Payment Method

Payment Method: Update

See also the Payment Method response object.

note

If you have card verification enabled, any updates made to credit cards are subject to those rules.

  1. PHP
$result = $gateway->paymentMethod()->update(
  'the_token',
  [
    'billingAddress' => [
        'streetAddress' => '100 Maple Lane',
        'options' => [
            'updateExisting' => true
        ]
    ]
]);
Arguments
tokenrequired, string
The alphanumeric value that references a specific payment method stored in your Vault.
Additional Parameters
A billing address associated with a specific customer ID. It can be further associated with a specific payment method. The maximum number of addresses per customer is 50.
'company'string
Company name. 255 character maximum.

The ISO 3166-1 alpha-2 country code specified in an address. The gateway only accepts specific alpha-2 values.

The ISO 3166-1 alpha-3 country code specified in an address. The gateway only accepts specific alpha-3 values.

The ISO 3166-1 numeric country code specified in an address. The gateway only accepts specific numeric values.

The country name specified in an address. Braintree only accepts specific country names.

The extended address information—such as apartment or suite number. 255 character maximum.
The first name. The first name value must be less than or equal to 255 characters.
The phone number that belongs to the address that is structured with country code and national number.
Country code of phone number. 1-3 digits. Required.
National number of phone number. 4-12 digits. Required.
The last name. The last name value must be less than or equal to 255 characters.
The locality/city. 255 character maximum.
Optional values that can be passed with a request.
Update the billing address associated with the payment method token specified. Other payment methods associated with the same billing address will have their addresses updated, as well.

Deprecated.

We recommend using international_phone. This functionality still exists in the gateway but is no longer documented. This parameter will be removed in the future.

The postal code. Postal code must be a string of 4-9 alphanumeric characters, optionally separated by a dash or a space. Spaces and hyphens are ignored.
'region'string
The state or province. For PayPal addresses, the region must meet PayPal's state restrictions; for all other payment methods, it must be less than or equal to 255 characters.
The billing street address. 255 character maximum. Required to perform card verification when AVS rules are configured to require street address.
The two-letter value for an address associated with a specific customer ID. The maximum number of addresses per customer is 50.
The cardholder name associated with the credit card. 175 character maximum.
'cvv'string

Typically requires PCI SAQ D compliance

We recommend using paymentMethodNonce to avoid any PCI concerns with raw credit card data being present on your server.

A 3 or 4 digit card verification value assigned to credit cards. The CVV will never be stored in the gateway, but it can be provided with one-time requests to verify the card.

Customer device information. Pass this value only if you have Premium Fraud Management Tools enabled and are adding credit card data to your Vault. Be sure to provide the full string received from the Braintree client SDK.

While we recommend using paymentMethodNonce when updating raw credit card data, the expiration date can be updated directly without any PCI concerns as long as you do not store, process, or transmit the raw PAN or CVV.

The expiration date, formatted MM/YY or MM/YYYY. May be used instead of expirationMonth and expirationYear.

While we recommend using paymentMethodNonce when updating raw credit card data, the expiration month can be updated directly without any PCI concerns as long as you do not store, process, or transmit the raw PAN or CVV.

The expiration month of a credit card, formatted MM. May be used with expirationYear, and instead of expirationDate.

While we recommend using paymentMethodNonce when updating raw credit card data, the expiration year can be updated directly without any PCI concerns as long as you do not store, process, or transmit the raw PAN or CVV.

The two or four digit year associated with a credit card, formatted YYYY or YY. May be used with expirationMonth, and instead of expirationDate.

'number'string

Typically requires PCI SAQ D compliance

We recommend using paymentMethodNonce to avoid any PCI concerns with raw credit card data being present on your server.

The 12-19 digit value consisting of a bank identification number (BIN) and primary account number (PAN).

If this option is passed and the same payment method has already been added to the Vault for any customer, the request will fail. This option will be ignored for PayPal, Pay with Venmo, Apple Pay, Google Pay, Samsung and ACH payment methods.
If this option is passed and the same payment method has already been added to the Vault for the same customer, the request will fail. This option can only be used for customers with at most 100 credit cards, cannot be used in combination with the fail_on_duplicate_payment_method option, and is ignored for PayPal, Pay with Venmo, Apple Pay, Google Pay, Samsung and ACH payment methods.

If the payment method is a Credit Card or Paypal Account, this option makes the specified payment method the default for the customer. See example below.

Prevents the verification from being evaluated as part of Premium Fraud Management Tools checks. Use with caution – once you've skipped checks for a verification, it is not possible to run them retroactively.

This functionality still exists in the gateway but is no longer documented. Will remove this param/attr when the corresponding gateway code is removed.

Type of verification add ons for network check. Possible values:

  • customer_verification
Specify a non-negative amount that you want to use to verify a card. If you do not pass this option, the gateway will automatically use a verification amount of $0 or $1, depending on the processor and/or card type.

Specify the merchant account ID that you want to use to verify a card. See the merchantAccountId on Transaction: Sale to learn more. The merchant account can't be a marketplace sub-merchant account. See the Braintree Marketplace Guide to learn more.

If the payment method is a credit card, this option prompts the gateway to verify the card's number and expiration date. It also verifies the AVS and CVV information if you've enabled AVS and CVV rules.

note

Braintree strongly recommends verifying all cards before they are stored in your Vault by enabling card verification for your entire account in the Control Panel.

In some cases, cardholders may see a temporary authorization on their account after their card has been verified. The authorization will fall off the cardholder's account within a few days and will never settle.

Only returns a Credit Card Verification result if verification runs and is unsuccessful.

One-time-use reference to new card details provided by your customer. Can only be used on payment method update if the payment method type is a card; other payment method types do not allow their details to be updated. See example below.

Results of a merchant-performed 3D Secure authentication. You will only need to use these fields if you've performed your own integration with a 3D Secure MPI provider (e.g. Cardinal Centinel). Otherwise, Braintree's SDKs handle this for you in our standard 3D Secure integration.

'cavv'string

Cardholder authentication verification value or CAVV. The main encrypted message issuers and card networks use to verify authentication has occurred. Mastercard uses an AVV message and American Express uses an AEVV message, each of which should also be passed in the cavv parameter.

Transaction identifier resulting from 3D Secure 2 authentication. This field must be supplied for Mastercard Identity Check.

'eciFlag'string

The value of the electronic commerce indicator (ECI) flag, which indicates the outcome of the 3DS authentication.

Accepted values for Mastercard:

  • 00 = Failed or not attempted
  • 01 = Attempted
  • 02 = Success
  • 04 = Data-Only (Applies to limited processors)

Accepted values for all other card brands:

  • 07 = Failed or not attempted
  • 06 = Attempted
  • 05 = Success

The version of 3D Secure authentication used for the transaction. Required on Visa and Mastercard authentications. Must be composed of digits separated by periods (e.g. 1.0.2).

'xid'string

Transaction identifier resulting from 3D Secure authentication. Uniquely identifies the transaction and sometimes required in the authorization message. Must be base64-encoded. This field will no longer be used in 3D Secure 2 authentications.

'token'string
If provided, updates the token for the payment method.

Examplesanchor

Update billing addressanchor

To update the existing billing address when updating a payment method use the updateExisting option. If any other payment methods are associated with the same billing address, this will also update the billing address for those payment methods.

  1. PHP
$result = $gateway->paymentMethod()->update(
  'the_token',
  [
    'billingAddress' => [
        'streetAddress' => '100 Maple Lane',
        'options' => [
            'updateExisting' => true
        ]
    ]
]);

If the payment method can't be found, you'll receive a Braintree\Exception\NotFound exception.

New billing addressanchor

If you don't use the updateExisting option, a new address will be created. The existing billing address will remain in the Vault associated with the customer.

  1. PHP
$result = $gateway->paymentMethod()->update(
  'the_token',
  [
    'billingAddress' => [
        'firstName' => 'Drew',
        'lastName' => 'Smith',
        'company' => 'Smith Co.',
        'streetAddress' => '1 E Main St',
        'region' => 'IL',
        'postalCode' => '60622'
    ]
  ]
);

Update with existing billing addressanchor

If a customer already has an address you'd like to use, you can update the payment method with that address.

  1. PHP
$result = $gateway->paymentMethod()->update(
  'the_token',
  [
    'billingAddressId' => 'theBillingAddressId'
  ]
);

Updating a PayPal account tokenanchor

The only fields that may be updated on a PayPal account are the token associated with that account, and setting the account as the default payment method for a customer.

  1. PHP
$result = $gateway->payPalAccount()->update($originalToken, [
    'token' => $newToken
]);

Make defaultanchor

If the payment method is a credit card or PayPal account, you can use this call to set the payment method as the customer's default. For all other payment method types, use defaultPaymentMethodToken on Customer: Update instead.

  1. PHP
$updateResult = $gateway->paymentMethod()->update(
  'the_token',
  [
    'options' => [
      'makeDefault' => true
    ]
  ]
);
note

This only works with credit cards and PayPal accounts. We recommend updating the customer to set a default payment method.

Card verificationanchor

By default we will run credit card validations but not perform verification . Braintree strongly recommends verifying all cards before they are stored in your Vault by enabling card verification for your entire account in the Control Panel. If you choose to manually verify cards, set verifyCard to true .

If you have AVS/CVV checks enabled, they will be performed when you call the payment method update. To skip these checks, set verifyCard to false.

  1. PHP
$result = $gateway->paymentMethod()->update('the_payment_method_token', [
    'paymentMethodNonce' => nonceFromTheClient,
    'options' => [
        'verifyCard' => true
    ]
]);
important

If you are using our Premium Fraud Management Tools, we strongly recommend passing deviceData each time you verify a card.

Updating with a nonce and additional parametersanchor

When updating the credit card information with a nonce, you may pass additional parameters to update as well. Here is an example of updating a payment method and explicitly verifying the card.

important

If a field is passed from the client and included in the nonce data (such as postal code) it should not be passed as an explicit argument as well.

  1. PHP
$result = $gateway->paymentMethod()->update(
  'the_token',
  [
    'paymentMethodNonce' => nonceFromTheClient,
    'billingAddress' => [
        'firstName' => 'Drew',
        'lastName' => 'Smith',
        'company' => 'Smith Co.',
        'streetAddress' => '1 E Main St',
        'region' => 'IL'
    ]
  ]
);
note

Nonce used for updating a payment method must not be associated with any customer. A nonce that was created with a customer ID in authorization when used to update a payment method will raise a Braintree::CannotUpdateCardUsingPaymentMethodNonce.

important

If you are using our Premium Fraud Management Tools, we strongly recommend passing deviceData each time you verify a card.

To verify the AVS information of an existing payment method, pass the update request with verify_card set to "true". Note that an update will create a transaction, so if your processing options are set to reject transactions without CVV, you will need to include CVV as a parameter, or disable this rule (see below).

To disable the CVV requirement:

  1. Log into the Control Panel
  2. Click on the gear icon in the top right corner
  3. Click Fraud Management from the drop-down menu
  4. Next to CVV, click the Options link
  5. Under the Reject Transactions & Verifications If section, uncheck the CVV Not Provided (I) box

Payment method nonces vs. raw card dataanchor

While it is possible to pass both raw card data and a payment method nonce in the same call, we recommend passing only a payment method nonce.

Passing both will result in a payment method that has a mix of their attributes, with precedence given to the fields individually, then to the attributes of the payment method nonce. For example, if you pass both a card number and a payment method nonce, the payment method will have the number you passed explicitly, but the rest of the attributes will be obtained through the nonce.