---
title: "Change card PIN"
method: POST
path: "/v1/cards/{card_account_id}/pin_update_requests"
tags: ["Encrypted PIN Change"]
---

# Change card PIN

`POST /v1/cards/{card_account_id}/pin_update_requests`

Changes the PIN of the card specified in the request URL. Follow these instructions to use this endpoint: 
  1. In your backend, retrieve the encryption key in JWK format with the `GET Retrieve latest public key` method and make it available to the customer's device.
  2. On the customer's device, collect the customer's desired PIN through a text input in your frontend and store it as string containing a JSON-formatted object `{"pin": "<NEW_PIN>"}`.
  3. On the customer's device, parse the received encryption key JWK from the first step (you may want to use a suitable library of your choice, e.g. [JOSESwift for iOS](https://github.com/airsidemobile/JOSESwift) or [Nimbus JOSE for Android](https://connect2id.com/products/nimbus-jose-jwt)).
  4. On the customer's device, encrypt the string containing the new PIN from step 2 into a JWE using the previously received encryption key and the following properties: 
     1. Algorithm: `RSA-OAEP-256`
     2. Encryption method: `A256CBC-HS512`
     3. Key ID: `kid` property from the encryption key JWK
  5. On the customer's device, generate the compact serialization of the JWE created in the previous step—this will be used as the `encrypted_pin` parameter.
  6. On the customer's device, sign the serialized JWE of the previous step using the cardholder's private key from their bound device — this is the `signature` parameter. Note that you must use the **restricted** key.
  7. Transfer the values generated in the previous two steps (serialized JWE and created signature) to your backend.
  8. Call this endpoint from your backend.

## Path parameters

- `card_account_id` string, required

## Request body

- PinUpdateRequest
  - `device_id` string, required — ID of the customer's previously bound device.
  - `device_data` string — Encoded device fingerprint generated using the [Seon SDK](https://seon.io). See the [device monitoring guide](https://docs.solarisgroup.com/guides/kyc/device-monitoring) for more information about generating this value.
  - `encrypted_pin` string, required — The encrypted PIN value (JWE in compact serialization). See the description of this method for instructions on how to produce this value.
  - `key_id` string, required — Solaris' public RSA key ID. Returned as the `kid` property by the `GET Retrieve latest public key` endpoint.
  - `signature` string, required — The signature of the `encrypted_pin` created with the device binding key.

## Response `200`

The card's PIN was successfully changed.

## Other responses

- `400` — Validation error.
- `403` — Unauthorized action.
- `404` — The card could not be found.
- `500` — Internal server error.

---

[API](https://skmtc.net/solarisgroup/apis/card-creation-servicing.md) · [All operations](https://skmtc.net/solarisgroup/apis/card-creation-servicing/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/solarisgroup/card-creation-servicing/revisions/a772504dcc9e/schema)