> For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://developer.americanexpress.ferndocs.com/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://developer.americanexpress.ferndocs.com/_mcp/server. # Modify a Card User PUT https://api.qasb2s.americanexpress.com/commercial/v1/card_on_demand/cardusers/{cardUserId} Content-Type: application/json Updates an existing Card User's information, such as the residential address, phone, or email. After a Card User's information is updated, a status change notification might be sent within eight calendar days due to the Card User's status changing during the regular risk reviews performed using the updated information. Reference: https://developer.americanexpress.ferndocs.com/payment-services/card-on-demand/api-reference/modify-card-user ## Authentication - `Authorization` header (bearer token, required) — OAuth 2.0 client credentials. Exchange your API key and secret for a bearer token, then send it as `Authorization: Bearer `. ## Servers - `https://api.qasb2s.americanexpress.com/commercial/v1/card_on_demand` (Sandbox, default) - `https://api.americanexpress.com/commercial/v1/card_on_demand` (Production) ## Request ### Path parameters - `cardUserId` (string, required) — A unique ID that is created for the Card User. ### Body (application/json) This endpoint expects an object. - `buyerId` (string, required) — A unique Buyer ID that is created during the Buyer enrollment. - `name` (name, required) — The name of the Card User. - `dateOfBirth` (string, required) — The Date of Birth of the Card User in YYYY-MM-DD format. - `email` (list of EmailItems, required) — The email of the Card User; currently supports only one email. - `phone` (list of PhoneItems, required) — The phone details of the Card User; currently supports only one phone. - `address` (list of AddressItems, required) — The residential address of the Card User; currently supports only one address with the type RESIDENCE. P.O. boxes or commercial mail-receiving agencies are prohibited. The address will be validated using the [USPS address validation API](https://www.usps.com/business/web-tools-apis/address-information-api.htm). - `expressConsentObtained` (boolean, required) — The Card User's consent to send their PII to American Express for verification. - `employeeId` (string, optional) — The unique ID assigned by the Buyer resource to the Card User being enrolled. Alphabetic characters, spaces and numbers are allowed. ## Response ### 200 Successful operation - `cardUserId` (string, required) — A unique ID that is created for the Card User. - `cardUser` (CardusersCardUserIdPutResponsesContentApplicationJsonSchemaCardUser, required) — The Card User request being returned. ## Errors ### 400 Bad Request Error Bad Request - `errors` (list of 400ErrorItems, required) ### 401 Unauthorized Error Unauthorized - `errorCode` (string, required) — A machine-readable field indicating the type of error. - `errorDescription` (string, optional) — Provides a short description of the error. ### 403 Forbidden Error Unauthenticated - `errorCode` (string, required) — A machine-readable field indicating the type of error. - `errorDescription` (string, optional) — Provides a short description of the error. ### 404 Not Found Error Resource not found - `errorCode` (string, required) — A machine-readable field indicating the type of error. - `errorDescription` (string, optional) — Provides a short description of the error. ### 500 Internal Server Error Service error - `errorCode` (string, required) — A machine-readable field indicating the type of error. - `errorDescription` (string, optional) — Provides a short description of the error. ### 503 Service Unavailable Error Service unavailable - `errorCode` (string, required) — A machine-readable field indicating the type of error. - `errorDescription` (string, optional) — Provides a short description of the error. ## Types ### name The name of the Card User. - `first` (string, required) — The first name. The allowed characters are alphabets, spaces, hyphen (-) and apostrophe ('). - `last` (string, required) — The last name. The allowed characters are alphabets, spaces, hyphen (-) and apostrophe ('). - `middle` (string, optional) — The middle name or initial. The allowed characters are alphabets, spaces, hyphen (-) and apostrophe ('). - `suffix` (string, optional) — The suffix, e.g., Jr. Only alphabetic characters and periods are allowed. ### EmailItems - `type` (enum, required) — The type of email; currently supports only PERSONAL. - Allowed values: `PERSONAL`, `WORK`, `ALTERNATE` - `emailAddress` (string, required) — The email address. ### PhoneItems - `countryCode` (string, required) — The country code must be three digits. Only numeric values accepted. Currently supports only the U.S. country code. - `number` (string, required) — The phone number of the Card User. - `type` (enum, required) — The allowed value is MOBILE. - Allowed values: `MOBILE` ### AddressItems - `type` (enum, required) — The type of the Card User's address. The current version only supports the enum value as RESIDENCE. More enum values, such as WORK will be supported in the upcoming releases. - Allowed values: `RESIDENCE` - `purpose` (enum, required) — The purpose for which the address will be used. The current version only supports PRIMARY, which includes the following purposes: KYC or identity verification, servicing communication, and default for delivering PLASTIC Cards. More enum values, such as PLASTIC_DELIVERY and STATEMENT_DELIVERY will be supported in the upcoming releases. - Allowed values: `PRIMARY` - `line1` (string, required) — Address line one. - `city` (string, required) — The city of the Card User's address. - `state` (string, required) — The state of the Card User's address. Only alphabetic characters are allowed. - `country` (string, required) — The two-letter country code of the Card User's address. Please find the full list in the [ISO Country Codes](iso-country-codes.pdf) list. The column to reference is Alpha 2 Code. - `postalCode` (string, required) — The Postal Code of the Card User's address. Only numeric values and hyphens are allowed. For the most accurate address, please use the full nine-digit Postal Code. Some examples are 85260 or 85260-7706. - `line2` (string, optional) — Address line two. ### CardusersCardUserIdPutResponsesContentApplicationJsonSchemaCardUser The Card User request being returned. - `buyerId` (string, required) — A unique Buyer ID that is created during the Buyer enrollment. - `name` (name, required) — The name of the Card User. - `dateOfBirth` (string, required) — The Date of Birth of the Card User in YYYY-MM-DD format. - `email` (list of EmailItems, required) — The email of the Card User; currently supports only one email. - `phone` (list of PhoneItems, required) — The phone details of the Card User; currently supports only one phone. - `address` (list of AddressItems, required) — The residential address of the Card User; currently supports only one address with the type RESIDENCE. P.O. boxes or commercial mail-receiving agencies are prohibited. The address will be validated using the [USPS address validation API](https://www.usps.com/business/web-tools-apis/address-information-api.htm). - `expressConsentObtained` (boolean, required) — The Card User's consent to send their PII to American Express for verification. - `employeeId` (string, optional) — The unique ID assigned by the Buyer resource to the Card User being enrolled. Alphabetic characters, spaces and numbers are allowed. ### 400ErrorItems - `code` (string, required) — A machine-readable field indicating the type of error. - `message` (string, required) — Provides a short description of the error. - `detail` (string, optional) — Provides a detailed description of the error. - `link` (string, optional) — The link to documentation that explains the error. ## Examples **Request** ```json { "buyerId": "OBpB8D9X93VO03sm", "name": { "first": "John", "last": "Smith", "middle": "M", "suffix": "Jr." }, "dateOfBirth": "1999-05-24", "email": [ { "type": "PERSONAL", "emailAddress": "someone@example.com" } ], "phone": [ { "countryCode": "001", "number": "5555551111", "type": "MOBILE" } ], "address": [ { "type": "RESIDENCE", "purpose": "PRIMARY", "line1": "100 Elm Street", "city": "Phoenix", "state": "Arizona", "country": "US", "postalCode": "12345", "line2": "Suite A" } ], "expressConsentObtained": true, "employeeId": "2322199833" } ``` **Response** ```json { "cardUserId": "123456", "cardUser": { "buyerId": "OBpB8D9X93VO03sm", "name": { "first": "John", "last": "Smith", "middle": "M", "suffix": "Jr." }, "dateOfBirth": "1999-05-24", "email": [ { "type": "PERSONAL", "emailAddress": "someone@example.com" } ], "phone": [ { "countryCode": "001", "number": "5555551111", "type": "MOBILE" } ], "address": [ { "type": "RESIDENCE", "purpose": "PRIMARY", "line1": "100 Elm Street", "city": "Phoenix", "state": "Arizona", "country": "US", "postalCode": "12345", "line2": "Suite A" } ], "expressConsentObtained": true, "employeeId": "2322199833" } } ``` **SDK Code** ```python modifyCardUser_example import requests url = "https://api.qasb2s.americanexpress.com/commercial/v1/card_on_demand/cardusers/123456" payload = { "buyerId": "OBpB8D9X93VO03sm", "name": { "first": "John", "last": "Smith", "middle": "M", "suffix": "Jr." }, "dateOfBirth": "1999-05-24", "email": [ { "type": "PERSONAL", "emailAddress": "someone@example.com" } ], "phone": [ { "countryCode": "001", "number": "5555551111", "type": "MOBILE" } ], "address": [ { "type": "RESIDENCE", "purpose": "PRIMARY", "line1": "100 Elm Street", "city": "Phoenix", "state": "Arizona", "country": "US", "postalCode": "12345", "line2": "Suite A" } ], "expressConsentObtained": True, "employeeId": "2322199833" } headers = { "Authorization": "Bearer ", "Content-Type": "application/json" } response = requests.put(url, json=payload, headers=headers) print(response.json()) ``` ```javascript modifyCardUser_example const url = 'https://api.qasb2s.americanexpress.com/commercial/v1/card_on_demand/cardusers/123456'; const options = { method: 'PUT', headers: {Authorization: 'Bearer ', 'Content-Type': 'application/json'}, body: '{"buyerId":"OBpB8D9X93VO03sm","name":{"first":"John","last":"Smith","middle":"M","suffix":"Jr."},"dateOfBirth":"1999-05-24","email":[{"type":"PERSONAL","emailAddress":"someone@example.com"}],"phone":[{"countryCode":"001","number":"5555551111","type":"MOBILE"}],"address":[{"type":"RESIDENCE","purpose":"PRIMARY","line1":"100 Elm Street","city":"Phoenix","state":"Arizona","country":"US","postalCode":"12345","line2":"Suite A"}],"expressConsentObtained":true,"employeeId":"2322199833"}' }; try { const response = await fetch(url, options); const data = await response.json(); console.log(data); } catch (error) { console.error(error); } ``` ```go modifyCardUser_example package main import ( "fmt" "strings" "net/http" "io" ) func main() { url := "https://api.qasb2s.americanexpress.com/commercial/v1/card_on_demand/cardusers/123456" payload := strings.NewReader("{\n \"buyerId\": \"OBpB8D9X93VO03sm\",\n \"name\": {\n \"first\": \"John\",\n \"last\": \"Smith\",\n \"middle\": \"M\",\n \"suffix\": \"Jr.\"\n },\n \"dateOfBirth\": \"1999-05-24\",\n \"email\": [\n {\n \"type\": \"PERSONAL\",\n \"emailAddress\": \"someone@example.com\"\n }\n ],\n \"phone\": [\n {\n \"countryCode\": \"001\",\n \"number\": \"5555551111\",\n \"type\": \"MOBILE\"\n }\n ],\n \"address\": [\n {\n \"type\": \"RESIDENCE\",\n \"purpose\": \"PRIMARY\",\n \"line1\": \"100 Elm Street\",\n \"city\": \"Phoenix\",\n \"state\": \"Arizona\",\n \"country\": \"US\",\n \"postalCode\": \"12345\",\n \"line2\": \"Suite A\"\n }\n ],\n \"expressConsentObtained\": true,\n \"employeeId\": \"2322199833\"\n}") req, _ := http.NewRequest("PUT", url, payload) req.Header.Add("Authorization", "Bearer ") req.Header.Add("Content-Type", "application/json") res, _ := http.DefaultClient.Do(req) defer res.Body.Close() body, _ := io.ReadAll(res.Body) fmt.Println(res) fmt.Println(string(body)) } ``` ```ruby modifyCardUser_example require 'uri' require 'net/http' url = URI("https://api.qasb2s.americanexpress.com/commercial/v1/card_on_demand/cardusers/123456") http = Net::HTTP.new(url.host, url.port) http.use_ssl = true request = Net::HTTP::Put.new(url) request["Authorization"] = 'Bearer ' request["Content-Type"] = 'application/json' request.body = "{\n \"buyerId\": \"OBpB8D9X93VO03sm\",\n \"name\": {\n \"first\": \"John\",\n \"last\": \"Smith\",\n \"middle\": \"M\",\n \"suffix\": \"Jr.\"\n },\n \"dateOfBirth\": \"1999-05-24\",\n \"email\": [\n {\n \"type\": \"PERSONAL\",\n \"emailAddress\": \"someone@example.com\"\n }\n ],\n \"phone\": [\n {\n \"countryCode\": \"001\",\n \"number\": \"5555551111\",\n \"type\": \"MOBILE\"\n }\n ],\n \"address\": [\n {\n \"type\": \"RESIDENCE\",\n \"purpose\": \"PRIMARY\",\n \"line1\": \"100 Elm Street\",\n \"city\": \"Phoenix\",\n \"state\": \"Arizona\",\n \"country\": \"US\",\n \"postalCode\": \"12345\",\n \"line2\": \"Suite A\"\n }\n ],\n \"expressConsentObtained\": true,\n \"employeeId\": \"2322199833\"\n}" response = http.request(request) puts response.read_body ``` ```java modifyCardUser_example import com.mashape.unirest.http.HttpResponse; import com.mashape.unirest.http.Unirest; HttpResponse response = Unirest.put("https://api.qasb2s.americanexpress.com/commercial/v1/card_on_demand/cardusers/123456") .header("Authorization", "Bearer ") .header("Content-Type", "application/json") .body("{\n \"buyerId\": \"OBpB8D9X93VO03sm\",\n \"name\": {\n \"first\": \"John\",\n \"last\": \"Smith\",\n \"middle\": \"M\",\n \"suffix\": \"Jr.\"\n },\n \"dateOfBirth\": \"1999-05-24\",\n \"email\": [\n {\n \"type\": \"PERSONAL\",\n \"emailAddress\": \"someone@example.com\"\n }\n ],\n \"phone\": [\n {\n \"countryCode\": \"001\",\n \"number\": \"5555551111\",\n \"type\": \"MOBILE\"\n }\n ],\n \"address\": [\n {\n \"type\": \"RESIDENCE\",\n \"purpose\": \"PRIMARY\",\n \"line1\": \"100 Elm Street\",\n \"city\": \"Phoenix\",\n \"state\": \"Arizona\",\n \"country\": \"US\",\n \"postalCode\": \"12345\",\n \"line2\": \"Suite A\"\n }\n ],\n \"expressConsentObtained\": true,\n \"employeeId\": \"2322199833\"\n}") .asString(); ``` ```php modifyCardUser_example request('PUT', 'https://api.qasb2s.americanexpress.com/commercial/v1/card_on_demand/cardusers/123456', [ 'body' => '{ "buyerId": "OBpB8D9X93VO03sm", "name": { "first": "John", "last": "Smith", "middle": "M", "suffix": "Jr." }, "dateOfBirth": "1999-05-24", "email": [ { "type": "PERSONAL", "emailAddress": "someone@example.com" } ], "phone": [ { "countryCode": "001", "number": "5555551111", "type": "MOBILE" } ], "address": [ { "type": "RESIDENCE", "purpose": "PRIMARY", "line1": "100 Elm Street", "city": "Phoenix", "state": "Arizona", "country": "US", "postalCode": "12345", "line2": "Suite A" } ], "expressConsentObtained": true, "employeeId": "2322199833" }', 'headers' => [ 'Authorization' => 'Bearer ', 'Content-Type' => 'application/json', ], ]); echo $response->getBody(); ``` ```csharp modifyCardUser_example using RestSharp; var client = new RestClient("https://api.qasb2s.americanexpress.com/commercial/v1/card_on_demand/cardusers/123456"); var request = new RestRequest(Method.PUT); request.AddHeader("Authorization", "Bearer "); request.AddHeader("Content-Type", "application/json"); request.AddParameter("application/json", "{\n \"buyerId\": \"OBpB8D9X93VO03sm\",\n \"name\": {\n \"first\": \"John\",\n \"last\": \"Smith\",\n \"middle\": \"M\",\n \"suffix\": \"Jr.\"\n },\n \"dateOfBirth\": \"1999-05-24\",\n \"email\": [\n {\n \"type\": \"PERSONAL\",\n \"emailAddress\": \"someone@example.com\"\n }\n ],\n \"phone\": [\n {\n \"countryCode\": \"001\",\n \"number\": \"5555551111\",\n \"type\": \"MOBILE\"\n }\n ],\n \"address\": [\n {\n \"type\": \"RESIDENCE\",\n \"purpose\": \"PRIMARY\",\n \"line1\": \"100 Elm Street\",\n \"city\": \"Phoenix\",\n \"state\": \"Arizona\",\n \"country\": \"US\",\n \"postalCode\": \"12345\",\n \"line2\": \"Suite A\"\n }\n ],\n \"expressConsentObtained\": true,\n \"employeeId\": \"2322199833\"\n}", ParameterType.RequestBody); IRestResponse response = client.Execute(request); ``` ```swift modifyCardUser_example import Foundation let headers = [ "Authorization": "Bearer ", "Content-Type": "application/json" ] let parameters = [ "buyerId": "OBpB8D9X93VO03sm", "name": [ "first": "John", "last": "Smith", "middle": "M", "suffix": "Jr." ], "dateOfBirth": "1999-05-24", "email": [ [ "type": "PERSONAL", "emailAddress": "someone@example.com" ] ], "phone": [ [ "countryCode": "001", "number": "5555551111", "type": "MOBILE" ] ], "address": [ [ "type": "RESIDENCE", "purpose": "PRIMARY", "line1": "100 Elm Street", "city": "Phoenix", "state": "Arizona", "country": "US", "postalCode": "12345", "line2": "Suite A" ] ], "expressConsentObtained": true, "employeeId": "2322199833" ] as [String : Any] let postData = JSONSerialization.data(withJSONObject: parameters, options: []) let request = NSMutableURLRequest(url: NSURL(string: "https://api.qasb2s.americanexpress.com/commercial/v1/card_on_demand/cardusers/123456")! as URL, cachePolicy: .useProtocolCachePolicy, timeoutInterval: 10.0) request.httpMethod = "PUT" request.allHTTPHeaderFields = headers request.httpBody = postData as Data let session = URLSession.shared let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in if (error != nil) { print(error as Any) } else { let httpResponse = response as? HTTPURLResponse print(httpResponse) } }) dataTask.resume() ```