CardIssued

⚠️
PAN and CVV are no longer delivered
The pan and cvv fields are deprecated and no longer populated — they remain in the payload for backward compatibility as null and will be retired soon. Card details are not delivered via webhooks for any integration type.
All webhook bodies are plain unencrypted JSON. There is no encrypted payload variant and no x-sign header. Webhook authenticity is verified via signatures — see Webhook Security.

Payload Fields

Field	Type	Description
`event`	string	Always `CardIssued`
`card.cardId`	string (UUID)	Unique card identifier
`card.idempotencyKey`	string (UUID)	Idempotency key provided during card issuance
`card.status`	string	Card status. Possible values: `Frozen`, `Issuing`, `Deleting`, `Ready`, `Failed`
`card.name`	string	Cardholder name printed on the card
`card.last4`	string	Last 4 digits of the card number
`card.address`	string	Billing address associated with the card
`card.isActive`	boolean	Whether the card is currently active
`card.clientNote`	string \| null	Optional note set during card issuance
`card.currency`	string	Card currency (ISO 4217, e.g. `GBP`)
`card.dateEnteredUtc`	string (ISO 8601)	Card creation timestamp in UTC
`card.purseId`	integer	ID of the purse (balance) linked to this card
`pan`	string \| null	Always `null`. Deprecated — no longer populated; the field will be retired soon
`cvv`	string \| null	Always `null`. Deprecated — no longer populated; the field will be retired soon

Sample Payload

The body is plain unencrypted JSON. The deprecated pan and cvv fields are always null.

{
  "event": "CardIssued",
  "card": {
    "cardId": "8f9c080b-b6a7-4208-aa42-8666e1482f93",
    "idempotencyKey": "f3f68ce3-c1eb-4e19-8b22-1ebaef3381f9",
    "status": "Ready",
    "name": "John Smith",
    "last4": "2575",
    "address": "123 Example Street, London",
    "isActive": true,
    "clientNote": null,
    "currency": "GBP",
    "dateEnteredUtc": "2025-09-29T07:55:09.119Z",
    "purseId": 4357502
  },
  "pan": null,
  "cvv": null
}

Webhook Security

This webhook is signed. Every request includes X-Signature and X-Key-Id headers for authenticity verification. See Webhook Security for verification instructions.