Immersve Docs
GithubX

Card Token Updated

post{listenerUrl}/card-token-updated

Triggered when a card token is created, changes status, or is removed from or added back to a device. Card tokens are Apple Pay, Google Pay, and Samsung Pay device tokens, and merchant card-on-file tokens.

Request

Header Parameters

  • X-Delivery-Idstring

    Unique message id plus delivery attempt.

  • X-Key-Idstring

    ID of the public key used to validate the signature.

  • X-Signaturestring

    Base64-encoded RSA SHA-256 signature of {deliveryId}:{keyId}:{requestBody}.

Body application/json

  • topicstring
    Allowed values:card-token-updated
  • payloadobject
    • eventobjectrequired
      • typestringrequired

        The card token lifecycle event which triggered the webhook.

        This set is non-exhaustive and may grow over time, so consumers should tolerate unrecognized values. The current values are created, activated, suspended, unsuspended, canceled, re-added, and removed-from-device.

      • createdAtstring<date-time>required

        Time the event occurred.

    • tokenobjectrequired
      • idstringrequired

        Card token identifier.

      • requestorstringrequired

        The wallet or merchant that requested the token.

        This set is non-exhaustive and may grow over time, so consumers should tolerate unrecognized values. The current options are apple-pay, google-pay, samsung-pay, merchant, and other.

      • statusstringrequired
        Allowed values:awaiting-approvalawaiting-verificationactivesuspendedcanceledapprovingsuspendingunsuspendingcanceling

        Token status.

        A token is awaiting-approval when the wallet tells the cardholder to contact the issuer to finish adding the card. Verify the cardholder, then call the Approve Card Token endpoint.

      • deviceStatusstring
        Allowed values:presentremoved

        Whether the card is still on the device, as last reported to Immersve. Omitted for merchant tokens and canceled tokens.

      • tokenSuffixstring

        Last four digits of the token's device primary account number (DPAN). Omitted until the card network reports it.

      • descriptionstring

        Human-readable label for the token, such as the device name or the merchant description.

      • provisioningRequestedAtstring<date-time>required

        Time the token was first requested.

    • cardobjectrequired
      • idstringrequired

        Card identifier.

    • cardholderobjectrequired
      • idstringrequired

        Cardholder account identifier.

  • messageIdstring
  • listenerIdstring
  • listenerAccountIdstring
  • deliveryAttemptnumber
  • createdAtstring

    The notification message creation timestamp.

  • sentAtstring

    The delivery attempt timestamp.

  • keyIdstring

    The public key id for validating the signature. Public keys can be found at https://api.immersve.com/.well-known/jwks.json and matched using the "kid" attribute.

  • issuerstring