What a CVV test API endpoint is
A CVV test API endpoint is a sandbox route in a payment provider's API that returns a simulated card verification value (CVV) result. It never reaches a card network. Stripe, Adyen, Braintree, and Authorize.Net publish these routes for developers who build checkout flows. The request carries a test card number, a test CVV, an expiry date, and an amount. The response carries a status such as pass, fail, or unavailable. Production systems reject test card data.
How sandbox CVV responses work
Test mode mirrors live mode in structure. The request format is the same. Only the credentials and the card values differ. Each test card maps to a fixed result. The response field for the CVV check usually holds one of four values:
- pass or match: the test CVV equals the value the sandbox expects.
- fail or no_match: the test CVV differs from the expected value.
- unchecked: no check ran on that request.
- unavailable: the check could not complete.
Stripe returns these values in the cvc_check field. The same pattern appears at other processors under different field names.
Test card numbers
Processors publish their own test card numbers. Stripe lists 4242 4242 4242 4242 as a card that passes. Each number carries a defined behavior for approvals, declines, and CVV mismatches. Developers use these numbers to trigger each branch of their error handling code. None of the numbers belong to a real account.
Rules that apply to real CVV data
PCI DSS treats the CVV as sensitive authentication data. Requirement 3.3.1 of PCI DSS v4.0 forbids storage of sensitive authentication data after authorization. A merchant cannot keep the CVV in a database, a log, or a file. Tokenization replaces the card number and the CVV with a token at the point of entry. A developer who needs a CVV check must send the data to the processor and keep nothing. Visa requires CVV2 verification for card-not-present transactions in many markets and bars storage of the CVV2 value.
What no legitimate endpoint does
No payment processor offers an endpoint that validates a card owned by another person. Test endpoints accept test card numbers only. A service that claims to check live card numbers is describing data taken from a breach or a theft. Holding, testing, or selling that data is a crime under US federal law and state law. There is no sandbox that makes it legal.