Card Activated

card.activated — delivered when card issuance succeeds and the card becomes usable.

When it fires

The Issue Card endpoint returns status: PENDING, which only means the request was accepted.
This event is the confirmation that the card is live.

Wait for this event before telling your end user the card is ready. If issuance fails you
receive Card Failed instead.

Payload

Envelope

Field	Type	Description
`eventId`	string	Unique per event. Deduplicate on this value
`eventType`	string	Always `card.activated`
`version`	string	Payload schema version. Additive changes do not bump it
`occurredAt`	string	When the event happened, not when it was delivered (ISO 8601)
`data`	object	The card, see below

`data`

Field	Type	Description
`cardNo`	string	PIK card number
`cardholderNo`	string	PIK cardholder number this card belongs to
`maskedCardNumber`	string	Masked card number, as issued by the card network. This event is sent once per card; the value is also available later from `GET /api/v1/issuing/card/{cardNo}`
`status`	string	`ACTIVE` for this event
`cardLimit`	string	Cumulative spending ceiling
`availableLimit`	string	Remaining spendable amount against `cardLimit`
`currency`	string	Settlement currency
`label`	string	Your label for the card
`externalId`	string	Your own identifier
`createTimeUtc`	string	Creation time (UTC)

Example

{
  "eventId": "evt_01J9X8ZQ4T2K",
  "eventType": "card.activated",
  "version": "1.0",
  "occurredAt": "2026-08-11T02:16:40Z",
  "data": {
    "cardNo": "CD260811X9Y8Z7",
    "cardholderNo": "CH260811A1B2C3",
    "maskedCardNumber": "40963608****0501",
    "status": "ACTIVE",
    "cardLimit": "500.00",
    "availableLimit": "500.00",
    "currency": "USD",
    "label": "Ads spend - Q3",
    "externalId": "card-req-4471",
    "createTimeUtc": "2026-08-11T02:16:02Z"
  }
}

Verifying the signature

Three headers accompany every delivery:

Header	Value
`X-Webhook-Event`	Event category, always `ISSUING` for this event
`X-Webhook-Event-Type`	The specific event type, see above
`X-Webhook-Signature`	HMAC-SHA256 signature, lowercase hex

X-Webhook-Signature = hex_lower( HMAC_SHA256( appSecret, rawBody ) )

The signed content is the raw request body only, with no timestamp and no separator. The signing
key is your appSecret — there is no separate webhook secret.

Sign the raw bytes of the request body, before any JSON parsing.

Compare in constant time.

Nothing time-based is signed, so a captured delivery stays replayable — deduplicating on
eventId is mandatory, not optional.

Delivery

Return any 2xx within 10 seconds to acknowledge.

Failed deliveries are retried on a fixed interval: 5 attempts, 5 minutes apart (about
20 minutes in total), after which the event is marked exhausted and never retried again.

This endpoint receives Issuing events only; still return 2xx for event types you do not handle.

Delivery is at least once — deduplicate on eventId.

Ordering is not guaranteed — use occurredAt to decide which version is newer.

See the Webhooks guide for verification code samples and recommended
handling.

Card Activated

When it fires#

Payload#

Envelope#

data#

Example#

Verifying the signature#