> ## Documentation Index
> Fetch the complete documentation index at: https://docs.henrylabs.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Card Update CVV

> Refresh the CVV on an already-stored card without re-sending the card number or expiry.

Card verification values cannot be stored, so the CVV captured at tokenization expires while the rest of the card stays valid. Charging a stored card after that point requires the buyer to re-enter their CVV. This endpoint applies that value to the existing card, and the `cardToken` continues to reference the same card.

**PCI scope warning:** this endpoint accepts the raw CVV directly on your server, which brings your systems into PCI DSS scope. To stay out of scope, collect it with the client SDK's CVC element instead, which captures the value inside a Henry Labs-hosted iframe so it never reaches your backend.



## OpenAPI

````yaml https://app.stainless.com/api/spec/documented/henry-sdk/openapi.documented.yml post /card/{cardToken}/cvv
openapi: 3.1.0
info:
  title: Henry Labs API
  version: 1.5.0
  description: Playground for Henry Labs API endpoints
  contact:
    name: Henry Labs API Support
    email: support@henrylabs.ai
servers:
  - url: https://api.henrylabs.ai/v1
    description: Production server
security:
  - ApiKeyAuth: []
tags:
  - name: Product
    description: Product search, details, and data enrichment
  - name: Cart
    description: Universal user shopping cart management
  - name: Orders
    description: Order management post purchase
  - name: Merchants
    description: Merchant information and status
  - name: Card
    description: Card tokenization and management
paths:
  /card/{cardToken}/cvv:
    post:
      tags:
        - Card
      summary: Card Update CVV
      description: >-
        Refresh the CVV on an already-stored card without re-sending the card
        number or expiry.


        Card verification values cannot be stored, so the CVV captured at
        tokenization expires while the rest of the card stays valid. Charging a
        stored card after that point requires the buyer to re-enter their CVV.
        This endpoint applies that value to the existing card, and the
        `cardToken` continues to reference the same card.


        **PCI scope warning:** this endpoint accepts the raw CVV directly on
        your server, which brings your systems into PCI DSS scope. To stay out
        of scope, collect it with the client SDK's CVC element instead, which
        captures the value inside a Henry Labs-hosted iframe so it never reaches
        your backend.
      operationId: cardUpdateCvv
      parameters:
        - in: path
          name: cardToken
          schema:
            type: string
            description: Card token returned when the card was tokenized
            example: card_live_abc123xyz
          required: true
          description: Card token returned when the card was tokenized
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                cvv:
                  type: string
                  pattern: ^\d{3,4}$
                  description: Card verification value (3 digits for Visa/MC, 4 for Amex)
                  example: '123'
              required:
                - cvv
      responses:
        '200':
          description: CVV updated successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/cardUpdateCvvResponse'
        '400':
          description: Bad request - Invalid CVV
          content:
            application/json:
              schema:
                type: object
                properties:
                  success:
                    type: boolean
                  status:
                    type: string
                  message:
                    type: string
                required:
                  - success
                  - status
                  - message
                additionalProperties: false
        '401':
          description: Unauthorized - Invalid API key
          content:
            application/json:
              schema:
                type: object
                properties:
                  success:
                    type: boolean
                  status:
                    type: string
                  message:
                    type: string
                required:
                  - success
                  - status
                  - message
                additionalProperties: false
        '404':
          description: Not found - Unknown card token
          content:
            application/json:
              schema:
                type: object
                properties:
                  success:
                    type: boolean
                  status:
                    type: string
                  message:
                    type: string
                required:
                  - success
                  - status
                  - message
                additionalProperties: false
      security:
        - ApiKeyAuth: []
components:
  schemas:
    cardUpdateCvvResponse:
      type: object
      properties:
        success:
          type: boolean
        status:
          type: string
        message:
          type: string
        data:
          $ref: '#/components/schemas/cardTokenizeResponseData'
      required:
        - success
        - status
        - message
        - data
      additionalProperties: false
    cardTokenizeResponseData:
      type: object
      properties:
        cardToken:
          type: string
          description: Opaque token representing the stored card
          example: card_live_abc123xyz
        cardBin:
          type: string
          description: First 6 digits of the card number
          example: '424242'
        cardLast4:
          type: string
          description: Last 4 digits of the card number
          example: '4242'
        cardBrand:
          type: string
          description: Detected card brand
          example: visa
      required:
        - cardToken
        - cardBin
        - cardLast4
        - cardBrand
      additionalProperties: false
  securitySchemes:
    ApiKeyAuth:
      type: apiKey
      in: header
      name: x-api-key

````