Immersve Docs
GithubX

XPay Card Load OTP

post{listenerUrl}/xpay-card-load-otp

Triggered when a one-time password (OTP) is generated as part of the security challenge for provisioning an XPay card to a digital wallet (Apple Pay, Google Pay or similar). The challenge applies to both manual and in-app push provisioning and is presented dynamically based on card load risk scoring. Subscribers should use this event to deliver the OTP to the cardholder in their preferred channel.

Request

Header Parameters

  • X-Delivery-Idstring

    Unique message id plus delivery attempt.

  • X-Key-Idstring

    ID of the public key used to validate the signature.

  • X-Signaturestring

    Base64-encoded RSA SHA-256 signature of {deliveryId}:{keyId}:{requestBody}.

Body application/json

  • topicstring
    Allowed values:xpay-card-load-otp
  • payloadobject
    • xpayTypestring
      Allowed values:applegenericgoogle

      Type of XPay being used.

    • verificationCodestring

      The XPay one-time code to deliver to the cardholder.

    • cardholderIdstring

      The Immersve cardholder's account id.

    • cardIdstring

      The Immersve card id for the card being loaded.

    • cardPanLast4string

      The last four digits of the card PAN.

    • cardProgramIdstring

      The Immersve card program id for the card.

    • expiresAtstring

      The OTP expiration timestamp

    • deliveryOptionsobject[]min items: 1

      Specifies the method by which the notification should be delivered to the cardholder. Subscriber must send the notification using one of the specified delivery channel.

      Items

      • typestringrequired
        Allowed values:smsemail

        The delivery channel method.

      • destinationstring

        The delivery destination. E.g: a phone number in the case of sms or email address in the case of email

  • messageIdstring
  • listenerIdstring
  • listenerAccountIdstring
  • deliveryAttemptnumber
  • createdAtstring

    The notification message creation timestamp.

  • sentAtstring

    The delivery attempt timestamp.

  • keyIdstring

    The public key id for validating the signature. Public keys can be found at https://api.immersve.com/.well-known/jwks.json and matched using the "kid" attribute.

  • issuerstring

Response

Subscription response

Body application/json

  • deliveryTypestring

    Selected delivery option by the subscriber

  • deliveryDestinationstring

    Destination where the notification was sent to by the subscriber