curl --request POST \
--url https://api-sandbox.uqpaytech.com/api/v1/issuing/cards/pin \
--header 'Content-Type: application/json' \
--header 'x-auth-token: <api-key>' \
--header 'x-idempotency-key: <x-idempotency-key>' \
--data '
{
"card_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"pin": "<string>",
"type": "SET"
}
'import requests
url = "https://api-sandbox.uqpaytech.com/api/v1/issuing/cards/pin"
payload = {
"card_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"pin": "<string>",
"type": "SET"
}
headers = {
"x-idempotency-key": "<x-idempotency-key>",
"x-auth-token": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {
'x-idempotency-key': '<x-idempotency-key>',
'x-auth-token': '<api-key>',
'Content-Type': 'application/json'
},
body: JSON.stringify({card_id: '3c90c3cc-0d44-4b50-8888-8dd25736052a', pin: '<string>', type: 'SET'})
};
fetch('https://api-sandbox.uqpaytech.com/api/v1/issuing/cards/pin', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api-sandbox.uqpaytech.com/api/v1/issuing/cards/pin",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'card_id' => '3c90c3cc-0d44-4b50-8888-8dd25736052a',
'pin' => '<string>',
'type' => 'SET'
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"x-auth-token: <api-key>",
"x-idempotency-key: <x-idempotency-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api-sandbox.uqpaytech.com/api/v1/issuing/cards/pin"
payload := strings.NewReader("{\n \"card_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"pin\": \"<string>\",\n \"type\": \"SET\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("x-idempotency-key", "<x-idempotency-key>")
req.Header.Add("x-auth-token", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api-sandbox.uqpaytech.com/api/v1/issuing/cards/pin")
.header("x-idempotency-key", "<x-idempotency-key>")
.header("x-auth-token", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"card_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"pin\": \"<string>\",\n \"type\": \"SET\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api-sandbox.uqpaytech.com/api/v1/issuing/cards/pin")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["x-idempotency-key"] = '<x-idempotency-key>'
request["x-auth-token"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"card_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"pin\": \"<string>\",\n \"type\": \"SET\"\n}"
response = http.request(request)
puts response.read_body{
"request_status": "SUCCESS",
"card_id": "eeeed4ff-e5b6-4e10-b3ae-156996192174",
"card_order_id": "d8102e17-e21a-4574-878f-6824fa5abb6b",
"order_status": "PROCESSING",
"create_time": "2026-09-10T16:14:49.721921515+08:00"
}Manage Card PIN
Set, reset, or update a card PIN.
curl --request POST \
--url https://api-sandbox.uqpaytech.com/api/v1/issuing/cards/pin \
--header 'Content-Type: application/json' \
--header 'x-auth-token: <api-key>' \
--header 'x-idempotency-key: <x-idempotency-key>' \
--data '
{
"card_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"pin": "<string>",
"type": "SET"
}
'import requests
url = "https://api-sandbox.uqpaytech.com/api/v1/issuing/cards/pin"
payload = {
"card_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"pin": "<string>",
"type": "SET"
}
headers = {
"x-idempotency-key": "<x-idempotency-key>",
"x-auth-token": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {
'x-idempotency-key': '<x-idempotency-key>',
'x-auth-token': '<api-key>',
'Content-Type': 'application/json'
},
body: JSON.stringify({card_id: '3c90c3cc-0d44-4b50-8888-8dd25736052a', pin: '<string>', type: 'SET'})
};
fetch('https://api-sandbox.uqpaytech.com/api/v1/issuing/cards/pin', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api-sandbox.uqpaytech.com/api/v1/issuing/cards/pin",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'card_id' => '3c90c3cc-0d44-4b50-8888-8dd25736052a',
'pin' => '<string>',
'type' => 'SET'
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"x-auth-token: <api-key>",
"x-idempotency-key: <x-idempotency-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api-sandbox.uqpaytech.com/api/v1/issuing/cards/pin"
payload := strings.NewReader("{\n \"card_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"pin\": \"<string>\",\n \"type\": \"SET\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("x-idempotency-key", "<x-idempotency-key>")
req.Header.Add("x-auth-token", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api-sandbox.uqpaytech.com/api/v1/issuing/cards/pin")
.header("x-idempotency-key", "<x-idempotency-key>")
.header("x-auth-token", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"card_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"pin\": \"<string>\",\n \"type\": \"SET\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api-sandbox.uqpaytech.com/api/v1/issuing/cards/pin")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["x-idempotency-key"] = '<x-idempotency-key>'
request["x-auth-token"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"card_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"pin\": \"<string>\",\n \"type\": \"SET\"\n}"
response = http.request(request)
puts response.read_body{
"request_status": "SUCCESS",
"card_id": "eeeed4ff-e5b6-4e10-b3ae-156996192174",
"card_order_id": "d8102e17-e21a-4574-878f-6824fa5abb6b",
"order_status": "PROCESSING",
"create_time": "2026-09-10T16:14:49.721921515+08:00"
}Authorizations
The API token for login provided by UQPAY.
Headers
Specifies the sub-account on whose behalf the request is made. This should be set to the account_id, which can be retrieved via the List Connected Accounts endpoint. If omitted or empty, the request is executed using the master account.
More information at Connected Accounts.
A unique identifier (UUID) used to maintain operation idempotency, ensuring that repeated executions of the same operation do not result in unintended effects or duplication. It helps preserve data consistency in the face of network errors, retries, or failures.
Body
- Set PIN
- Reset PIN
- Update PIN
Card to manage. It must be active and not expired. Wait for any PIN operation already processing for this card to finish before submitting another.
New PIN. Do not use a repeated single digit or a PIN that occurs within the cardholder's phone number. Its last four digits must not match the card number's last four digits. When updating, it must differ from the current PIN.
^[0-9]{6}$If omitted, defaults to SET for initial PIN setup. Use SET for initial setup; explicitly pass RESET to reset without the current PIN, or UPDATE to change after verifying the current PIN. Supported operations depend on the card; unsupported operations return pin_operation_not_supported.
SET Response
PIN operation order accepted; the PIN change is not yet confirmed.
The request was accepted; this is not the final PIN operation result.
SUCCESS Card associated with the order.
Order identifier used to track the PIN operation through Retrieve Card Order or the card order webhook.
PIN operation order status:
PROCESSING: accepted and processing; the PIN change is not yet confirmed.SUCCESS: completed; the PIN has changed.FAILED: the operation failed.
This endpoint returns PROCESSING at acceptance. Retrieve the order or consume the card order webhook to obtain its final status.
API order statuses use uppercase; card update webhooks use lowercase: pending means processing, success means succeeded, and failed means failed.
PROCESSING Order creation time in RFC3339 format.

