Skip to main content
WEBHOOK

Headers

​
x-hmac-signature
string

HMAC-SHA256 of the raw request body, computed with the webhook's hmac_key and encoded as lowercase hex. Only sent when the webhook has an HMAC key.

Body

application/json
​
id
string<uuid>
required

The unique identifier for the event.

Example:

"8c2a6e4d-1f9b-4d5a-c7e3-2b8f6d4a9c1e"

​
created_at
string<date-time>
required

The timestamp when the event was created, with microsecond precision.

Example:

"2026-02-03T10:00:05.482913Z"

​
type
enum<string>
required

The type of event that occurred.

network.token.deleted is sent when a network token is deleted, whether through the API or by the card scheme. The token is no longer listed, and its related_object.url returns 404.

import.finished and import.failed are sent when an import completes or fails; related_object.id is the ID of the import.

wallet.apple_pay.certificate.expiring_soon is sent once a day for each Apple Pay certificate that expires within the next 30 days. wallet.apple_pay.certificate.compromised is sent when an Apple Pay certificate is disabled because it is suspected to be compromised. wallet.google_pay.key.disabled is sent when a Google Pay key is disabled. For these events, related_object.id is the ID of the certificate or key.

Available options:
network.token.updated,
network.token.deleted,
pci.token.security-code.expired,
import.finished,
import.failed,
wallet.apple_pay.certificate.expiring_soon,
wallet.apple_pay.certificate.compromised,
wallet.google_pay.key.disabled
​
reason
string
required

A human readable reason description why the event was triggered.

Example:

"The scheme updated the network token."

​
related_object
object
required

Response

Confirmation of receipt. Any 2xx status code is accepted.