Skip to main content

Overview

Card webhooks notify your application when a card changes state or a card transaction occurs. The current card event types are:
  • card.authorization
  • card.charges
  • card.contactless.activation
  • card.created
  • card.created.failed
  • card.freezed
  • card.terminated
  • card.transaction
  • card.unfreezed
  • card.updated
The sections below document the payloads currently covered by this guide. Treat event IDs as idempotency keys and return 2xx after the event has been accepted for processing.

Created webhook event

This event is fired when a card is created.
card.created

Terminated webhook event

This event is fired when a card is terminated.
card.terminated

Freeze webhook event

This event is fired when a card is frozen.
card.freezed

Unfreeze webhook event

This event is fired when a card is unfrozen.
card.unfreezed

Updated webhook event

This event is fired when a card is funded.
card.updated

Transaction webhook event

This event is fired when a card transaction is made.

Transaction Categories

  • FUNDING
  • WITHDRAW
  • Transaction

Transaction Types

  • DEBIT
  • CREDIT

Transaction Status

  • APPROVED
  • DECLINED
  • COMPLETED
  • FAILED
  • REVERSE
card.transaction

Charges webhook event

The card.charges event is fired when a card-related fee is debited from the business USD wallet. It is not emitted when the fee is successfully taken directly from the card. Use charge_type to identify the fee:
  • CARD_DECLINE_FEE: a declined-card fee that could not be collected from the card.
  • CROSS_BORDER_FEE: a pending cross-border fee passed to the business wallet.
funding_source is BUSINESS_WALLET for this event.
card.charges

Contactless activation webhook event

The card.contactless.activation event contains the one-time code needed to add a contactless card to a supported wallet. This confidential event is delivered only after the business explicitly subscribes an eligible webhook.
card.contactless.activation
Swervpay includes these headers: Verify the signature against the raw request body using the webhook signing key returned when the webhook was created. The signed message is:
NodeJS
Validate that the timestamp is recent, verify the signature before parsing the body, store the event ID for idempotency, and return 2xx promptly. Swervpay attempts confidential delivery up to three times. Activation payloads are redacted from webhook logs and cannot be manually retried through the webhook retry endpoint.