Card Activated

card.activated — delivered when card issuance succeeds and the card becomes usable.

When it fires

The Issue Card endpoint returns status: PENDING, which only means the request was accepted.
This event is the confirmation that the card is live.

Wait for this event before telling your end user the card is ready. If issuance fails you
receive Card Failed instead.

Payload

Envelope

Field	Type	Description
`eventId`	string	Unique per event. Deduplicate on this value
`eventType`	string	Always `card.activated`
`version`	string	Payload schema version. Additive changes do not bump it
`occurredAt`	string	When the event happened, not when it was delivered (ISO 8601)
`data`	object	The card, see below

`data`

Field	Type	Description
`cardNo`	string	PIK card number
`cardholderNo`	string	PIK cardholder number this card belongs to
`maskedCardNumber`	string	Masked card number
`expireMonthYear`	string	Card expiry in MM/YY
`status`	string	`ACTIVE` for this event
`cardLimit`	string	Cumulative spending ceiling
`availableLimit`	string	Remaining spendable amount against `cardLimit`
`currency`	string	Settlement currency
`label`	string	Your label for the card
`externalId`	string	Your own identifier
`createTimeUtc`	string	Creation time (UTC)

Example

{
  "eventId": "evt_01J9X8ZQ4T2K",
  "eventType": "card.activated",
  "version": "1.0",
  "occurredAt": "2026-08-11T10:16:40+08:00",
  "data": {
    "cardNo": "CD260811X9Y8Z7",
    "cardholderNo": "CH260811A1B2C3",
    "maskedCardNumber": "409636******0501",
    "expireMonthYear": "08/29",
    "status": "ACTIVE",
    "cardLimit": "500.00",
    "availableLimit": "500.00",
    "currency": "USD",
    "label": "Ads spend - Q3",
    "externalId": "card-req-4471",
    "createTimeUtc": "2026-08-11T02:16:02Z"
  }
}

Verifying the signature

Two headers accompany every delivery:

Header	Value
`x-pik-timestamp`	Unix timestamp in seconds
`x-pik-signature`	HMAC-SHA512 signature, lowercase hex

x-pik-signature = hex_lower( HMAC_SHA512( webhookSecret, rawBody + timestamp ) )

The signed content is the raw body concatenated with the timestamp, no separator.

Sign the raw bytes of the request body, before any JSON parsing.

Compare in constant time.

Reject deliveries whose x-pik-timestamp is more than 300 seconds from your clock.

Delivery

Return HTTP 200 within 5 seconds to acknowledge.

Failed deliveries are retried with exponential backoff: 10s, 1m, 5m, 30m, 2h, 6h, 24h.

Delivery is at least once — deduplicate on eventId.

Ordering is not guaranteed — use occurredAt to decide which version is newer.

See the Webhooks guide for verification code samples and recommended
handling.

Card Activated

When it fires#

Payload#

Envelope#

data#

Example#

Verifying the signature#