Skip to main content

Overview

Our card webhook events are fired based on the following triggers:
  • Created webhook event
  • Terminated webhook event
  • Freeze webhook event
  • Unfreeze webhook event
  • Updated webhook event
  • Transaction webhook event
  • Charges webhook event
  • Contactless activation webhook event

Created webhook event

This event is fired when a card is created.
card.created

Terminated webhook event

This event is fired when a card is terminated.
card.terminated

Freeze webhook event

This event is fired when a card is freezed.
card.freezed

Unfreeze webhook event

This event is fired when a card is unfreezed.
card.unfreezed

Updated webhook event

This event is fired when a card is funded.
card.updated

Transaction webhook event

This event is fired when a card transaction is made.

Transaction Categories

  • FUNDING
  • WITHDRAW
  • Transaction

Transaction Types

  • DEBIT
  • CREDIT

Transaction Status

  • APPROVED
  • DECLINED
  • COMPLETED
  • FAILED
  • REVERSE
card.transaction

Charges webhook event

The card.charges event is fired when a card-related fee is debited from the business USD wallet. It is not emitted when the fee is successfully taken directly from the card. Use charge_type to identify the fee:
  • CARD_DECLINE_FEE: a declined-card fee that could not be collected from the card.
  • CROSS_BORDER_FEE: a pending cross-border fee passed to the business wallet.
funding_source is BUSINESS_WALLET for this event.
card.charges

Contactless activation webhook event

The card.contactless.activation event contains the one-time code needed to add a contactless card to a supported wallet. This confidential event is delivered only after the business explicitly subscribes an eligible webhook.
card.contactless.activation
Swervpay includes these headers: Verify the signature against the raw request body using the webhook signing key returned when the webhook was created. The signed message is:
NodeJS
Validate that the timestamp is recent, verify the signature before parsing the body, store the event ID for idempotency, and return 2xx promptly. Swervpay attempts confidential delivery up to three times. Activation payloads are redacted from webhook logs and cannot be manually retried through the webhook retry endpoint.