Card Updated

card.updated — delivered when a card's limit or status has changed and the change has taken effect.

When it fires

The three card operations — adjust limit, freeze, unfreeze — all return status: PROCESSING,
which only means the request was accepted. The card itself has not changed yet. This event is the
confirmation that it has.

Wait for this event before showing your end user the new limit or status.

One event covers all three operations; there is no separate event per operation. Whatever changed,
data is the full current card — apply it as a replacement snapshot, not as a diff.

It also fires for changes PIK made on your behalf rather than through your API call, and for
status changes set by the card network (for example a card becoming BLOCKED or CANCELLED), so a
card can change without you having asked. Treat this event, not your own request, as the source of truth
for a card's current limit and status.

If the card network rejects an operation after accepting it, you receive
card.operation.failed instead, and the card keeps its previous
limit and status. Every accepted operation therefore ends in exactly one of the two events. An
operation refused synchronously by the API (a 4xx response) was never accepted and produces no
event.

Payload

Envelope

Field	Type	Description
`eventId`	string	Unique per event. Deduplicate on this value
`eventType`	string	Always `card.updated`
`version`	string	Payload schema version. Additive changes do not bump it
`occurredAt`	string	When the event happened, not when it was delivered (ISO 8601)
`data`	object	The card, see below

`data`

Structurally identical to the response of GET /api/v1/issuing/card/{cardNo}, so a single parser
handles both paths.

Field	Type	Description
`cardNo`	string	PIK card number
`cardholderNo`	string	PIK cardholder number this card belongs to
`maskedCardNumber`	string	Masked card number
`status`	string	The status after the change. After your own limit / freeze / unfreeze operations this is `ACTIVE` or `FROZEN`; changes from the card network can bring any card status: `PENDING` / `ACTIVE` / `FROZEN` / `BLOCKED` / `PRE_CANCEL` / `CANCELLED` / `LOST` / `STOLEN` / `FAILED`. Treat an unrecognised value as "not usable"
`cardLimit`	string	Cumulative spending ceiling, after the change
`availableLimit`	string	Remaining spendable amount against `cardLimit`
`currency`	string	Settlement currency
`label`	string	Your label for the card
`externalId`	string	Your own identifier
`createTimeUtc`	string	Creation time (UTC)

Example — limit raised

{
  "eventId": "evt_01J9X8ZQ4T7M",
  "eventType": "card.updated",
  "version": "1.0",
  "occurredAt": "2026-09-23T04:11:27Z",
  "data": {
    "cardNo": "CD260811X9Y8Z7",
    "cardholderNo": "CH260811A1B2C3",
    "maskedCardNumber": "409636******0501",
    "status": "ACTIVE",
    "cardLimit": "800.00",
    "availableLimit": "788.50",
    "currency": "USD",
    "label": "Ads spend - Q3",
    "externalId": "card-req-4471",
    "createTimeUtc": "2026-08-11T02:16:02Z"
  }
}

Example — card frozen

{
  "eventId": "evt_01J9X8ZQ4T8N",
  "eventType": "card.updated",
  "version": "1.0",
  "occurredAt": "2026-09-23T04:15:02Z",
  "data": {
    "cardNo": "CD260811X9Y8Z7",
    "cardholderNo": "CH260811A1B2C3",
    "maskedCardNumber": "409636******0501",
    "status": "FROZEN",
    "cardLimit": "800.00",
    "availableLimit": "788.50",
    "currency": "USD",
    "label": "Ads spend - Q3",
    "externalId": "card-req-4471",
    "createTimeUtc": "2026-08-11T02:16:02Z"
  }
}

What freezing does. A frozen card is refused for all new authorisations. Transactions
that were already authorised but not yet settled are unaffected — they will still settle, and
you will still receive their events.

Verifying the signature

Three headers accompany every delivery:

Header	Value
`X-Webhook-Event`	Event category, always `ISSUING` for this event
`X-Webhook-Event-Type`	The specific event type, see above
`X-Webhook-Signature`	HMAC-SHA256 signature, lowercase hex

X-Webhook-Signature = hex_lower( HMAC_SHA256( appSecret, rawBody ) )

The signed content is the raw request body only, with no timestamp and no separator. The signing
key is your appSecret — there is no separate webhook secret.

Sign the raw bytes of the request body, before any JSON parsing.

Compare in constant time.

Nothing time-based is signed, so a captured delivery stays replayable — deduplicating on
eventId is mandatory, not optional.

Delivery

Return any 2xx within 10 seconds to acknowledge.

Failed deliveries are retried on a fixed interval: 5 attempts, 5 minutes apart (about
20 minutes in total), after which the event is marked exhausted and never retried again.

This endpoint receives Issuing events only; still return 2xx for event types you do not handle.

Delivery is at least once — deduplicate on eventId.

Ordering is not guaranteed — use occurredAt to decide which version is newer. A card that
changes twice in quick succession produces two events, and they can arrive out of order.

See the Webhooks guide for verification code samples and recommended
handling.

Card Updated

When it fires#

Payload#

Envelope#

data#

Example — limit raised#

Example — card frozen#

Verifying the signature#

Delivery#