> ## Documentation Index
> Fetch the complete documentation index at: https://www.marqeta.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Create or update PIN

> Creates or updates a personal identification number (PIN) for an existing card.

<div className="mb-4 flex items-center gap-2"><span className="rounded-lg font-bold px-1.5 py-0.5 text-sm leading-5 bg-yellow-400/20 text-yellow-700 dark:text-yellow-400">PUT</span><span className="flex items-center gap-0.5 font-mono text-sm"><span className="text-gray-400">/</span><span className="font-medium text-gray-800 dark:text-white">{"pins"}</span></span></div>

Creates or updates a personal identification number (PIN) for an existing card. Although cardholders might choose a four-, five-, or six-digit PIN if they set their PIN at an automated teller machine, they can only set a four-digit PIN using the Marqeta Set PIN widget or the create or update PIN endpoint (`PUT /pins`). Cardholders can update their PIN through the API regardless of its length, but the new PIN value they choose must contain four digits.

If you want to manage a card's PIN, first create a new control token for the card by sending a `POST` request to `/pins/controltoken`, and then use that token to update the PIN. You must create a card before you can manage a PIN.

Unless PIN reveal functionality has been enabled for your program, you cannot retrieve a PIN that has previously been created. If the PIN has been forgotten, you must either update the card's PIN or create a new card and PIN.

If you have enabled PIN reveal functionality for your program, you can send a `POST` request to the `/pins/reveal` endpoint to retrieve an existing PIN. See [Reveal PIN](/docs/core-api/pins/reveal) on this page for details.

<Danger>
  **Warning**<br />Sending a request to this endpoint requires PCI DSS compliance. You must comply with PCI DSS data security requirements if you want to store, transmit, or process sensitive card data such as the cardholder's primary account number (PAN), personal identification number (PIN), and card expiration date.
</Danger>

<h2 id="_request_body_2">
  Request body
</h2>

| Fields | Description |
| - | - |
| control\_token<br />string<br />Required | Unique value generated as a result of issuing a `POST` request to the `/pins/controltoken` endpoint. This value cannot be updated.<br />**Allowable Values:**<br />1–36 chars |
| pin<br />string<br />Required | Four-digit number to associate with the card.<br />**Allowable Values:**<br />4 chars |

<h2 id="_sample_request_body_2">
  Sample request body
</h2>

```json JSON lines wrap theme={null}
{
  "control_token": "b4647c9a-d4b8-4091-a5ff-dd67a7bb9ffc",
  "pin": "5678"
}
```


## Related topics

- [PINs Overview](/docs/core-api/pins.md)
- [Reveal PIN](/docs/core-api/pins/reveal.md)
- [Create card](/docs/core-api/cards/create.md)
- [Create PIN control token](/docs/core-api/pins/create-control-token.md)
- [Update document](/docs/core-api/disputes-visa/update-document.md)