Refresh CVV
Submit a new card verification value for a stored card belonging to the authenticated user.
Headers#
2Path parameters#
2Request body#
1123Response#
7Before you refresh the CVV#
- Authenticate the customer and send their user access token in the Authorization header.
- Set the path user ID to the authenticated customer's UUID and use a card ID returned by List stored cards.
- Collect the card verification value (CVV) from the customer for the stored card. The card must belong to that customer and have a valid expiration date.
Send the refresh request#
Use the sandbox base URL below for testing and https://api.deuna.io for production. Send a JSON object with the required card_cvv string containing the three- or four-digit CVV. There are no query parameters. This operation updates an existing card; it does not create a card or charge the customer.
curl --request POST \
--url 'https://api.sandbox.deuna.io/users/USER_ID/cards/CARD_ID/refresh-cvv' \
--header 'Authorization: Bearer USER_ACCESS_TOKEN' \
--header 'Content-Type: application/json' \
--data '{"card_cvv":"123"}'const response = await fetch("https://api.sandbox.deuna.io/users/USER_ID/cards/CARD_ID/refresh-cvv", {
method: "POST",
headers: {
"Authorization": "Bearer USER_ACCESS_TOKEN",
"Content-Type": "application/json"
},
body: JSON.stringify({
"card_cvv": "123"
})
});
if (!response.ok) throw new Error(`Request failed: ${response.status}`);
const data = await response.json();import requests
response = requests.request(
"POST",
"https://api.sandbox.deuna.io/users/USER_ID/cards/CARD_ID/refresh-cvv",
headers={
"Authorization": "Bearer USER_ACCESS_TOKEN",
"Content-Type": "application/json"
},
json={
"card_cvv": "123"
},
)
response.raise_for_status()
data = response.json()<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.sandbox.deuna.io/users/USER_ID/cards/CARD_ID/refresh-cvv",
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_HTTPHEADER => [
"Authorization: Bearer USER_ACCESS_TOKEN",
"Content-Type: application/json"
],
CURLOPT_POSTFIELDS => json_encode([
"card_cvv" => "123"
])
]);
$response = curl_exec($curl);
curl_close($curl);import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
public class Example {
public static void main(String[] args) throws Exception {
HttpRequest request = HttpRequest.newBuilder()
.uri(URI.create("https://api.sandbox.deuna.io/users/USER_ID/cards/CARD_ID/refresh-cvv"))
.header("Authorization", "Bearer USER_ACCESS_TOKEN")
.header("Content-Type", "application/json")
.method("POST", HttpRequest.BodyPublishers.ofString("{\"card_cvv\":\"123\"}"))
.build();
HttpResponse<String> response = HttpClient.newHttpClient().send(
request, HttpResponse.BodyHandlers.ofString()
);
System.out.println(response.body());
}
}package main
import (
"fmt"
"io"
"net/http"
"strings"
)
func main() {
request, err := http.NewRequest("POST", "https://api.sandbox.deuna.io/users/USER_ID/cards/CARD_ID/refresh-cvv", strings.NewReader("{\"card_cvv\":\"123\"}"))
if err != nil { panic(err) }
request.Header.Set("Authorization", "Bearer USER_ACCESS_TOKEN")
request.Header.Set("Content-Type", "application/json")
response, err := http.DefaultClient.Do(request)
if err != nil { panic(err) }
defer response.Body.Close()
body, _ := io.ReadAll(response.Body)
fmt.Println(string(body))
}Verify the result#
A successful request returns HTTP 204 No Content with an empty body. Do not parse it as JSON. The response confirms completion of the CVV refresh; it does not confirm a payment or expose the CVV in a card response. No payment webhook is needed to confirm this operation.
Continue with your payment request when the customer is ready to pay.
Handle errors and retries#
HTTP 400 indicates invalid identifiers, malformed JSON, or a missing or invalid CVV. HTTP 401 indicates invalid user authorization. HTTP 404 means the stored card was not found for the authenticated user. HTTP 422 indicates an expired card, invalid expiration data, or a card that cannot be refreshed. Correct the input or select another card before retrying.
If a timeout or server error leaves the outcome uncertain, do not replay the CVV automatically. No idempotency-key contract is defined for this operation. Let the customer retry within the active flow and collect the CVV again when needed. See response codes and troubleshooting.
Was this page helpful?