APG PayAPG Paydocs

Payment sources

Update source

PATCH/sources/{sourceId}

Replace a card's verification code, or lift a block the platform placed on it. Selected by the body's type.

2 actionsPsrcUpdateCvcPsrcUpdateRemoveBlock

Permissions

Required permission

Required action depends on the request variant. Select a variant in the request body below to see the permission it requires.

Path parameters

sourceIdstring
required

Request body

This body is a typed union. Pick a variant to see its fields, the permission it requires, and a matching example.

Discriminated by type
type = "PsrcUpdateCvc"
Required permission
customerPaymentSources:update

Replace a card's verification code

cvcstringrequired

Write-only, tokenised by the vault, and never stored in the clear.

curl -X PATCH https://api.tst.au.apgpay.dev/sources/{sourceId} \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "type": "PsrcUpdateCvc",
  "cvc": "string"
}'

Responses

The response is a tagged shape: type is always "PsrcUpdateRspAttributes". Switch on it; subtypes can be added, and a client that already reads it will not break.

Discriminated by type
type = "PsrcUpdateRspAttributes"

The resource as it stands after the change.

Example
{
  "type": "PsrcUpdateRspAttributes",
  "updated": {
    "type": "PsrcViewCard",
    "sourceId": "psrc_9f2Kd8QpLzXw",
    "customerId": "cust_9f2Kd8QpLzXw",
    "merchantId": "mcht_9f2Kd8QpLzXw",
    "status": "Active",
    "last4": "4242",
    "bin": "424242",
    "brand": "Visa",
    "funding": "Credit",
    "expiryMonth": 6,
    "expiryYear": 2029,
    "issuerCountry": "AU",
    "currency": "AUD",
    "createdAt": "2026-08-19T04:21:07Z",
    "updatedAt": "2026-08-19T04:21:07Z"
  }
}

Error responses