Skip to main content
POST
Register webhook

Authorizations

Authorization
string
header
required

JWT bearer token obtained via the OAuth2 client-credentials grant from the platform Authentication API. The token's scopes gate the endpoints it may call, and its audience names the Guardian instance. This is the standard way to authenticate to Guardian.

Body

application/json
events
enum<string>[]
required

The list of events to subscribe to.

Minimum array length: 1

The type of event that occurred.

Available options:
network.token.updated,
pci.token.security-code.expired
url
string<uri>
required

The URL to which the webhook will send event notifications.

Example:

"https://merchant.com.example/webhooks/guardian"

hmac_key
string

The HMAC key to be used to sign the payloads sent to the webhook URL.

Example:

"c2VjcmV0LXdlYmhvb2stc2lnbmluZy1rZXk="

Response

Success response

id
string<uuid>
required

The unique identifier for the webhook.

Example:

"2f8d4b6c-9e1a-4c7f-b3d5-8a6e2c9f4b1d"

created_at
string<date-time>
required

The timestamp when the webhook was created.

Example:

"2026-01-20T08:30:00Z"

events
enum<string>[]
required

The list of events the webhook is subscribed to.

Minimum array length: 1

The type of event that occurred.

Available options:
network.token.updated,
pci.token.security-code.expired
url
string<uri>
required

The URL to which the webhook sends event notifications.

Example:

"https://merchant.com.example/webhooks/guardian"

masked_hmac_key
string

The masked HMAC key used to sign the payloads sent to the webhook URL.

Example:

"123xxxx"