CardIssued

🔐
PAN, CVV and Payload Encryption (PCI DSS only)
By default, pan and cvv are not included in the payload and the body is not encrypted. Both are only available for integrations certified as PCI DSS compliant and explicitly enabled by Altery. In that case, the webhook body is encrypted using your public key registered with Altery.
To request PAN/CVV delivery, contact your account manager with proof of your PCI DSS compliance certification.

Payload Fields

Field	Type	Description
`event`	string	Always `CardIssued`
`card.cardId`	string (UUID)	Unique card identifier
`card.idempotencyKey`	string (UUID)	Idempotency key provided during card issuance
`card.status`	string	Card status. Possible values: `Frozen`, `Issuing`, `Deleting`, `Ready`, `Failed`
`card.name`	string	Cardholder name printed on the card
`card.last4`	string	Last 4 digits of the card number
`card.address`	string	Billing address associated with the card
`card.isActive`	boolean	Whether the card is currently active
`card.clientNote`	string \| null	Optional note set during card issuance
`card.currency`	string	Card currency (ISO 4217, e.g. `GBP`)
`card.dateEnteredUtc`	string (ISO 8601)	Card creation timestamp in UTC
`card.purseId`	integer	ID of the purse (balance) linked to this card
`pan`	string	Full card number. PCI DSS compliant integrations only
`cvv`	string	Card security code. PCI DSS compliant integrations only

Sample Payload

The sample below shows the payload for a PCI DSS compliant integration. For standard integrations, pan and cvv are omitted and the body is not encrypted.

{
  "event": "CardIssued",
  "card": {
    "cardId": "8f9c080b-b6a7-4208-aa42-8666e1482f93",
    "idempotencyKey": "f3f68ce3-c1eb-4e19-8b22-1ebaef3381f9",
    "status": "Ready",
    "name": "John Smith",
    "last4": "2575",
    "address": "123 Example Street, London",
    "isActive": true,
    "clientNote": null,
    "currency": "GBP",
    "dateEnteredUtc": "2025-09-29T07:55:09.119Z",
    "purseId": 4357502
  },
  "pan": "4308135113832575",
  "cvv": "507"
}

Webhook Security

This webhook is signed. Every request includes X-Signature and X-Key-Id headers for authenticity verification. See Webhook Security for verification instructions.