# Update a card

Update a linked card and/or resubmit it for verification.

If a value is provided for CVV, a new verification ($0 authorization) will be submitted for the card. Updating the expiration
date or address will update the information stored on file for the card but will not be verified.

Read our [accept card payments guide](https://docs.moov.io/guides/sources/cards/accept-card-payments/#reverify-a-card) to learn
more.

Only use this endpoint if you have provided Moov with a copy of your PCI attestation of compliance.

To access this endpoint using an [access token](https://docs.moov.io/api/authentication/access-tokens/) you'll need to specify the `/accounts/{accountID}/cards.write` scope.

## PATCH

/accounts/{accountID}/cards/{cardID}

### Ask

```shell
curl -X PATCH "https://api.moov.io/accounts/{accountID}/cards/{cardID}" \
  -H "Authorization: Bearer {token}" \
  -H "X-Moov-Version: v2026.04.00" \
  -d '{
  "cardCvv": "456"
}'
```

### Ask

```go
mc, _ := moov.NewClient()

var accountID string
var cardID string

mc.UpdateCard(ctx, accountID, cardID,
  moov.WithCardOnFile(true),
)
```

### Ask

```typescript
import { Moov } from "@moovio/sdk";

const moov = new Moov({
  security: {
    username: "",
    password: "",
  },
});

async function run() {
  const result = await moov.cards.update({
    accountID: "7104688e-8434-482e-9556-4784be3ad3fe",
    cardID: "01234567-89ab-cdef-0123-456789abcdef",
    updateCard: {
      cardCvv: "456",
    },
  });

console.log(result);
}

run();
```

### Ask

```php
declare(strict_types=1);

require 'vendor/autoload.php';

use Moov\MoovPhp;
use Moov\MoovPhp\Models\Components;

$sdk = MoovPhp\Moov::builder()
    ->setSecurity(
        new Components\Security(
            username: '',
            password: '',
        )
    )
    ->build();

$updateCard = new Components\UpdateCard(
    cardCvv: '456',
);

$response = $sdk->cards->update(
    accountID: '7104688e-8434-482e-9556-4784be3ad3fe',
    cardID: '01234567-89ab-cdef-0123-456789abcdef',
    updateCard: $updateCard
);

if ($response->card !== null) {
    // handle response
}
```

### Ask

```java
package hello.world;

import io.moov.sdk.Moov;
import io.moov.sdk.models.components.Security;
import io.moov.sdk.models.components.UpdateCard;
import io.moov.sdk.models.errors.GenericError;
import io.moov.sdk.models.errors.UpdateCardError;
import io.moov.sdk.models.operations.UpdateCardResponse;
import java.lang.Exception;

public class Application {

public static void main(String[] args) throws GenericError, UpdateCardError, Exception {

Moov sdk = Moov.builder()
                .security(Security.builder()
                    .username("")
                    .password("")
                    .build())
            .build();

UpdateCardResponse res = sdk.cards().update()
                .accountID("7104688e-8434-482e-9556-4784be3ad3fe")
                .cardID("01234567-89ab-cdef-0123-456789abcdef")
                .updateCard(UpdateCard.builder()
                    .cardCvv("456")
                    .build())
                .call();

if (res.card().isPresent()) {
            System.out.println(res.card().get());
        }
    }
}
```

### Ask

```python
from moovio_sdk import Moov
from moovio_sdk.models import components

with Moov(
    security=components.Security(
        username="",
        password="",
    ),
) as moov:

res = moov.cards.update(account_id="7104688e-8434-482e-9556-4784be3ad3fe", card_id="01234567-89ab-cdef-0123-456789abcdef", e2ee={
        "token": "eyJhbGciOiJFQ0RILUVTK0EyNTZLVyIsImVuYyI6IkEyNTZHQ00iLCJlcGsiOnsia3R5IjoiRUMiLCJjcnYiOiJQLTUyMSIsIngiOiJBS0NYVDM1WVdvTm8wbzExNy1SU0dqUGg3alN1NjFmLUhnYkx1dW0xVG1ueTRlcW5yX2hyU0hpY0w1d3gwODRCWDBRZjVTdEtkRUoydzY2ZUJqWHprRV9OIiwieSI6IkFIMEJfT2RaYTQtbG43dGJ4M3VBdlc1NDNQRE9HUXBCTDloRFFNWjlTQXNfOW05UWN3dnhRd1hrb1VrM3VzT1FnVV9ySVFrNFRoZ1NTUzV4UlhKcm5ZaTkifSwia2lkIjoiYmRvV3pLekpKUGw0TVFIaENDa05WYTZlZ1dmYi02V1haSjZKTFZqQ0hWMD0ifQ.HalyoHsfufBJEODd2lD9ThQvvVWw3b2kgWDLHGxmHhMv8rODyLL_Ug.rpQP178t8Ed_pUU2.Sn9UFeVoegAxiMUv11q7l3M0y9YHSLYi2n_JB7n7Pc777_47-icfaxstJemT0IC81w.akkq1EBxzWkBr4vEomSpWA",
    }, billing_address={
        "address_line1": "123 Main Street",
        "address_line2": "Apt 302",
        "city": "Boulder",
        "state_or_province": "CO",
        "postal_code": "80301",
        "country": "US",
    }, expiration={
        "month": "01",
        "year": "21",
    }, card_cvv="456")

# Handle response
    print(res)
```

### Ask

```ruby
require 'moov_ruby'

Models = ::Moov::Models
s = ::Moov::Client.new(
  security: Models::Components::Security.new(
    username: '',
    password: ''
  )
)
res = s.cards.update(account_id: '7104688e-8434-482e-9556-4784be3ad3fe', card_id: '01234567-89ab-cdef-0123-456789abcdef', update_card: Models::Components::UpdateCard.new(
  card_cvv: '456'
))

unless res.card.nil?
  # handle response
end
```

### Ask

```csharp
using Moov.Sdk;
using Moov.Sdk.Models.Components;

var sdk = new MoovClient(security: new Security() {
    Username = "",
    Password = "",
});

var res = await sdk.Cards.UpdateAsync(
    accountID: "7104688e-8434-482e-9556-4784be3ad3fe",
    cardID: "01234567-89ab-cdef-0123-456789abcdef",
    body: new UpdateCard() {
        CardCvv = "456",
    }
);

// handle response
```

The request completed successfully.

## Example

```json
{
  "billingAddress": {
    "addressLine1": "123 Main Street",
    "addressLine2": "Apt 302",
    "city": "Boulder",
    "country": "US",
    "postalCode": "80301",
    "stateOrProvince": "CO"
  },
  "bin": "411111",
  "brand": "Visa",
  "cardAccountUpdater": {
    "updateType": "number-update",
    "updatedOn": "2024-05-06T12:20:38.184Z"
  },
  "cardCategory": "CLASSIC",
  "cardID": "01234567-89ab-cdef-0123-456789abcdef",
  "cardOnFile": true,
  "cardType": "credit",
  "cardVerification": {
    "accountName": {
      "firstName": "match",
      "fullName": "match",
      "lastName": "match",
      "middleName": "match"
    },
    "addressLine1": "match",
    "cvv": "match",
    "postalCode": "match"
  },
  "commercial": false,
  "domesticPullFromCard": "supported",
  "domesticPushToCard": "standard",
  "expiration": {
    "month": "01",
    "year": "21"
  },
  "fingerprint": "9948962d92a1ce40c9f918cd9ece3a22bde62fb325a2f1fe2e833969de672ba3",
  "holderName": "Jules Jackson",
  "issuer": "GRINGOTTS BANK",
  "issuerCountry": "US",
  "issuerPhone": "8185551212",
  "issuerURL": "HTTPS://WWW.EXAMPLE.COM/",
  "lastFourCardNumber": "1111",
  "merchantAccountID": "01234567-89ab-cdef-0123-456789abcdef",
  "regulated": false
}
```

### Response headers

A unique identifier used to trace requests.

The server could not understand the request due to invalid syntax.

```json
{
  "error": "string"
}
```

### Response headers

A unique identifier used to trace requests.

The request contained missing or expired authentication.

### Response headers

A unique identifier used to trace requests.

The user is not authorized to make the request.

### Response headers

A unique identifier used to trace requests.

The requested resource was not found.

### Response headers

A unique identifier used to trace requests.

The request conflicted with the current state of the target resource.

```json
{
  "error": "string"
}
```

### Response headers

A unique identifier used to trace requests.

The request was well-formed, but the contents failed validation. Check the request for missing or invalid fields.

```json
{
  "e2ee": {
    "token": "string"
  },
  "billingAddress": "string",
  "expiration": "string",
  "cardCvv": "string",
  "cardOnFile": "string",
  "merchantAccountID": "string",
  "verifyName": "string",
  "holderName": "string"
}
```

### Response headers

A unique identifier used to trace requests.

Request was refused due to rate limiting.

### Response headers

A unique identifier used to trace requests.

The request failed due to an unexpected error.

### Response headers

A unique identifier used to trace requests.

The request failed because a downstream service failed to respond.

### Response headers

A unique identifier used to trace requests.

Set this header to v2026.04.00 to use the API described in this specification. When omitted, the server defaults to v2024.01.00, which may not match the behavior documented here.