---
title: "Change card PIN with Change Request"
method: POST
path: "/v1/cards/{card_account_id}/sca_pin_update_requests"
tags: ["Encrypted PIN Change"]
---

# Change card PIN with Change Request

`POST /v1/cards/{card_account_id}/sca_pin_update_requests`

Changes the PIN of the card specified in the request URL using the Change Request process. Follow these instructions to use this endpoint: 
  1. Retrieve the encryption key in JWK format with the `GET Retrieve latest public key` method and make it available.
  2. Collect the customer's desired PIN through a text input in your frontend and store it as string containing a JSON-formatted object `{"pin": "<NEW_PIN>"}`.
  3. Parse the received encryption key JWK from the first step (you may want to use a suitable library of your choice, e.g. [JOSESwift for iOS](https://github.com/airsidemobile/JOSESwift) or [Nimbus JOSE for Android](https://connect2id.com/products/nimbus-jose-jwt)).
  4. Encrypt the string containing the new PIN from step 2 into a JWE using the previously received encryption key and the following properties: 
     1. Algorithm: `RSA-OAEP-256`
     2. Encryption method: `A256CBC-HS512`
     3. Key ID: `kid` property from the encryption key JWK
  5. On the customer's device, generate the compact serialization of the JWE created in the previous step—this will be used as the `encrypted_pin` parameter.
  6. Call this endpoint from your backend.

## Path parameters

- `card_account_id` string, required

## Request body

- PinUpdateSCARequest
  - `encrypted_pin` string, required — The encrypted PIN value (JWE in compact serialization). See the description of this method for instructions on how to produce this value.
  - `key_id` string, required — Solaris' public RSA key ID. Returned as the `kid` property by the `GET Retrieve latest public key` endpoint.

## Response `200`

The request was accepted, and now the customer must confirm the change request.

- ChangeRequestResponse
  - `id` string — ID of the change request.
  - `status` 'ACCEPTED' | 'AUTHORIZATION_REQUIRED' | 'CONFIRMATION_REQUIRED' | 'COMPLETED' | 'FAILED' — The current status of the change request.
  - `updated_at` string, date-time — UTC timestamp from the last time the change request was updated.
  - `url` string — URL to use to authorize the change request.

## Other responses

- `400` — Validation error.
- `403` — Unauthorized action.
- `404` — The card could not be found.
- `500` — Internal server error.

---

[API](https://skmtc.net/solarisgroup/apis/card-creation-servicing.md) · [All operations](https://skmtc.net/solarisgroup/apis/card-creation-servicing/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/solarisgroup/card-creation-servicing/revisions/a772504dcc9e/schema)