Skip to main content
Receive real-time notifications for card activity, virtual account funding, and payment transfers by configuring webhooks in your dashboard. Events are sent as POST requests to the URL you configure.

How Webhooks Work

  1. Configure your endpoint – In the dashboard, set the URL that will receive webhook events.
  2. Set your secret – Provide a secret value used to sign each request. Use it to verify that events come from Platnova.
  3. Receive events – We send a POST request to your URL for each subscribed event. Your endpoint must respond with HTTP 200 to acknowledge receipt.
  4. Retries – If your endpoint does not return 200, we retry the delivery up to 5 times at intermittent intervals until successful.
Your endpoint must return HTTP 200 for the request to be considered delivered. Non-2xx responses (including 4xx and 5xx) trigger retries.

Request Details

Always validate the X-WEBHOOK-SECRET header in your handler to ensure the request is from Platnova and has not been tampered with.

Supported Events

You can subscribe to specific events or patterns when configuring your webhook:

Event Payloads

Every webhook payload includes top-level fields:
  • event – Event type (e.g. card.created, transfer.success).
  • timestamp – ISO 8601 timestamp when the event occurred.
  • customer_id – Customer ID associated with the event (may be empty for entity-level events).
  • data – Event-specific payload (see below).

card.created

Sent when a new card is created.

card.terminated

Sent when a card is terminated.

card.withdrawal

Sent when funds are withdrawn from a card.

card.charged

Sent when a card is charged (purchase).

card.refund

Sent when a card charge is refunded.

card.funded

Sent when a card is funded (deposit).

card.declined

Sent when a card transaction is declined.

account.funded

Sent when a virtual account receives funds.

account.issued

Sent when a virtual account is issued.

customer.approved

Sent when a customer’s documents are approved for virtual account creation.

customer.rejected

Sent when a customer’s documents are rejected for virtual account creation.

transfer.success

Sent when a transfer completes successfully.

transfer.failed

Sent when a transfer fails.

Best Practices

  • Verify the secret – Always check X-WEBHOOK-SECRET against your configured value before processing.
  • Respond quickly – Return 200 as soon as you have received and validated the payload; process asynchronously if needed.
  • Handle duplicates – Use transaction_ref or event idempotency keys to avoid processing the same event more than once.
  • Log for debugging – Log incoming webhook requests and responses to troubleshoot delivery or retry issues.
For API endpoints to create or manage webhook configurations programmatically, see the Webhooks API reference.