Register webhook
Register a new webhook and receive callbacks.
Authorizations
JWT bearer token obtained via the OAuth2 client-credentials grant from the platform Authentication API. The token's scopes gate the endpoints it may call, and its audience names the Guardian instance. This is the standard way to authenticate to Guardian.
Body
The list of events to subscribe to.
1The type of event that occurred.
network.token.deleted is sent when a network token is deleted, whether through the API or by the card scheme. The token is no longer listed, and its related_object.url returns 404.
import.finished and import.failed are sent when an import completes or fails; related_object.id is the ID of the import.
wallet.apple_pay.certificate.expiring_soon is sent once a day for each Apple Pay certificate that expires within the next 30 days. wallet.apple_pay.certificate.compromised is sent when an Apple Pay certificate is disabled because it is suspected to be compromised. wallet.google_pay.key.disabled is sent when a Google Pay key is disabled. For these events, related_object.id is the ID of the certificate or key.
network.token.updated, network.token.deleted, pci.token.security-code.expired, import.finished, import.failed, wallet.apple_pay.certificate.expiring_soon, wallet.apple_pay.certificate.compromised, wallet.google_pay.key.disabled The URL to which the webhook will send event notifications. Use a publicly reachable HTTPS URL; Guardian does not deliver to private or reserved IP addresses.
255"https://merchant.com.example/webhooks/guardian"
The HMAC key to be used to sign the payloads sent to the webhook URL. Optional: without a key, notifications carry no x-hmac-signature header. The key is used as a string exactly as given (leading and trailing whitespace removed); it is not base64-decoded.
255"c2VjcmV0LXdlYmhvb2stc2lnbmluZy1rZXk="
Response
Success response
The unique identifier for the webhook.
"2f8d4b6c-9e1a-4c7f-b3d5-8a6e2c9f4b1d"
The timestamp when the webhook was created.
"2026-01-20T08:30:00Z"
The list of events the webhook is subscribed to.
1The type of event that occurred.
network.token.deleted is sent when a network token is deleted, whether through the API or by the card scheme. The token is no longer listed, and its related_object.url returns 404.
import.finished and import.failed are sent when an import completes or fails; related_object.id is the ID of the import.
wallet.apple_pay.certificate.expiring_soon is sent once a day for each Apple Pay certificate that expires within the next 30 days. wallet.apple_pay.certificate.compromised is sent when an Apple Pay certificate is disabled because it is suspected to be compromised. wallet.google_pay.key.disabled is sent when a Google Pay key is disabled. For these events, related_object.id is the ID of the certificate or key.
network.token.updated, network.token.deleted, pci.token.security-code.expired, import.finished, import.failed, wallet.apple_pay.certificate.expiring_soon, wallet.apple_pay.certificate.compromised, wallet.google_pay.key.disabled The URL to which the webhook sends event notifications.
"https://merchant.com.example/webhooks/guardian"
The masked HMAC key used to sign the payloads sent to the webhook URL. null when the webhook has no HMAC key.
"123xxxx"