Verify CVV, AVS, and Name

Verify a Payment Instrument to determine CVV, AVS, and name verification results.

Endpoint: PUT /payment_instruments/{payment_instrument_id_verify}
Security: BasicAuth

Path parameters:

• payment_instrument_id_verify (string, required)
  The ID of the Payment Instrument you wish to verify.
  Example: "PIhWqjo3DU13WmFzWZFLngfa"

Response 200 fields (application/json):

• id (string)
  The ID of the resource.

• created_at (string)
  Timestamp of when the object was created.

• updated_at (string)
  Timestamp of when the object was last updated.

• created_via (string)
  The method by which the resource was created.
  Enum: "API"

• account_updater_enabled (boolean)
  When enabled, Finix automatically checks for updates with card networks. This Account Updater functionality:

• Automatically updates card details (e.g., number or expiration date) to maintain continuity of charges, increasing authorization rates.

• Saves the cardholder the hassle of updating card details across Merchants for each of their Subscriptions.

Note: Cards created before the feature is enabled are unaffected by default. To include these cards, you can manually enable the Account Updater functionality for each card individually using a PUT request. Once enabled, you can link the card to this API call to trigger updates with card networks.

• address (object)
  The address of the card owner. Including a postal or zip code when creating a Payment Instrument can lower the interchange on credit card transactions.

• address.line1 (string,null, required)
  First line of the address (max 35 characters).

• address.line2 (string,null)
  Second line of the address (max 35 characters).

• address.city (string,null, required)
  City (max 20 characters).

• address.region (string,null, required)
  2-letter State code.

• address.postal_code (string,null, required)
  Zip or Postal code (max 7 characters).

• address.country (string,null, required)
  Enum: "ABW", "AFG", "AGO", "AIA", "ALA", "ALB", "AND", "ARE", "ARG", "ARM", "ASM", "ATA", "ATF", "ATG", "AUS", "AUT", "AZE", "BDI", "BEL", "BEN", "BES", "BFA", "BGD", "BGR", "BHR", "BHS", "BIH", "BLM", "BLR", "BLZ", "BMU", "BOL", "BRA", "BRB", "BRN", "BTN", "BVT", "BWA", "CAF", "CAN", "CCK", "CHE", "CHL", "CHN", "CIV", "CMR", "COD", "COG", "COK", "COL", "COM", "CPV", "CRI", "CUB", "CUW", "CXR", "CYM", "CYP", "CZE", "DEU", "DJI", "DMA", "DNK", "DOM", "DZA", "ECU", "EGY", "ERI", "ESH", "ESP", "EST", "ETH", "FIN", "FJI", "FLK", "FRA", "FRO", "FSM", "GAB", "GBR", "GEO", "GGY", "GHA", "GIB", "GIN", "GLP", "GMB", "GNB", "GNQ", "GRC", "GRD", "GRL", "GTM", "GUF", "GUM", "GUY", "HKG", "HMD", "HND", "HRV", "HTI", "HUN", "IDN", "IMN", "IND", "IOT", "IRL", "IRN", "IRQ", "ISL", "ISR", "ITA", "JAM", "JEY", "JOR", "JPN", "KAZ", "KEN", "KGZ", "KHM", "KIR", "KNA", "KOR", "KWT", "LAO", "LBN", "LBR", "LBY", "LCA", "LIE", "LKA", "LSO", "LTU", "LUX", "LVA", "MAC", "MAF", "MAR", "MCO", "MDA", "MDG", "MDV", "MEX", "MHL", "MKD", "MLI", "MLT", "MMR", "MNE", "MNG", "MNP", "MRT", "MSR", "MTQ", "MUS", "MWI", "MYS", "MYT", "NAM", "NCL", "NER", "NFK", "NGA", "NIC", "NIU", "NLD", "NOR", "NPL", "NRU", "NZL", "OMN", "PAK", "PAN", "PCN", "PER", "PHL", "PLW", "PNG", "POL", "PRI", "PRK", "PRT", "PRY", "PSE", "PYF", "QAT", "REU", "ROU", "RUS", "RWA", "SAU", "SDN", "SEN", "SGP", "SGS", "SHN", "SJM", "SLB", "SLE", "SLV", "SMR", "SOM", "SPM", "SRB", "SSD", "STP", "SUR", "SVK", "SVN", "SWE", "SWZ", "SXM", "SYC", "SYR", "TCA", "TCD", "TGO", "THA", "TJK", "TKL", "TKM", "TLS", "TON", "TTO", "TUN", "TUR", "TUV", "TWN", "TZA", "UGA", "UKR", "UMI", "URY", "USA", "UZB", "VAT", "VCT", "VEN", "VGB", "VIR", "VNM", "VUT", "WLF", "WSM", "XKX", "YEM", "ZAF", "ZMB", "ZWE"

• address_verification (string)

  • Details the results of verifying address with the issuing bank.

• Set to UNKNOWN when address gets updated.
  Enum: "POSTAL_CODE_AND_STREET_MATCH", "STREET_MATCH", "POSTAL_CODE_MATCH", "NO_ADDRESS", "NO_MATCH", "NOT_SUPPORTED", "UNKNOWN"

• application (string)
  ID of the Application the resource was created under.

• bin (string)
  Bank Identification number for the Payment Instrument.

• brand (string)
  The brand of the card saved in the Payment Instrument.
  Enum: "UNKNOWN", "DINERS_CLUB_INTERNATIONAL", "DANKORT", "MIR", "TROY", "UATP", "CHINA_T_UNION", "CHINA_UNION_PAY", "AMERICAN_EXPRESS", "VERVE", "RUPAY", "DISCOVER", "JCB", "MASTERCARD", "INTERPAYMENT", "INSTAPAYMENT", "MAESTRO", "VISA", "LANKAPAY", "DINERS_CLUB", "INTERAC"

• card_type (string)
  The type of payment card saved in the Payment Instrument.
  Enum: "CREDIT", "DEBIT", "HSA_FSA", "NON_RELOADABLE_PREPAID", "RELOADABLE_PREPAID", "UNKNOWN"

• country (string,null)
  Enum: "ABW", "AFG", "AGO", "AIA", "ALA", "ALB", "AND", "ARE", "ARG", "ARM", "ASM", "ATA", "ATF", "ATG", "AUS", "AUT", "AZE", "BDI", "BEL", "BEN", "BES", "BFA", "BGD", "BGR", "BHR", "BHS", "BIH", "BLM", "BLR", "BLZ", "BMU", "BOL", "BRA", "BRB", "BRN", "BTN", "BVT", "BWA", "CAF", "CAN", "CCK", "CHE", "CHL", "CHN", "CIV", "CMR", "COD", "COG", "COK", "COL", "COM", "CPV", "CRI", "CUB", "CUW", "CXR", "CYM", "CYP", "CZE", "DEU", "DJI", "DMA", "DNK", "DOM", "DZA", "ECU", "EGY", "ERI", "ESH", "ESP", "EST", "ETH", "FIN", "FJI", "FLK", "FRA", "FRO", "FSM", "GAB", "GBR", "GEO", "GGY", "GHA", "GIB", "GIN", "GLP", "GMB", "GNB", "GNQ", "GRC", "GRD", "GRL", "GTM", "GUF", "GUM", "GUY", "HKG", "HMD", "HND", "HRV", "HTI", "HUN", "IDN", "IMN", "IND", "IOT", "IRL", "IRN", "IRQ", "ISL", "ISR", "ITA", "JAM", "JEY", "JOR", "JPN", "KAZ", "KEN", "KGZ", "KHM", "KIR", "KNA", "KOR", "KWT", "LAO", "LBN", "LBR", "LBY", "LCA", "LIE", "LKA", "LSO", "LTU", "LUX", "LVA", "MAC", "MAF", "MAR", "MCO", "MDA", "MDG", "MDV", "MEX", "MHL", "MKD", "MLI", "MLT", "MMR", "MNE", "MNG", "MNP", "MOZ", "MRT", "MSR", "MTQ", "MUS", "MWI", "MYS", "MYT", "NAM", "NCL", "NER", "NFK", "NGA", "NIC", "NIU", "NLD", "NON_USA", "NOR", "NPL", "NRU", "NZL", "OMN", "PAK", "PAN", "PCN", "PER", "PHL", "PLW", "PNG", "POL", "PRI", "PRK", "PRT", "PRY", "PSE", "PYF", "QAT", "REU", "ROU", "RUS", "RWA", "SAU", "SDN", "SEN", "SGP", "SGS", "SHN", "SJM", "SLB", "SLE", "SLV", "SMR", "SOM", "SPM", "SRB", "SSD", "STP", "SUR", "SVK", "SVN", "SWE", "SWZ", "SXM", "SYC", "SYR", "TCA", "TCD", "TGO", "THA", "TJK", "TKL", "TKM", "TLS", "TON", "TTO", "TUN", "TUR", "TUV", "TWN", "TZA", "UGA", "UKR", "UMI", "URY", "USA", "UZB", "VAT", "VCT", "VEN", "VGB", "VIR", "VNM", "VUT", "WLF", "WSM", "YEM", "ZAF", "ZMB", "ZWE"

• currency (string)
  ISO 4217 3-letter currency code.
  Enum: "CAD", "USD"

• disabled_code (string,null)
  A code indicating why the Payment Instrument was disabled. This field is set when:

• The system automatically disables the Payment Instrument.

• A user manually disables it (returns USER_INITIATED).

See disabled_message for all possible codes and their descriptions.
Enum: "CARD_ACCOUNT_CLOSED", "INVALID_ACCOUNT_NUMBER", "LOST_OR_STOLEN_CARD", "NON_RELOADABLE_INSUFFICIENT_FUNDS", "PICK_UP_CARD", "RESTRICTED_CARD", "USER_INITIATED"

• disabled_message (string,null)
  A human-readable message explaining why the Payment Instrument was disabled. This field provides additional context for the disabled_code.

The possible error codes/messages are:

• CARD_ACCOUNT_CLOSED: "The card account has been closed. The card has been disabled to prevent further use."

• INVALID_ACCOUNT_NUMBER: "The card number is not valid. The card has been disabled to prevent further use."

• LOST_OR_STOLEN_CARD: "The card is reported lost or stolen. The card has been disabled to prevent further use."

• NON_RELOADABLE_INSUFFICIENT_FUNDS: "The card has insufficient funds for the transaction and is non-reloadable. The card has been disabled to prevent further use."

• PICK_UP_CARD: "The card is reported lost or stolen. The card has been disabled to prevent further use."

• RESTRICTED_CARD: "The card has a restriction preventing approval for this transaction. The card has been disabled to prevent further use."

• USER_INITIATED: "The card has been disabled by a user."

• enabled (boolean)
  Indicates whether the Payment Instrument resource is enabled. The default value is true; set it to false to disable the Payment Instrument. The user or the system can update this field to enable or disable the payment instrument.

• expiration_month (integer)
  Expiration month (e.g. 12 for December).

• expiration_year (integer)
  4-digit expiration year.

• fast_funds_indicator (string)
  Details if Fast Funds is enabled for the card.

• fingerprint (string)
  Unique ID that represents the tokenized card data.
  Example: "FPRxxxxxxxxxxxxxxxxx"

• identity (string)
  The ID of the Identity used to create the resource.

• instrument_type (string)
  The type of Payment Instrument.
  Enum: "PAYMENT_CARD", "PAYMENT_CARD_PRESENT", "TOKEN"

• issuer_country (string)
  The Alpha-3 Code of the country the card was issued in.

In addition, the following values are possible:

• NON_USA - The card was issued outside of the United States.

• UNKNOWN - The processor did not return an issuer country for this particular BIN.
  Enum: "ABW", "AFG", "AGO", "AIA", "ALA", "ALB", "AND", "ARE", "ARG", "ARM", "ASM", "ATA", "ATF", "ATG", "AUS", "AUT", "AZE", "BDI", "BEL", "BEN", "BES", "BFA", "BGD", "BGR", "BHR", "BHS", "BIH", "BLM", "BLR", "BLZ", "BMU", "BOL", "BRA", "BRB", "BRN", "BTN", "BVT", "BWA", "CAF", "CAN", "CCK", "CHE", "CHL", "CHN", "CIV", "CMR", "COD", "COG", "COK", "COL", "COM", "CPV", "CRI", "CUB", "CUW", "CXR", "CYM", "CYP", "CZE", "DEU", "DJI", "DMA", "DNK", "DOM", "DZA", "ECU", "EGY", "ERI", "ESH", "ESP", "EST", "ETH", "FIN", "FJI", "FLK", "FRA", "FRO", "FSM", "GAB", "GBR", "GEO", "GGY", "GHA", "GIB", "GIN", "GLP", "GMB", "GNB", "GNQ", "GRC", "GRD", "GRL", "GTM", "GUF", "GUM", "GUY", "HKG", "HMD", "HND", "HRV", "HTI", "HUN", "IDN", "IMN", "IND", "IOT", "IRL", "IRN", "IRQ", "ISL", "ISR", "ITA", "JAM", "JEY", "JOR", "JPN", "KAZ", "KEN", "KGZ", "KHM", "KIR", "KNA", "KOR", "KWT", "LAO", "LBN", "LBR", "LBY", "LCA", "LIE", "LKA", "LSO", "LTU", "LUX", "LVA", "MAC", "MAF", "MAR", "MCO", "MDA", "MDG", "MDV", "MEX", "MHL", "MKD", "MLI", "MLT", "MMR", "MNE", "MNG", "MNP", "MOZ", "MRT", "MSR", "MTQ", "MUS", "MWI", "MYS", "MYT", "NAM", "NCL", "NER", "NFK", "NGA", "NIC", "NIU", "NLD", "NON_USA", "NOR", "NPL", "NRU", "NZL", "OMN", "PAK", "PAN", "PCN", "PER", "PHL", "PLW", "PNG", "POL", "PRI", "PRK", "PRT", "PRY", "PSE", "PYF", "QAT", "REU", "ROU", "RUS", "RWA", "SAU", "SDN", "SEN", "SGP", "SGS", "SHN", "SJM", "SLB", "SLE", "SLV", "SMR", "SOM", "SPM", "SRB", "SSD", "STP", "SUR", "SVK", "SVN", "SWE", "SWZ", "SXM", "SYC", "SYR", "TCA", "TCD", "TGO", "THA", "TJK", "TKL", "TKM", "TLS", "TON", "TTO", "TUN", "TUR", "TUV", "TWN", "TZA", "UGA", "UKR", "UMI", "UNKNOWN", "URY", "USA", "UZB", "VAT", "VCT", "VEN", "VGB", "VIR", "VNM", "VUT", "WLF", "WSM", "YEM", "ZAF", "ZMB", "ZWE"

• last_four (string)
  Last four digits of the card.

• name (string,null)
  The name of the card owner.

• network_token_enabled (boolean)
  When enabled, a "network token" replaces raw card details (e.g., the 16-digit PAN and expiration date) for transactions. Network tokens have several benefits:

• The token offers increased authorization rates, even for lost or stolen cards, as it remains valid while the physical card is replaced.

• Visa reduces interchange fees when using network tokens.

• Tokens enhance security by replacing card details with a non-sensitive string that is usable only within the Finix system.

Note: Cards created before the feature is enabled are unaffected. To include them, update the individual Payment Instrument to set network_token_enabled to true.

• network_token_state (string)
  The state of the network token. The possible enum values are as follows:

• NOT_ENABLED: The network_token_state is NOT_ENABLED when the value of network_token_enabled on the Payment Instrument is false.

• PENDING: Immediately after Finix enables network tokens for a specific card, network_token_state is initially set to PENDING.

• ACTIVE: After Finix receives the network token successfully from the card network, network_token_state updates to ACTIVE.

• FAILED: In the event that there is an issue with the card network such as service becomes unavailable, FAILED is returned.

• SUSPENDED: When the issuing bank does not allow the network token to be used in transactions, SUSPENDED is returned.

• CLOSED: In the event that the issuing bank has closed the card permanently, CLOSED is returned. Enum: "ACTIVE", "CLOSED", "FAILED", "NOT_ENABLED", "SUSPENDED", "PENDING"

• payload_type (string)
  Enum: "SOURCE", "DESTINATION"

• push_funds_block_indicator (string)
  Details if the card is enabled to receive push-to-card disbursements.

• name_verification_results (object,null)
  Details the results of verifying the cardholder's name with the issuing bank. Returns null if name_verification_details was not included in the request.

• name_verification_results.first_name_verification (string)
  The result of verifying the cardholder's first name.
  Enum: "MATCH", "NO_MATCH", "NOT_SUPPORTED", "PARTIAL_MATCH", "UNKNOWN"

• name_verification_results.last_name_verification (string)
  The result of verifying the cardholder's last name.
  Enum: "MATCH", "NO_MATCH", "NOT_SUPPORTED", "PARTIAL_MATCH", "UNKNOWN"

• name_verification_results.middle_name_verification (string)
  The result of verifying the cardholder's middle name.
  Enum: "MATCH", "NO_MATCH", "NOT_SUPPORTED", "PARTIAL_MATCH", "UNKNOWN"

• name_verification_results.name_verification (string)
  The result of verifying the cardholder's full name.
  Enum: "MATCH", "NO_MATCH", "NOT_SUPPORTED", "PARTIAL_MATCH", "UNKNOWN"

• security_code_verification (string)
  Details the results of the Card Verification Code check.
  Enum: "MATCHED", "UNKNOWN", "UNMATCHED"

• tags (object,null)
  Include up to 50 key: value pairs to annotate requests with custom metadata.

• Maximum character length for individual keys is 40.

• Maximum character length for individual values is 500. (For example, order_number: 25, item_type: produce, department: sales)

• third_party (string,null)
  This field is not applicable to payment cards.

• third_party_token (string,null)
  This field is not applicable to payment cards.

• type (string)
  Type of Payment Instrument.
  Enum: "PAYMENT_CARD", "TOKEN", "GOOGLE_PAY", "APPLE_PAY"

• _links (object)
  For your convenience, every response includes several URLs which link to resources relevant to the request. You can use these _links to make your follow-up requests and quickly access relevant IDs.

• _links.application (object)
  Link to the Application the request was made under.

• _links.application.href (string)

• _links.authorizations (object)
  Link to the Authorizations created under the resource.

• _links.authorizations.href (string)

• _links.identity (object)
  Link to the Identity the request was made under.

• _links.identity.href (string)

• _links.self (object)
  Link to the resource that was used in the request.

• _links.self.href (string)

• _links.transfers (object)
  Link to the Transfers created under the resource.

• _links.transfers.href (string)

• _links.updates (object)
  Link to the Updates created under the resource.

• _links.updates.href (string)

• _links.verifications (object)
  Link to the Verification that was used to verify the Merchant that the request was made under.

• _links.verifications.href (string)

Response 400 fields (application/json):

• total (integer, required)
  Total number of errors returned.

• _embedded (object, required)
  Container for embedded error objects.

• _embedded.errors (array)
  List of individual error objects.

• _embedded.errors.code (string)
  The error code. The UNKNOWN error code is returned for a 401 Unauthorized or 403 Forbidden request.

• _embedded.errors.logref (string)
  A log reference identifier for the error, useful for debugging and support purposes.

• _embedded.errors.message (string)
  A human-friendly error message.

• _embedded.errors._links (object)
  Links related to this error.

• _embedded.errors._links.self (object)
  Link to the resource related to the error.

• _embedded.errors._links.self.href (string)
  URL of the related resource.

Response 401 fields (application/json):

• total (integer, required)
  Total number of errors returned.

• _embedded (object, required)
  Container for embedded error objects.

• _embedded.errors (array)
  List of individual error objects.

• _embedded.errors.code (string)
  The error code. The UNKNOWN error code is returned for a 401 Unauthorized or 403 Forbidden request.

• _embedded.errors.logref (string)
  A log reference identifier for the error, useful for debugging and support purposes.

• _embedded.errors.message (string)
  A human-friendly error message.

• _embedded.errors._links (object)
  Links related to this error.

• _embedded.errors._links.self (object)
  Link to the resource related to the error.

• _embedded.errors._links.self.href (string)
  URL of the related resource.

Response 403 fields (application/json):

• total (integer, required)
  Total number of errors returned.

• _embedded (object, required)
  Container for embedded error objects.

• _embedded.errors (array)
  List of individual error objects.

• _embedded.errors.code (string)
  The error code. The UNKNOWN error code is returned for a 401 Unauthorized or 403 Forbidden request.

• _embedded.errors.logref (string)
  A log reference identifier for the error, useful for debugging and support purposes.

• _embedded.errors.message (string)
  A human-friendly error message.

• _embedded.errors._links (object)
  Links related to this error.

• _embedded.errors._links.self (object)
  Link to the resource related to the error.

• _embedded.errors._links.self.href (string)
  URL of the related resource.

Response 404 fields (application/json):

• total (integer, required)
  Total number of errors returned.

• _embedded (object, required)
  Container for embedded error objects.

• _embedded.errors (array)
  List of individual error objects.

• _embedded.errors.code (string)
  The error code. The UNKNOWN error code is returned for a 401 Unauthorized or 403 Forbidden request.

• _embedded.errors.logref (string)
  A log reference identifier for the error, useful for debugging and support purposes.

• _embedded.errors.message (string)
  A human-friendly error message.

• _embedded.errors._links (object)
  Links related to this error.

• _embedded.errors._links.self (object)
  Link to the resource related to the error.

• _embedded.errors._links.self.href (string)
  URL of the related resource.

Response 406 fields (application/json):

• total (integer, required)
  Total number of errors returned.

• _embedded (object, required)
  Container for embedded error objects.

• _embedded.errors (array)
  List of individual error objects.

• _embedded.errors.code (string)
  The error code. The UNKNOWN error code is returned for a 401 Unauthorized or 403 Forbidden request.

• _embedded.errors.logref (string)
  A log reference identifier for the error, useful for debugging and support purposes.

• _embedded.errors.message (string)
  A human-friendly error message.

• _embedded.errors._links (object)
  Links related to this error.

• _embedded.errors._links.self (object)
  Link to the resource related to the error.

• _embedded.errors._links.self.href (string)
  URL of the related resource.