Update a beneficiary

PUThttps://api.veriko.mx/v1/beneficiaries/{id}

Audience: public
Auth: API key
Permission: beneficiaries:update

Updates an already registered beneficiary. The body accepts the JSON:API envelope or a flat object, and what is sent determines the scope of the change:

label only: sanitised and stored, leaving the account untouched.
A new account_number, or the legacy clabe alias: account_type, bank_code, and bank_name are derived again under the same rules as POST /v1/beneficiaries, so a change of type resolves by itself. If the new number is a phone, the body must carry bank_code.
bank_code only: applies solely to a phone-type beneficiary. On a CLABE or a card the bank is derived from the number, so the value sent is discarded without an error.

A body with no editable field responds 422 no_valid_fields.

Parameters
Parameter	In	Type	Required	Description
`id`*	path	`integer`	required	Numeric beneficiary ID. e.g. `42`

Parameters
Parameter	Type	Required	Description
`label`	string (?–100)	optional	Optional free-form label. Sanitized with `strip_tags` + `trim`. e.g. `Proveedor XYZ`
`account_number`	string (pattern)	optional	New account number. Replaces the existing one and triggers the re-derivation of `account_type`, `bank_code` and `bank_name`. For type `phone`, `bank_code` must accompany the request. e.g. `012180004412345678`
`bank_code`	string (pattern)	optional	5-digit Banxico SPEI code. For `phone` beneficiaries, may be sent alone to reassign the DiMo receiving bank. For CLABE/card the field is ignored. e.g. `40021`

Request

cURLPython•JavaScript•PHP•

curl -X PUT 'https://api.veriko.mx/v1/beneficiaries/{id}' \
  -H 'Authorization: Bearer veriko_••••' \
  -H 'Content-Type: application/json' \
  -d '{
    "data": {
      "attributes": {
        "label": "Proveedor XYZ actualizado"
      }
    }
  }'

Python example — coming soon.

JavaScript example — coming soon.

PHP example — coming soon.

**Response 200**`UpdateBeneficiaryResponse` — Beneficiary updated.
Field	Type	Description
`data`	`object`	Main response payload. Shape varies by endpoint (object, array, or JSON:API envelope with `type`, `id`, `attributes`).
`type`*	`string`	JSON:API resource type. Always `beneficiary`. e.g. `beneficiary`
`id`*	`string`	Auto-increment numeric identifier of the beneficiary in the `user_beneficiaries` table. e.g. `42`
`attributes`*	`object`	Canonical beneficiary attributes (recipient account data and record metadata).
`account_number`*	`string`	Stored account number: 18-digit CLABE, 16-digit card, or 10-digit DiMo phone. Use `account_type` to disambiguate the exact type. e.g. `012180004412345678`
`account_type`*	`string`	Auto-detected account type: `clabe` (18 digits), `card` (16 digits), or `phone` (10 digits, DiMo mobile). e.g. `clabe`
`bank_code`*	`string`	5-digit Banxico code of the receiving bank, derived from the CLABE prefix, card BIN, or DiMo catalog. e.g. `40012`
`bank_name`*	`string`	Bank name resolved from the CLABE prefix, card BIN, or DiMo catalog. e.g. `BBVA MEXICO`
`label`	`string \| null`nullable	User-assigned descriptive label. `null` if not provided. e.g. `Proveedor ABC`
`status`*	`string`	Beneficiary status. `inactive` is set when the beneficiary is archived (excluded from default listings). `active` — in use; `inactive` — retired without being deleted. e.g. `active`
`created_at`*	`string (date-time)`	UTC creation timestamp. e.g. `2026-01-15T10:00:00Z`
`meta`	`object`	Response metadata including API version, route prefix, unique request identifier, and the server timestamp in UTC.
`version`	`string`	API version that processed the request. e.g. `1.47.0`
`api_version`	`string`	API route prefix version (e.g. `v1`). e.g. `v1`
`request_id`	`string`	Unique request identifier (hex). e.g. `a1b2c3d4e5f6`
`datetime`	`object`	Companion descriptor present in every response's meta block (and in outgoing webhook payloads). Lets clients assert the timezone contract without re-reading the spec. e.g. `{"timezone":"UTC","format":"ISO 8601"}`
`timezone`*	`string`	Always `UTC` — the canonical timezone for every datetime field in the body. e.g. `UTC`
`format`*	`string`	Always `ISO 8601` — explicit `Z` suffix on every datetime. e.g. `ISO 8601`
`links`	`object`	Pagination or related links, present only when the endpoint returns a paginated collection.

**Response status codes**`PUT /v1/beneficiaries/{id}`
Status	Class	Description	Body
200	`2xx`	Beneficiary updated.	`UpdateBeneficiaryResponse`
400	`4xx`	The request body is empty or is not valid JSON.	`ErrorResponse`
401	`4xx`	Authentication is required or the provided credentials are invalid.	`ErrorResponse`
403	`4xx`	Insufficient permissions.	`ErrorResponse`
404	`4xx`	The resource does not exist or is not visible to the client	`Error`
413	`4xx`	The request body exceeds the maximum accepted size (`body_too_large`).	`ErrorResponse`
422	`4xx`	The body failed validation. Possible codes are `no_valid_fields`, `invalid_account_length`, `clabe_prefix_not_recognized`, and `bank_code_required_for_phone`.	`ErrorResponse`

**Errors from `PUT /v1/beneficiaries/{id}`**
Status	Code	Example
400	`body_empty`	The request body is empty. Envelope meta.request_id `a5b6c7d8e9f0`
400	`invalid_json`	The body is not valid JSON. Envelope meta.request_id `b6c7d8e9f0a1`
401	`unauthorized`	Invalid or missing authentication credentials. Envelope meta.request_id `c4d5e6f7a8b9`
403	`forbidden`	You do not have permission to access this resource. Envelope meta.request_id `d5e6f7a8b9c0`
413	`body_too_large`	The request body is too large. Envelope meta.request_id `1a2b3c4d5e6f`
422	`no_valid_fields`	The body carries no editable field. Envelope meta.request_id `d0e1f2a3b4c5`