How Webhooks Work
- Configure your endpoint – In the dashboard, set the URL that will receive webhook events.
- Set your secret – Provide a secret value used to sign each request. Use it to verify that events come from Platnova.
- Receive events – We send a POST request to your URL for each subscribed event. Your endpoint must respond with HTTP 200 to acknowledge receipt.
- Retries – If your endpoint does not return 200, we retry the delivery up to 5 times at intermittent intervals until successful.
Request Details
Always validate the
X-WEBHOOK-SECRET header in your handler to ensure the request is from Platnova and has not been tampered with.
Supported Events
You can subscribe to specific events or patterns when configuring your webhook:Event Payloads
Every webhook payload includes top-level fields:- event – Event type (e.g.
card.created,transfer.success). - timestamp – ISO 8601 timestamp when the event occurred.
- customer_id – Customer ID associated with the event (may be empty for entity-level events).
- data – Event-specific payload (see below).
card.created
Sent when a new card is created.card.terminated
Sent when a card is terminated.card.withdrawal
Sent when funds are withdrawn from a card.card.charged
Sent when a card is charged (purchase).card.refund
Sent when a card charge is refunded.card.funded
Sent when a card is funded (deposit).card.declined
Sent when a card transaction is declined.account.funded
Sent when a virtual account receives funds.account.issued
Sent when a virtual account is issued.customer.approved
Sent when a customer’s documents are approved for virtual account creation.customer.rejected
Sent when a customer’s documents are rejected for virtual account creation.transfer.success
Sent when a transfer completes successfully.transfer.failed
Sent when a transfer fails.Best Practices
- Verify the secret – Always check
X-WEBHOOK-SECRETagainst your configured value before processing. - Respond quickly – Return 200 as soon as you have received and validated the payload; process asynchronously if needed.
- Handle duplicates – Use
transaction_refor event idempotency keys to avoid processing the same event more than once. - Log for debugging – Log incoming webhook requests and responses to troubleshoot delivery or retry issues.

