Update an instrument

curl --request PATCH \
  --url https://api.staging.payrails.io/payment/instruments/{instrumentId} \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'x-idempotency-key: <x-idempotency-key>' \
  --data '{}'

{
  "status": "disabled",
  "id": "b8fe6271-5d71-4d28-b8e8-89e64acc0c49",
  "holderId": "788c7c09-a490-4603-915a-e2a957a6cca1",
  "createdAt": "2022-04-22T17:53:36.814Z",
  "updatedAt": "2022-04-22T17:53:36.814Z",
  "paymentMethod": "card",
  "displayName": "Visa **** 1111",
  "description": "Personal card.",
  "merchantReference": "ref_C47C47",
  "fingerprint": "739abff0-406a-4d32-8cfb-701e12be5848",
  "futureUsage": "CardOnFile",
  "networkTransactionReference": "987654321234567",
  "data": {
    "network": "visa",
    "bin": "411111",
    "suffix": "1111",
    "expiryMonth": "10",
    "expiryYear": "2026",
    "holderName": "John Doe",
    "billingAddress": {
      "country": {
        "code": "DE",
        "name": "Germany"
      },
      "postalCode": "10117"
    }
  }
}

{
  "errors": [
    {
      "id": "a24bc325-3929-4d9d-9c08-b3aa532685b7",
      "code": "request.malformed",
      "detail": "The request has malformed syntax",
      "docUrl": "https://docs.payrails.com/docs/resources/error-codes#requestmalformed"
    }
  ]
}

{
  "errors": [
    {
      "id": "a24bc325-3929-4d9d-9c08-b3aa532685b7",
      "code": "request.unauthorized",
      "detail": "The request lacks necessary credentials to perform the specified action",
      "docUrl": "https://docs.payrails.com/docs/resources/error-codes#requestunauthorized"
    }
  ]
}

{
  "errors": [
    {
      "id": "e7db22b3-914e-4975-928e-9edfb0885bea",
      "code": "request.forbidden",
      "detail": "The request credentials lack the required permissions to perform the specified action",
      "docUrl": "https://docs.payrails.com/docs/resources/error-codes#requestforbidden"
    }
  ]
}

{
  "errors": [
    {
      "id": "a24bc325-3929-4d9d-9c08-b3aa532685b7",
      "code": "request.not-found",
      "detail": "The requested resource was not found",
      "docUrl": "https://docs.payrails.com/docs/resources/error-codes#requestnot-found"
    }
  ]
}

{
  "errors": [
    {
      "id": "a24bc325-3929-4d9d-9c08-b3aa532685b7",
      "code": "request.rate-limit",
      "detail": "Too many requests",
      "docUrl": "https://docs.payrails.com/docs/resources/error-codes#requestrate-limit"
    }
  ]
}

PATCH

https://api.staging.payrails.io

payment

instruments

{instrumentId}

curl --request PATCH \
  --url https://api.staging.payrails.io/payment/instruments/{instrumentId} \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'x-idempotency-key: <x-idempotency-key>' \
  --data '{}'

{
  "status": "disabled",
  "id": "b8fe6271-5d71-4d28-b8e8-89e64acc0c49",
  "holderId": "788c7c09-a490-4603-915a-e2a957a6cca1",
  "createdAt": "2022-04-22T17:53:36.814Z",
  "updatedAt": "2022-04-22T17:53:36.814Z",
  "paymentMethod": "card",
  "displayName": "Visa **** 1111",
  "description": "Personal card.",
  "merchantReference": "ref_C47C47",
  "fingerprint": "739abff0-406a-4d32-8cfb-701e12be5848",
  "futureUsage": "CardOnFile",
  "networkTransactionReference": "987654321234567",
  "data": {
    "network": "visa",
    "bin": "411111",
    "suffix": "1111",
    "expiryMonth": "10",
    "expiryYear": "2026",
    "holderName": "John Doe",
    "billingAddress": {
      "country": {
        "code": "DE",
        "name": "Germany"
      },
      "postalCode": "10117"
    }
  }
}

{
  "errors": [
    {
      "id": "a24bc325-3929-4d9d-9c08-b3aa532685b7",
      "code": "request.malformed",
      "detail": "The request has malformed syntax",
      "docUrl": "https://docs.payrails.com/docs/resources/error-codes#requestmalformed"
    }
  ]
}

{
  "errors": [
    {
      "id": "a24bc325-3929-4d9d-9c08-b3aa532685b7",
      "code": "request.unauthorized",
      "detail": "The request lacks necessary credentials to perform the specified action",
      "docUrl": "https://docs.payrails.com/docs/resources/error-codes#requestunauthorized"
    }
  ]
}

{
  "errors": [
    {
      "id": "e7db22b3-914e-4975-928e-9edfb0885bea",
      "code": "request.forbidden",
      "detail": "The request credentials lack the required permissions to perform the specified action",
      "docUrl": "https://docs.payrails.com/docs/resources/error-codes#requestforbidden"
    }
  ]
}

{
  "errors": [
    {
      "id": "a24bc325-3929-4d9d-9c08-b3aa532685b7",
      "code": "request.not-found",
      "detail": "The requested resource was not found",
      "docUrl": "https://docs.payrails.com/docs/resources/error-codes#requestnot-found"
    }
  ]
}

{
  "errors": [
    {
      "id": "a24bc325-3929-4d9d-9c08-b3aa532685b7",
      "code": "request.rate-limit",
      "detail": "Too many requests",
      "docUrl": "https://docs.payrails.com/docs/resources/error-codes#requestrate-limit"
    }
  ]
}

Authorizations

Authorization

string

header

required

You can use an OAuth2 JWT bearer token in the Authorization header of your API requests for supported endpoints: Authorization: Bearer <YOUR_JWT_HERE>. These tokens are valid for 10 minutes and can be requested via the access token endpoint endpoint.

Headers

x-idempotency-key

string<uuid>

required

Idempotency key to be used. Sending again the same key would return the same result without re-executing the update.

Path Parameters

instrumentId

string<uuid>

required

Identifier of the resource in Payrails.

Body

application/json

status

enum<string>

New status of the Instrument. If you want to change to "deleted", you should use the DELETE endpoint instead. Also, note that some status are internal and cannot be changed via API, e.g. transient, etc. Status update requests can also be rejected if an instrument status cannot be changed to the desired one, e.g. deleted instruments.

Available options:

enabled,

disabled

networkTransactionReference

string

Identifier of the initial payment made with this instrument on the Networks, e.g. Mastercard Trace ID or Visa Transaction ID.

transactionLinkId

string

Mastercard Transaction Link Identifier (TLID) of the transaction series this instrument belongs to. Returned by the card network on the initial cardholder-initiated transaction and required on economically related merchant-initiated transactions, such as recurring payments and installments, when the series spans payment providers.

merchantReference

string

Merchant-provided reference for the instrument.

paymentMethod

enum<string>

New payment method of the instrument. Only the methods supporting instruments are accepted.

Available options:

applePay,

card,

googlePay,

payPal

default

boolean | null

True if the holder wants to make this instrument as default.

billingAddress

object

Information about a physical address.

Hide child attributes

billingAddress.street

string

The name of the street of a postal address.

billingAddress.doorNumber

string

The number on the door, building, or room.

billingAddress.complement

string

Additional addressing information, 2nd line of postal address.

billingAddress.area

string

The name of the suburb or area within a city.

billingAddress.city

string

The name of the city of a postal address.

billingAddress.postalCode

string

The postal code.

billingAddress.state

string

The name of the state a postal address is in.

billingAddress.country

object

The country where the address is in.

Hide child attributes

billingAddress.country.code

string

required

ISO 3166-1 alpha-2 country code.

Pattern: ^[A-Z]{2}$

billingAddress.country.iso3

string

ISO 3-letter country code. Returned by Payrails, but not interpreted in requests.

Pattern: ^[A-Z]{3}$

billingAddress.country.name

string

The English name of the country. Returned by Payrails, but not interpreted in requests.

billingAddress.latitude

number<float>

Latitude of the address in the GPS coordinate system.

billingAddress.longitude

number<float>

Longitude of the address in the GPS coordinate system.

billingAddress.phone

object

The phone to contact in the address (can be different that the customer's).

Hide child attributes

billingAddress.phone.number

string

required

The local number of the phone, such that countryCode + number can be dialed.

Pattern: ^[0-9]+$

billingAddress.phone.countryCode

string

International prefix of the phone, if known separately.

Pattern: ^\+?[0-9]+$

billingAddress.alias

string

Name of the address, e.g. home, work.

billingAddress.name

string

Name of the person to whom the address belongs to.

billingAddress.lastName

string

Last name of the person to whom the address belongs to.

billingAddress.email

string

Email of the person to whom the address belongs to.

Response

Success.

string<uuid>

required

Id of the instrument.

createdAt

string<date-time>

required

Date and time when the Instrument was created in Payrails.

updatedAt

string<date-time>

required

When the Instrument was last updated.

holderId

string<uuid>

required

Unique identifier of the Holder in Payrails.

paymentMethod

enum<string>

required

Represents the payment method type.

Available options:

alexBankMa7fazty,

applePay,

audi2pay,

bankAccount,

card,

2c2p,

vietQR,

cibSmartWallet,

easypaisa,

etisalatCash,

fawryMobileWallet,

fawryPay,

googlePay,

jazzCash,

nbePhoneCash,

orangeCash,

payPal,

qnbEWallet,

weCash,

genericRedirect,

alfa,

konnect,

eftPro,

netBanking,

upi,

cashFreeWallet,

paytmWallet,

phonePe,

iDeal,

bancontact,

klarnaPayLater,

klarnaPayNow,

klarnaPayOverTime,

scalapay,

payNow,

atome

status

enum<string>

required

Status of the instrument.

Available options:

created,

deleted,

enabled,

disabled,

transient

displayName

string

Instrument name suitable for display.

description

string

Description of the instrument.

default

boolean | null

True if this instrument is set as default for the holder.

merchantReference

string

Merchant-provided reference for the instrument.

fingerprint

string

System-wide unique identifier of the Instrument. If two Holders have the same instrument stored, this value will be the same for both, but the instrument and token IDs will be different. Cannot be used for payments, should only be used for analytics and fraud prevention.

futureUsage

enum<string>

Represents the future usage to define the payment flows that the stored instrument will be used for.

Available options:

Subscription,

CardOnFile,

UnscheduledCardOnFile

networkTransactionReference

string

Identifier of the initial payment made with this instrument on the Networks, e.g. Mastercard Trace ID or Visa Transaction ID.

transactionLinkId

string

data

Card · object

Type-specific information about the instrument.

Hide child attributes

data.network

enum<string>

required

Network of the instrument.

Available options:

unspecified,

visa,

visadankort,

mastercard,

amex,

diners,

discover,

unionpay,

unionpayuzcard,

maestro,

maestrobancontact,

hipercard,

jcb,

jcblankapay,

argencard,

aura,

belkart,

bpfuelcard,

cabal,

carnet,

cirrus,

chjonesfuelcard,

uzcard,

codensa,

dankort,

dinacard,

duet,

ebt,

eftpos,

elo,

euroshellfuelcard,

gecapital,

bc,

hrgstore,

humo,

lankapay,

lukoilfuelcard,

bancontact,

meeza,

newday,

mir,

ourocard,

pagobancomat,

paypak,

paypal,

phhfuelcard,

prostir,

rupay,

sbercard,

sodexo,

starrewards,

cencosud,

naranja,

troy,

uatp,

ukfuelcard,

verve,

voyager,

vpay,

wex,

cmi,

atm,

bankcard,

localbrand,

loyalty,

privatelabel,

fuelcard,

redfuelcard,

redliquidfuelcard

data.bin

string

required

First 6-8 digits of the Card number. Also known as IIN (Issuer Identification Number).

Required string length: 6 - 8

Example:

"416598"

data.suffix

string

required

Last digits of the Card number.

Required string length: 4

data.preferredScheme

enum<string>

Network of the instrument.

Available options:

unspecified,

visa,

visadankort,

mastercard,

amex,

diners,

discover,

unionpay,

unionpayuzcard,

maestro,

maestrobancontact,

hipercard,

jcb,

jcblankapay,

argencard,

aura,

belkart,

bpfuelcard,

cabal,

carnet,

cirrus,

chjonesfuelcard,

uzcard,

codensa,

dankort,

dinacard,

duet,

ebt,

eftpos,

elo,

euroshellfuelcard,

gecapital,

bc,

hrgstore,

humo,

lankapay,

lukoilfuelcard,

bancontact,

meeza,

newday,

mir,

ourocard,

pagobancomat,

paypak,

paypal,

phhfuelcard,

prostir,

rupay,

sbercard,

sodexo,

starrewards,

cencosud,

naranja,

troy,

uatp,

ukfuelcard,

verve,

voyager,

vpay,

wex,

cmi,

atm,

bankcard,

localbrand,

loyalty,

privatelabel,

fuelcard,

redfuelcard,

redliquidfuelcard

data.binLookup

object

Information about an issuer by the given BIN (or IIN).

Hide child attributes

data.binLookup.bin

string

required

First 6-8 digits of the Card number. Also known as IIN (Issuer Identification Number).

Required string length: 6 - 8

Example:

"416598"

data.binLookup.network

enum<string>

Network of the instrument.

Available options:

unspecified,

visa,

visadankort,

mastercard,

amex,

diners,

discover,

unionpay,

unionpayuzcard,

maestro,

maestrobancontact,

hipercard,

jcb,

jcblankapay,

argencard,

aura,

belkart,

bpfuelcard,

cabal,

carnet,

cirrus,

chjonesfuelcard,

uzcard,

codensa,

dankort,

dinacard,

duet,

ebt,

eftpos,

elo,

euroshellfuelcard,

gecapital,

bc,

hrgstore,

humo,

lankapay,

lukoilfuelcard,

bancontact,

meeza,

newday,

mir,

ourocard,

pagobancomat,

paypak,

paypal,

phhfuelcard,

prostir,

rupay,

sbercard,

sodexo,

starrewards,

cencosud,

naranja,

troy,

uatp,

ukfuelcard,

verve,

voyager,

vpay,

wex,

cmi,

atm,

bankcard,

localbrand,

loyalty,

privatelabel,

fuelcard,

redfuelcard,

redliquidfuelcard

data.binLookup.localNetwork

enum<string>

Card local network that supports the card, e.g. CartesBancaires, Dankort, Mada, Bancontact.

Available options:

bancontact,

cartesbancaires,

dankort,

mada

data.binLookup.issuer

string

Name of the bank or institution that issued the card.

data.binLookup.issuerCountry

object

Country of the bank or institution that issued the card.

Hide child attributes

data.binLookup.issuerCountry.code

string

required

ISO 3166-1 alpha-2 country code.

Pattern: ^[A-Z]{2}$

data.binLookup.issuerCountry.iso3

string

ISO 3-letter country code. Returned by Payrails, but not interpreted in requests.

Pattern: ^[A-Z]{3}$

data.binLookup.issuerCountry.name

string

The English name of the country. Returned by Payrails, but not interpreted in requests.

data.binLookup.segment

string

Segment of the card, e.g. gold, black, business.

data.binLookup.type

string

Type of the card, e.g. credit, debit, prepaid, gift.

data.binLookup.typeDetails

string

More information about the card type, e.g. personal, commercial.

data.binLookup.isNetworkToken

boolean

Indicates whether the card credential represents a network token rather than a primary account number (PAN).

data.binLookup.isFlexCard

boolean

Indicates whether the card is enrolled in a Flexible Credential or Flex Card program supported by the network - e.g. Visa Flexible Credential, Mastercard FlexCard.

data.billingAddress

object

Billing Address of the instrument.

Hide child attributes

data.billingAddress.street

string

The name of the street of a postal address.

data.billingAddress.doorNumber

string

The number on the door, building, or room.

data.billingAddress.complement

string

Additional addressing information, 2nd line of postal address.

data.billingAddress.area

string

The name of the suburb or area within a city.

data.billingAddress.city

string

The name of the city of a postal address.

data.billingAddress.postalCode

string

The postal code.

data.billingAddress.state

string

The name of the state a postal address is in.

data.billingAddress.country

object

The country where the address is in.

Hide child attributes

data.billingAddress.country.code

string

required

ISO 3166-1 alpha-2 country code.

Pattern: ^[A-Z]{2}$

data.billingAddress.country.iso3

string

ISO 3-letter country code. Returned by Payrails, but not interpreted in requests.

Pattern: ^[A-Z]{3}$

data.billingAddress.country.name

string

The English name of the country. Returned by Payrails, but not interpreted in requests.

data.billingAddress.latitude

number<float>

Latitude of the address in the GPS coordinate system.

data.billingAddress.longitude

number<float>

Longitude of the address in the GPS coordinate system.

data.billingAddress.phone

object

The phone to contact in the address (can be different that the customer's).

Hide child attributes

data.billingAddress.phone.number

string

required

The local number of the phone, such that countryCode + number can be dialed.

Pattern: ^[0-9]+$

data.billingAddress.phone.countryCode

string

International prefix of the phone, if known separately.

Pattern: ^\+?[0-9]+$

data.billingAddress.alias

string

Name of the address, e.g. home, work.

data.billingAddress.name

string

Name of the person to whom the address belongs to.

data.billingAddress.lastName

string

Last name of the person to whom the address belongs to.

data.billingAddress.email

string

Email of the person to whom the address belongs to.

data.expiryMonth

string

Expiry month of the Card.

Required string length: 2

data.expiryYear

string

Expiry year of the Card.

Required string length: 4

data.holderName

string

Name of the owner of the Card.

data.taxId

string

Payer-provided tax identification number (e.g. CPF in Brazil) collected on the instrument.

tokens

object[]

List of tokens inside the instrument. Not included by default, includeTokens query parameter must be used.

Hide child attributes

tokens.id

string<uuid>

required

Id of the token in Payrails.

tokens.createdAt

string<date-time>

required

Date and time when the Token was created in Payrails.

tokens.updatedAt

string<date-time>

required

When the Token was last updated.

tokens.instrumentId

string<uuid>

required

Id of the payment instrument the token belongs to.

tokens.status

enum<string>

required

Status of the token.

Available options:

created,

enabled,

disabled,

deleted

tokens.type

enum<string>

required

Type of the token.

Available options:

network,

vault,

psp,

networkOffers,

networkGateway

tokens.providerId

string<uuid>

required

Id of the provider the token belongs to.

tokens.reference

string

required

Unique identifier of the token in the provider's system.

tokens.providerConfigId

string<uuid>

Id of the configuration in the provider the token belongs to.

tokens.meta

object

Any merchant or provider-specific data that should be stored for context in the token.

Last modified on October 9, 2026

Payrails API Reference

Get started

Workflow

Payment

Provider

Merchant

Vault

Analytics

Reporting

Reconciliation

Dispute

Authorizations

Headers

Path Parameters

Body

Response