curl --request PUT \
--url https://api.atoa.me/api/customers/{customerId}/cards/{cardId} \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '{
"metadata": { "internalId": "42", "legacyRef": "" }
}'
import requests
url = "https://api.atoa.me/api/customers/{customerId}/cards/{cardId}"
payload = {
"metadata": {"internalId": "42", "legacyRef": ""}
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.put(url, json=payload, headers=headers)
print(response.json())
const response = await fetch(
"https://api.atoa.me/api/customers/{customerId}/cards/{cardId}",
{
method: "PUT",
headers: {
Authorization: "Bearer <token>",
"Content-Type": "application/json",
},
body: JSON.stringify({
metadata: { internalId: "42", legacyRef: "" },
}),
}
);
const data = await response.json();
console.log(data);
<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.atoa.me/api/customers/{customerId}/cards/{cardId}",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_CUSTOMREQUEST => "PUT",
CURLOPT_POSTFIELDS => json_encode([
"metadata" => ["internalId" => "42", "legacyRef" => ""]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
curl_close($curl);
echo $response;
package main
import (
"fmt"
"strings"
"net/http"
"io/ioutil"
)
func main() {
url := "https://api.atoa.me/api/customers/{customerId}/cards/{cardId}"
payload := strings.NewReader(`{
"metadata": { "internalId": "42", "legacyRef": "" }
}`)
req, _ := http.NewRequest("PUT", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := ioutil.ReadAll(res.Body)
fmt.Println(string(body))
}
HttpResponse<String> response = Unirest.put("https://api.atoa.me/api/customers/{customerId}/cards/{cardId}")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\"metadata\":{\"internalId\":\"42\",\"legacyRef\":\"\"}}")
.asString();
{
"id": "card_abc123def456",
"name": "John Doe",
"type": "credit",
"lastFourDigits": "4242",
"category": "consumer",
"cardType": "DEBIT",
"brand": "VISA",
"country": "GB",
"expiryDate": "12/2027",
"metadata": { "internalId": "42" },
"createdAt": "2025-06-15T10:30:00.000Z"
}
{
"name": "BAD_REQUEST",
"message": "metadata keys must be 40 characters or less.",
"status": 400,
"errors": []
}
{
"name": "NOT_FOUND",
"message": "Card not found",
"status": 404,
"errors": []
}
Payment Methods
Update Payment Method
Update payment method via the Atoa Payment Methods API, request parameters, response schema and code samples in cURL, Python, JavaScript, PHP, Go and Java.
PUT
/
api
/
customers
/
{customerId}
/
cards
/
{cardId}
curl --request PUT \
--url https://api.atoa.me/api/customers/{customerId}/cards/{cardId} \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '{
"metadata": { "internalId": "42", "legacyRef": "" }
}'
import requests
url = "https://api.atoa.me/api/customers/{customerId}/cards/{cardId}"
payload = {
"metadata": {"internalId": "42", "legacyRef": ""}
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.put(url, json=payload, headers=headers)
print(response.json())
const response = await fetch(
"https://api.atoa.me/api/customers/{customerId}/cards/{cardId}",
{
method: "PUT",
headers: {
Authorization: "Bearer <token>",
"Content-Type": "application/json",
},
body: JSON.stringify({
metadata: { internalId: "42", legacyRef: "" },
}),
}
);
const data = await response.json();
console.log(data);
<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.atoa.me/api/customers/{customerId}/cards/{cardId}",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_CUSTOMREQUEST => "PUT",
CURLOPT_POSTFIELDS => json_encode([
"metadata" => ["internalId" => "42", "legacyRef" => ""]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
curl_close($curl);
echo $response;
package main
import (
"fmt"
"strings"
"net/http"
"io/ioutil"
)
func main() {
url := "https://api.atoa.me/api/customers/{customerId}/cards/{cardId}"
payload := strings.NewReader(`{
"metadata": { "internalId": "42", "legacyRef": "" }
}`)
req, _ := http.NewRequest("PUT", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := ioutil.ReadAll(res.Body)
fmt.Println(string(body))
}
HttpResponse<String> response = Unirest.put("https://api.atoa.me/api/customers/{customerId}/cards/{cardId}")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\"metadata\":{\"internalId\":\"42\",\"legacyRef\":\"\"}}")
.asString();
{
"id": "card_abc123def456",
"name": "John Doe",
"type": "credit",
"lastFourDigits": "4242",
"category": "consumer",
"cardType": "DEBIT",
"brand": "VISA",
"country": "GB",
"expiryDate": "12/2027",
"metadata": { "internalId": "42" },
"createdAt": "2025-06-15T10:30:00.000Z"
}
{
"name": "BAD_REQUEST",
"message": "metadata keys must be 40 characters or less.",
"status": 400,
"errors": []
}
{
"name": "NOT_FOUND",
"message": "Card not found",
"status": 404,
"errors": []
}
Update a saved payment method. Today this updates the card’s metadata — supply only the metadata you want to change.
Request Body Schema
Response
Returns the updated saved card object.
Authorization
Bearer<accessSecret>
Path Parameters
string
required
The customer UUID who owns the card.
string
required
The card identifier to update.
object
Set of key-value pairs to attach to the saved card. Supplied keys are merged into the card’s existing metadata: a key is added or overwritten, and setting a key to an empty string (
"") removes it. Keys you don’t include are left unchanged.- Up to 50 key-value pairs.
- Each key must be 1–40 characters and must not contain
[or]. - Each value must be a string of at most 500 characters.
string
Card identifier.
string
Cardholder name.
string
Card type (e.g.,
credit, debit).string
Last 4 digits of the card number.
string
Card category.
string
Card type (e.g.,
DEBIT, CREDIT, PREPAID).string
Card network brand (e.g.,
VISA, MASTERCARD).string
Card issuing country code.
string
Card expiry date in
MM/YYYY format.object
The key/value string pairs attached to the card after the update.
string
ISO 8601 timestamp of when the card was saved.
curl --request PUT \
--url https://api.atoa.me/api/customers/{customerId}/cards/{cardId} \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '{
"metadata": { "internalId": "42", "legacyRef": "" }
}'
import requests
url = "https://api.atoa.me/api/customers/{customerId}/cards/{cardId}"
payload = {
"metadata": {"internalId": "42", "legacyRef": ""}
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.put(url, json=payload, headers=headers)
print(response.json())
const response = await fetch(
"https://api.atoa.me/api/customers/{customerId}/cards/{cardId}",
{
method: "PUT",
headers: {
Authorization: "Bearer <token>",
"Content-Type": "application/json",
},
body: JSON.stringify({
metadata: { internalId: "42", legacyRef: "" },
}),
}
);
const data = await response.json();
console.log(data);
<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.atoa.me/api/customers/{customerId}/cards/{cardId}",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_CUSTOMREQUEST => "PUT",
CURLOPT_POSTFIELDS => json_encode([
"metadata" => ["internalId" => "42", "legacyRef" => ""]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
curl_close($curl);
echo $response;
package main
import (
"fmt"
"strings"
"net/http"
"io/ioutil"
)
func main() {
url := "https://api.atoa.me/api/customers/{customerId}/cards/{cardId}"
payload := strings.NewReader(`{
"metadata": { "internalId": "42", "legacyRef": "" }
}`)
req, _ := http.NewRequest("PUT", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := ioutil.ReadAll(res.Body)
fmt.Println(string(body))
}
HttpResponse<String> response = Unirest.put("https://api.atoa.me/api/customers/{customerId}/cards/{cardId}")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\"metadata\":{\"internalId\":\"42\",\"legacyRef\":\"\"}}")
.asString();
{
"id": "card_abc123def456",
"name": "John Doe",
"type": "credit",
"lastFourDigits": "4242",
"category": "consumer",
"cardType": "DEBIT",
"brand": "VISA",
"country": "GB",
"expiryDate": "12/2027",
"metadata": { "internalId": "42" },
"createdAt": "2025-06-15T10:30:00.000Z"
}
{
"name": "BAD_REQUEST",
"message": "metadata keys must be 40 characters or less.",
"status": 400,
"errors": []
}
{
"name": "NOT_FOUND",
"message": "Card not found",
"status": 404,
"errors": []
}