WEBHOOK
v1
/
cards
{
    "id": "123e4567-e89b-12d3-a456-426614174000",
    "subscription_id": "123e4567-e89b-12d3-a456-426614174000",
    "organization_id": "123e4567-e89b-12d3-a456-426614174000",
    "membership_id": "123e4567-e89b-12d3-a456-426614174000",
    "type": "v1/cards",
    "created_at": "2025-01-24T10:55:00Z",
    "data": {
        "event": "created",
        "id": "f47ac10b-58cc-4372-a567-0e02b2c3d479",
        "nickname": "💳 for 🍗",
        "status": "pending",
        "masked_pan": "511768******7662",
        "exp_month": "3",
        "exp_year": "2024",
        "atm_option": true,
        "nfc_option": true,
        "online_option": true,
        "foreign_option": true,
        "atm_daily_limit": "1000.00",
        "atm_daily_limit_option": true,
        "atm_monthly_limit": "1000.00",
        "payment_monthly_limit": "1000.00",
        "payment_daily_limit": "1000.00",
        "payment_daily_limit_option": true,
        "payment_transaction_limit": "1000.00",
        "payment_transaction_limit_option": true,
        "payment_lifespan_limit": "42.00",
        "active_days": [1, 3, 5],
        "holder_id": "a2b0c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d",
        "bank_account_id": "b3c4d5e6-f7a8-9b0c-1d2e-3f4a5b6c7d8e",
        "updated_at": "2023-05-15T14:32:17Z",
        "created_at": "2023-05-15T14:30:00Z",
        "card_type": "debit",
        "card_level": "standard",
        "category_tags": ["transport", "restaurant_and_bar", "food_and_grocery"],
        "renewal": false,
        "upsell": false,
        "discarded_at": "2022-11-31"
    }
}

{
    "id": "123e4567-e89b-12d3-a456-426614174000",
    "subscription_id": "123e4567-e89b-12d3-a456-426614174000",
    "organization_id": "123e4567-e89b-12d3-a456-426614174000",
    "membership_id": "123e4567-e89b-12d3-a456-426614174000",
    "type": "v1/cards",
    "created_at": "2025-01-24T10:55:00Z",
    "data": {
        "event": "created",
        "id": "f47ac10b-58cc-4372-a567-0e02b2c3d479",
        "nickname": "💳 for 🍗",
        "status": "pending",
        "masked_pan": "511768******7662",
        "exp_month": "3",
        "exp_year": "2024",
        "atm_option": true,
        "nfc_option": true,
        "online_option": true,
        "foreign_option": true,
        "atm_daily_limit": "1000.00",
        "atm_daily_limit_option": true,
        "atm_monthly_limit": "1000.00",
        "payment_monthly_limit": "1000.00",
        "payment_daily_limit": "1000.00",
        "payment_daily_limit_option": true,
        "payment_transaction_limit": "1000.00",
        "payment_transaction_limit_option": true,
        "payment_lifespan_limit": "42.00",
        "active_days": [1, 3, 5],
        "holder_id": "a2b0c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d",
        "bank_account_id": "b3c4d5e6-f7a8-9b0c-1d2e-3f4a5b6c7d8e",
        "updated_at": "2023-05-15T14:32:17Z",
        "created_at": "2023-05-15T14:30:00Z",
        "card_type": "debit",
        "card_level": "standard",
        "category_tags": ["transport", "restaurant_and_bar", "food_and_grocery"],
        "renewal": false,
        "upsell": false,
        "discarded_at": "2022-11-31"
    }
}

Authorizations

​
X-Qonto-Signature
string
header
required

The signature header follows the format t={timestamp},v1={signature}.

Verification steps:

  1. Extract the timestamp and signature from the signature header
  2. Reject the request if the timestamp is older than 5 minutes
  3. Recreate the signed payload: '{timestamp}.{raw_request_body}'
  4. Compute HMAC-SHA256 of the signed payload using your webhook secret as the key
  5. Compare the computed signature with the one in the header

Body

application/json

Response

200

Webhook received successfully