diff --git a/net/server/internal/api_setCardStatus.go b/net/server/internal/api_setCardStatus.go
index 68276eb6..52a8af97 100644
--- a/net/server/internal/api_setCardStatus.go
+++ b/net/server/internal/api_setCardStatus.go
@@ -28,7 +28,11 @@ func SetCardStatus(w http.ResponseWriter, r *http.Request) {
     return
   }
   if !AppCardStatus(status) {
-    ErrResponse(w, http.StatusBadRequest, err)
+    ErrResponse(w, http.StatusBadRequest, errors.New("unknown status"))
+    return
+  }
+  if status == APP_CARDCONNECTED && token == "" {
+    ErrResponse(w, http.StatusBadRequest, errors.New("connected token not set"))
     return
   }
 
diff --git a/net/server/internal/contact_test.go b/net/server/internal/contact_test.go
index 5cec7db7..7692dfa7 100644
--- a/net/server/internal/contact_test.go
+++ b/net/server/internal/contact_test.go
@@ -3,6 +3,7 @@ package databag
 import (
   "testing"
   "strconv"
+  "github.com/gorilla/mux"
   "github.com/stretchr/testify/assert"
 )
 
@@ -49,3 +50,90 @@ func AddTestContacts(t *testing.T, prefix string, count int) []string {
 
   return access
 }
+
+func ConnectTestContacts(t *testing.T, access [2]string) {
+  var card Card
+  var msg DataMessage
+  var vars map[string]string
+  var contactStatus ContactStatus
+
+  // get A identity message
+  r, w, _ := NewRequest("GET", "/profile/message", nil)
+  SetBearerAuth(r, access[0])
+  GetProfileMessage(w, r)
+  assert.NoError(t, ReadResponse(w, &msg))
+
+  // add A card in B
+  r, w, _ = NewRequest("POST", "/contact/cards", &msg)
+  SetBearerAuth(r, access[1])
+  AddCard(w, r)
+  assert.NoError(t, ReadResponse(w, &card))
+
+  // update A status to connecting
+  r, w, _ = NewRequest("PUT", "/contact/cards/{cardId}/status", APP_CARDCONNECTING)
+  vars = map[string]string{ "cardId": card.CardId }
+  r = mux.SetURLVars(r, vars)
+  SetBearerAuth(r, access[1])
+  SetCardStatus(w, r)
+  assert.NoError(t, ReadResponse(w, &card))
+
+  // get open message to A
+  r, w, _ = NewRequest("GET", "/contact/cards/{cardId}/openMessage", nil)
+  vars = map[string]string{ "cardId": card.CardId }
+  r = mux.SetURLVars(r, vars)
+  SetBearerAuth(r, access[1])
+  GetOpenMessage(w, r)
+  assert.NoError(t, ReadResponse(w, &msg))
+
+  // set open message in A
+  r, w, _ = NewRequest("PUT", "/contact/openMessage", msg)
+  SetOpenMessage(w, r)
+  assert.NoError(t, ReadResponse(w, &contactStatus))
+
+  // get view of cards in A
+  r, w, _ = NewRequest("GET", "/contact/cards/view", nil)
+  SetBearerAuth(r, access[0])
+  GetCardView(w, r)
+  var views []CardView
+  assert.NoError(t, ReadResponse(w, &views))
+  assert.Equal(t, len(views), 1)
+
+  // get B card in A
+  r, w, _ = NewRequest("GET", "/contact/cards/{cardId}", nil)
+  vars = map[string]string{ "cardId": views[0].CardId }
+  r = mux.SetURLVars(r, vars)
+  SetBearerAuth(r, access[0])
+  GetCard(w, r)
+  assert.NoError(t, ReadResponse(w, &card))
+
+  // update B status to connecting
+  r, w, _ = NewRequest("PUT", "/contact/cards/{cardId}/status", APP_CARDCONNECTING)
+  vars = map[string]string{ "cardId": views[0].CardId }
+  r = mux.SetURLVars(r, vars)
+  SetBearerAuth(r, access[0])
+  SetCardStatus(w, r)
+  assert.NoError(t, ReadResponse(w, &card))
+
+  // get open message to B
+  r, w, _ = NewRequest("GET", "/contact/cards/{cardId}/openMessage", nil)
+  vars = map[string]string{ "cardId": views[0].CardId }
+  r = mux.SetURLVars(r, vars)
+  SetBearerAuth(r, access[0])
+  GetOpenMessage(w, r)
+  assert.NoError(t, ReadResponse(w, &msg))
+
+  // set open message in B
+  r, w, _ = NewRequest("PUT", "/contact/openMessage", msg)
+  SetOpenMessage(w, r)
+  assert.NoError(t, ReadResponse(w, &contactStatus))
+  assert.Equal(t, APP_CARDCONNECTED, contactStatus.Status)
+
+  // update B status to connected
+  r, w, _ = NewRequest("PUT", "/contact/cards/{cardId}/status?token=" + contactStatus.Token, APP_CARDCONNECTED)
+  vars = map[string]string{ "cardId": views[0].CardId }
+  r = mux.SetURLVars(r, vars)
+  SetBearerAuth(r, access[0])
+  SetCardStatus(w, r)
+  assert.NoError(t, ReadResponse(w, &card))
+
+}
diff --git a/net/server/internal/ucConnectContact_test.go b/net/server/internal/ucConnectContact_test.go
index 629fa45e..3ff658b9 100644
--- a/net/server/internal/ucConnectContact_test.go
+++ b/net/server/internal/ucConnectContact_test.go
@@ -14,6 +14,7 @@ func TestConnectContact(t *testing.T) {
   var msg DataMessage
   var vars map[string]string
   var cardRevision int64
+  var contactStatus ContactStatus
 
   // create some contacts for this test
   access := AddTestContacts(t, "connect", 2)
@@ -53,7 +54,7 @@ func TestConnectContact(t *testing.T) {
   SetCardStatus(w, r)
   assert.NoError(t, ReadResponse(w, &card))
 
-  // profile revision incremented
+  // card revision incremented
   _, data, _ = ws.ReadMessage()
   assert.NoError(t, json.Unmarshal(data, &revision))
   assert.NotEqual(t, cardRevision, revision.Card)
@@ -70,7 +71,6 @@ func TestConnectContact(t *testing.T) {
   // set open message in A
   r, w, _ = NewRequest("PUT", "/contact/openMessage", msg)
   SetOpenMessage(w, r)
-  var contactStatus ContactStatus
   assert.NoError(t, ReadResponse(w, &contactStatus))
 
   // get view of cards in A
@@ -89,21 +89,41 @@ func TestConnectContact(t *testing.T) {
   GetCard(w, r)
   assert.NoError(t, ReadResponse(w, &card))
 
-PrintMsg(card);
+  // update B status to connecting
+  r, w, _ = NewRequest("PUT", "/contact/cards/{cardId}/status", APP_CARDCONNECTING)
+  vars = map[string]string{ "cardId": views[0].CardId }
+  r = mux.SetURLVars(r, vars)
+  SetBearerAuth(r, access[0])
+  SetCardStatus(w, r)
+  assert.NoError(t, ReadResponse(w, &card))
 
+  // get open message to B
+  r, w, _ = NewRequest("GET", "/contact/cards/{cardId}/openMessage", nil)
+  vars = map[string]string{ "cardId": views[0].CardId }
+  r = mux.SetURLVars(r, vars)
+  SetBearerAuth(r, access[0])
+  GetOpenMessage(w, r)
+  assert.NoError(t, ReadResponse(w, &msg))
 
-  // get new card
+  // set open message in B
+  r, w, _ = NewRequest("PUT", "/contact/openMessage", msg)
+  SetOpenMessage(w, r)
+  assert.NoError(t, ReadResponse(w, &contactStatus))
+  assert.Equal(t, APP_CARDCONNECTED, contactStatus.Status)
 
-  // set status of pending to connecting
-
-  // create open message
-
-  // deliver open message
-
-  // receive websocket message
-
-  // update status to connected
+  // card revision incremented
+  _, data, _ = ws.ReadMessage()
+  assert.NoError(t, json.Unmarshal(data, &revision))
+  assert.NotEqual(t, cardRevision, revision.Card)
+  cardRevision = revision.Card
 
+  // update B status to connected
+  r, w, _ = NewRequest("PUT", "/contact/cards/{cardId}/status?token=" + contactStatus.Token, APP_CARDCONNECTED)
+  vars = map[string]string{ "cardId": views[0].CardId }
+  r = mux.SetURLVars(r, vars)
+  SetBearerAuth(r, access[0])
+  SetCardStatus(w, r)
+  assert.NoError(t, ReadResponse(w, &card))
 
 }