# Update a card

`PATCH /accounts/{accountID}/cards/{cardID}`

API version: `v2026.07.00`. Send `X-Moov-Version: v2026.07.00` to get the behavior described here.

> AI agents: search and read all Moov docs with the docs MCP server at https://docs.moov.io/mcp (no API key). Setup: https://docs.moov.io/guides/developer-tools/mcp-ai/docs-mcp/index.md

Update a linked card and/or resubmit it for verification.

If a value is provided for CVV, a new verification ($0 authorization) will be submitted for the card. Updating the expiration
date or
address will update the information stored on file for the card but will not be verified.

Read our [accept card payments guide](https://docs.moov.io/guides/sources/cards/accept-card-payments/#reverify-a-card) to learn
more.

Only use this endpoint if you have provided Moov with a copy of your PCI attestation of compliance.

To access this endpoint using an [access token](https://docs.moov.io/api/authentication/access-tokens/)
you'll need to specify the `/accounts/{accountID}/cards.write` scope.

## Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `X-Moov-Version` | header | string |  | Set this header to v2026.07.00 to use the API described in this specification. When omitted, the server defaults to v2024.01.00, the earliest supported version, which may not match the behavior documented here. An unrecognized well-formed version uses the latest supported version that is not newer than the requested version, when one exists. For example, `v2026.08.00` uses `v2026.07.00`. A malformed value, such as `2022`, returns a `404` response. Values: `v2026.07.00`. |
| `accountID` | path | string | Yes |  |
| `cardID` | path | string | Yes | ID of the card. |

## Request body

Content type: `application/json`

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `e2ee` | object |  | Wraps a compact-serialized JSON Web Encryption (JWE) token used for secure transmission of sensitive data (e.g., PCI information) through intermediaries. This token is encrypted using the public key from /end-to-end-keys and wraps an AES key. For details and examples, refer to our [GitHub repository](https://github.com/moovfinancial/moov-go/blob/main/examples/e2ee/e2ee_test.go). |
| `e2ee.token` | string (jwe) |  | An [RFC](https://datatracker.ietf.org/doc/html/rfc7516) compact-serialized JSON Web Encryption (JWE) token. |
| `billingAddress` | object |  | Updated billing address to store on file for the card. |
| `billingAddress.addressLine1` | string |  | Street address line 1. |
| `billingAddress.addressLine2` | string |  | Street address line 2 (e.g., apartment or suite number). |
| `billingAddress.city` | string |  | City name. |
| `billingAddress.stateOrProvince` | string |  | Two-letter state or province code. |
| `billingAddress.postalCode` | string |  | Postal or ZIP code. |
| `billingAddress.country` | string |  | Two-letter ISO 3166-1 country code. |
| `expiration` | object |  |  |
| `expiration.month` | string |  | Two-digit month the card expires. |
| `expiration.year` | string |  | Two-digit year the card expires. |
| `cardCvv` | string |  | The card's 3- or 4-digit card verification value. Providing this triggers a new $0 verification authorization, which performs both CVV and address verification. |
| `cardOnFile` | boolean |  | Indicates cardholder has authorized card to be stored for future payments (e.g., recurring payments). If true and no `merchantAccountID` is provided, the partner account's ID is automatically used as the merchant account for verification. |
| `merchantAccountID` | string |  | Merchant account whose details (statement descriptor, address, etc.) are used for the card verification authorization. If omitted, the partner account's details are used instead. |
| `verifyName` | boolean |  | If true, submits the cardholder's name to the card network for verification as part of the $0 authorization. Only supported for Visa and Mastercard; requesting name verification for American Express or Discover will return an error. |
| `holderName` | string |  | Updated name of the cardholder as it appears on the card. |

Example:

```json
{
  "cardCvv": "456"
}
```

## Response 200

The request completed successfully.

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `cardID` | string | Yes | ID of the card. |
| `fingerprint` | string | Yes | Uniquely identifies a linked payment card or token. For Apple Pay, the fingerprint is based on the tokenized card number and may vary based on the user's device. This field can be used to identify specific payment methods across multiple accounts on your platform. |
| `brand` | string | Yes | The card brand. Values: `American Express`, `Discover`, `Mastercard`, `Visa`, `Unknown`. |
| `cardType` | string | Yes | The type of the card. Values: `debit`, `credit`, `prepaid`, `unknown`. |
| `cardCategory` | string |  | The category or level of the card defined by the issuer. Examples include, but not limited to, "REWARDS", "TRADITIONAL REWARDS", "CLASSIC", and "CORPORATE PURCHASING". |
| `lastFourCardNumber` | string | Yes | Last four digits of the card number |
| `bin` | string | Yes | The first six to eight digits of the card number, which identifies the financial institution that issued the card. |
| `expiration` | object | Yes | The expiration date of the card or token. |
| `expiration.month` | string | Yes | Two-digit month the card expires. |
| `expiration.year` | string | Yes | Two-digit year the card expires. |
| `holderName` | string |  | The name of the cardholder as it appears on the card. |
| `billingAddress` | object | Yes | The billing address associated with the card. |
| `billingAddress.addressLine1` | string |  | Street address line 1. |
| `billingAddress.addressLine2` | string |  | Street address line 2 (e.g., apartment or suite number). |
| `billingAddress.city` | string |  | City name. |
| `billingAddress.stateOrProvince` | string |  | Two-letter state or province code. |
| `billingAddress.postalCode` | string | Yes | Postal or ZIP code. |
| `billingAddress.country` | string |  | Two-letter ISO 3166-1 country code. |
| `cardVerification` | object | Yes | The results of submitting cardholder data to a card network for verification. |
| `cardVerification.cvv` | string | Yes | Verification result of the card's CVV. Values: `noMatch`, `match`, `notChecked`, `unavailable`, `partialMatch`. |
| `cardVerification.addressLine1` | string | Yes | Verification result of the billing address line 1. Derived from the same AVS code as `postalCode`; the card network returns a single code covering both address fields. Values: `noMatch`, `match`, `notChecked`, `unavailable`, `partialMatch`. |
| `cardVerification.postalCode` | string | Yes | Verification result of the billing address postal code. Derived from the same AVS code as `addressLine1`; the card network returns a single code covering both address fields. Values: `noMatch`, `match`, `notChecked`, `unavailable`, `partialMatch`. |
| `cardVerification.accountName` | object |  | Verification results of the cardholder's name, broken down by name component. |
| `issuer` | string |  | Financial institution that issued the card. |
| `issuerCountry` | string |  | Country where the card was issued. |
| `issuerURL` | string (uri) |  | URL of the issuer. |
| `issuerPhone` | string |  | Phone number of the issuer. |
| `commercial` | boolean |  | If true, the card is for commercial use, or associated with a business. If false, the card is associated with a general consumer. |
| `regulated` | boolean |  | If true, the card issuing bank is regulated, and the scheme fees for debit transactions will be limited based on the Durbin Amendment. If false, the card issuing bank is not regulated, and the scheme fees will not be limited. |
| `cardOnFile` | boolean |  | Indicates cardholder has authorized card to be stored for future payments. |
| `merchantAccountID` | string |  | Merchant account whose details (statement descriptor, address, etc.) are used for the card verification authorization. If omitted, the partner account's details are used instead. |
| `cardAccountUpdater` | object |  | The results of the most recent card update request. |
| `cardAccountUpdater.updatedOn` | string (date-time) |  | Timestamp from the card network indicating when the card update was processed. |
| `cardAccountUpdater.updateType` | string |  | The results of the card update request. Values: `unspecified`, `account-closed`, `contact-cardholder`, `expiration-update`, `no-change`, `no-match`, `number-update`. |
| `domesticPushToCard` | string |  | Indicates which level of domestic push-to-card transfer is supported by the card, if any. Values: `not-supported`, `standard`, `fast-funds`, `unknown`. |
| `domesticPullFromCard` | string |  | Indicates if the card supports domestic pull-from-card transfer. Values: `not-supported`, `supported`, `unknown`. |
| `paymentMethods` | array of object |  | Includes any payment methods created as a result of linking a card with the `x-wait-for` header set to `payment-method`. Only returned by the link card endpoint; not included when getting or listing cards. |
| `paymentMethods[].paymentMethodID` | string | Yes | ID of the payment method. |
| `paymentMethods[].paymentMethodType` | string | Yes | The payment method type that represents a payment rail and directionality Values: `moov-wallet`, `ach-debit-fund`, `ach-debit-collect`, `ach-credit-standard`, `ach-credit-same-day`, `rtp-credit`, `card-payment`, `push-to-card`, `pull-from-card`, `apple-pay`, `card-present-payment`, `instant-bank-credit`, `push-to-apple-pay`, `pull-from-apple-pay`, `google-pay`, `push-to-google-pay`, `pull-from-google-pay`. |

## Errors

| Status | Meaning |
| --- | --- |
| 400 | The server could not understand the request due to invalid syntax. |
| 401 | The request contained missing or expired authentication. |
| 403 | The user is not authorized to make the request. |
| 404 | The requested resource was not found. |
| 409 | The request conflicted with the current state of the target resource. |
| 422 | The request was well-formed, but the contents failed validation. Check the request for missing or invalid fields. |
| 429 | Request was refused due to rate limiting. |
| 500 | The request failed due to an unexpected error. |
| 504 | The request failed because a downstream service failed to respond. |

## Examples

### cURL

```bash
curl -X PATCH "https://api.moov.io/accounts/{accountID}/cards/{cardID}" \
  -H "Authorization: Bearer {token}" \
  -H "X-Moov-Version: v2026.07.00" \
  -d '{
  "cardCvv": "456"
}'
```

### Typescript (SDK)

```typescript
import { Moov } from "@moovio/sdk";

const moov = new Moov({
  security: {
    username: "",
    password: "",
  },
});

async function run() {
  const result = await moov.cards.update({
    accountID: "7104688e-8434-482e-9556-4784be3ad3fe",
    cardID: "01234567-89ab-cdef-0123-456789abcdef",
    updateCard: {
      cardCvv: "456",
    },
  });

  console.log(result);
}

run();
```

Full reference with SDK examples in every language: https://docs.moov.io/api/sources/cards/update/