> ## Documentation Index
> Fetch the complete documentation index at: https://docs.paywithatoa.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Update Payment Method

> Update payment method via the Atoa Payment Methods API, request parameters, response schema and code samples in cURL, Python, JavaScript, PHP, Go and Java.

Update a saved payment method. Today this updates the card's metadata — supply only the metadata you want to change.

### Authorization

Bearer `<accessSecret>`

**Path Parameters**

**customerId** `string` *required*

The customer UUID who owns the card.

**cardId** `string` *required*

The card identifier to update.

**Request Body Schema**

**metadata** `object`

Set of key-value pairs to attach to the saved card. Supplied keys are merged into the card's existing metadata: a key is added or overwritten, and setting a key to an empty string (`""`) removes it. Keys you don't include are left unchanged.

* Up to **50** key-value pairs.
* Each key must be **1–40** characters and must not contain `[` or `]`.
* Each value must be a **string** of at most **500** characters.

**Response**

Returns the updated saved card object.

**id** `string`

Card identifier.

**name** `string`

Cardholder name.

**type** `string`

Card type (e.g., `credit`, `debit`).

**lastFourDigits** `string`

Last 4 digits of the card number.

**category** `string`

Card category.

**cardType** `string`

Card type (e.g., `DEBIT`, `CREDIT`, `PREPAID`).

**brand** `string`

Card network brand (e.g., `VISA`, `MASTERCARD`).

**country** `string`

Card issuing country code.

**expiryDate** `string`

Card expiry date in `MM/YYYY` format.

**metadata** `object`

The key/value string pairs attached to the card after the update.

**createdAt** `string`

ISO 8601 timestamp of when the card was saved.

```bash curl theme={null}
curl --request PUT \
  --url https://api.atoa.me/api/customers/{customerId}/cards/{cardId} \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{
  "metadata": { "internalId": "42", "legacyRef": "" }
}'
```

```python Python theme={null}
import requests

url = "https://api.atoa.me/api/customers/{customerId}/cards/{cardId}"
payload = {
    "metadata": {"internalId": "42", "legacyRef": ""}
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.put(url, json=payload, headers=headers)
print(response.json())
```

```javascript JavaScript theme={null}
const response = await fetch(
  "https://api.atoa.me/api/customers/{customerId}/cards/{cardId}",
  {
    method: "PUT",
    headers: {
      Authorization: "Bearer <token>",
      "Content-Type": "application/json",
    },
    body: JSON.stringify({
      metadata: { internalId: "42", legacyRef: "" },
    }),
  }
);

const data = await response.json();
console.log(data);
```

```php PHP theme={null}
<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.atoa.me/api/customers/{customerId}/cards/{cardId}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_CUSTOMREQUEST => "PUT",
  CURLOPT_POSTFIELDS => json_encode([
    "metadata" => ["internalId" => "42", "legacyRef" => ""]
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
curl_close($curl);
echo $response;
```

```go Go theme={null}
package main

import (
  "fmt"
  "strings"
  "net/http"
  "io/ioutil"
)

func main() {
  url := "https://api.atoa.me/api/customers/{customerId}/cards/{cardId}"
  payload := strings.NewReader(`{
    "metadata": { "internalId": "42", "legacyRef": "" }
  }`)

  req, _ := http.NewRequest("PUT", url, payload)
  req.Header.Add("Authorization", "Bearer <token>")
  req.Header.Add("Content-Type", "application/json")

  res, _ := http.DefaultClient.Do(req)
  defer res.Body.Close()
  body, _ := ioutil.ReadAll(res.Body)
  fmt.Println(string(body))
}
```

```java Java theme={null}
HttpResponse<String> response = Unirest.put("https://api.atoa.me/api/customers/{customerId}/cards/{cardId}")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\"metadata\":{\"internalId\":\"42\",\"legacyRef\":\"\"}}")
  .asString();
```

```json 200 theme={null}
{
  "id": "card_abc123def456",
  "name": "John Doe",
  "type": "credit",
  "lastFourDigits": "4242",
  "category": "consumer",
  "cardType": "DEBIT",
  "brand": "VISA",
  "country": "GB",
  "expiryDate": "12/2027",
  "metadata": { "internalId": "42" },
  "createdAt": "2025-06-15T10:30:00.000Z"
}
```

```json 400 theme={null}
{
  "name": "BAD_REQUEST",
  "message": "metadata keys must be 40 characters or less.",
  "status": 400,
  "errors": []
}
```

```json 404 theme={null}
{
  "name": "NOT_FOUND",
  "message": "Card not found",
  "status": 404,
  "errors": []
}
```


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.