiOnsia3R5IjoiRUMiLCJjcnYiOiJQLTUyMSIsIngiOiJBS0NYVDM1WVdvTm8wbzExNy1SU0dqUGg3alN1NjFmLUhnYkx1dW0xVG1ueTRlcW5yX2hyU0hpY0w1d3gwODRCWDBRZjVTdEtkRUoydzY2ZUJqWHprRV9OIiwieSI6IkFIMEJfT2RaYTQtbG43dGJ4M3VBdlc1NDNQRE9HUXBCTDloRFFNWjlTQXNfOW05UWN3dnhRd1hrb1VrM3VzT1FnVV9ySVFrNFRoZ1NTUzV4UlhKcm5ZaTkifSwia2lkIjoiYmRvV3pLekpKUGw0TVFIaENDa05WYTZlZ1dmYi02V1haSjZKTFZqQ0hWMD0ifQ.HalyoHsfufBJEODd2lD9ThQvvVWw3b2kgWDLHGxmHhMv8rODyLL_Ug.rpQP178t8Ed_pUU2.Sn9UFeVoegAxiMUv11q7l3M0y9YHSLYi2n_JB7n7Pc777_47-icfaxstJemT0IC81w.akkq1EBxzWkBr4vEomSpWA",
    }, billing_address={
        "address_line1": "123 Main Street",
        "address_line2": "Apt 302",
        "city": "Boulder",
        "state_or_province": "CO",
        "postal_code": "80301",
        "country": "US",
    }, expiration={
        "month": "01",
        "year": "21",
    }, card_cvv="456")

# Handle response
    print(res)
```

```ruby
require 'moov_ruby'

Models = ::Moov::Models
s = ::Moov::Client.new(
  security: Models::Components::Security.new(
    username: '',
    password: ''
  )
)
res = s.cards.update(account_id: '7104688e-8434-482e-9556-4784be3ad3fe', card_id: '01234567-89ab-cdef-0123-456789abcdef', update_card: Models::Components::UpdateCard.new(
  card_cvv: '456'
))

unless res.card.nil?
  # handle response
end
```

```csharp
using Moov.Sdk;
using Moov.Sdk.Models.Components;

var sdk = new MoovClient(security: new Security() {
    Username = "",
    Password = "",
});

var res = await sdk.Cards.UpdateAsync(
    accountID: "7104688e-8434-482e-9556-4784be3ad3fe",
    cardID: "01234567-89ab-cdef-0123-456789abcdef",
    body: new UpdateCard() {
        CardCvv = "456",
    }
);

// handle response
```

The request completed successfully.

## Response headers

A unique identifier used to trace requests.

The server could not understand the request due to invalid syntax.

## Example

```json
{
  "error": "string"
}
```

The request contained missing or expired authentication.

## Example

```json
{
  "error": "string"
}
```

The user is not authorized to make the request.

## Example

```json
{
  "error": "string"
}
```

The requested resource was not found.

## Example

```json
{
  "error": "string"
}
```

The request conflicted with the current state of the target resource.

## Example

```json
{
  "error": "string"
}
```

The request was well-formed, but the contents failed validation. Check the request for missing or invalid fields.

## Example

```json
{
  "e2ee": {
    "token": "string"
  },
  "billingAddress": "string",
  "expiration": "string",
  "cardCvv": "string",
  "cardOnFile": "string",
  "merchantAccountID": "string",
  "verifyName": "string",
  "holderName": "string"
}
```

Request was refused due to rate limiting.

## Example

```json
{
  "error": "string"
}
```

The request failed due to an unexpected error.

## Example

```json
{
  "error": "string"
}
```

Set this header to v2026.07.00 to use the API described in this specification. When omitted, the server defaults to v2024.01.00, which may not match the behavior documented here.

Possible values:

`v2026.07.00`

Updated billing address to store on file for the card.