Webhooks

Learn how to listen for transactions that happen on your account

A webhook is a URL on your server where we send payloads for transaction events. For example, if you implement webhooks, we will immediately notify your server with a btc.lightning.received.success event Once a lightning payment is received. Whenever you receive a webhook notification from us, return a 200 OK to avoid resending the same event again from our server.


Verifying Events

Verifying that these events come from Bitnob is necessary to avoid creating transactions due to a fraudulent event.

To verify events, validate the x-bitnob-signature header sent with the event. The HMAC SHA512 signature is the event payload signed with your secret key.

Notification Retries

When posting notifications, we expect to receive a 200 response code from you. If the response code is not 200, we retry sending the event 3 times after the first failure.

This way, whenever you experience downtime on your end, your updates will still be sent.

Don't rely on webhooks entirely

Note

We recommend that you set up a service to always query transactions, in the event that webhooks keep failing.

Testing Webhooks

Since notifications must always be available on a publicly accessible URL, you are likely to run into issues while starting to build your application in a local environment. You can easily get around this by using a tool like ngrok or localtunnel

Create a tunnel, and update the new webhook URL setting on your dashboard. Only do this in your test environment to avoid leaking data to the public.

Verify Bitnob Webhook (Node.js - Express)

Virtual Cards Webhooks

Virtual card webhooks are fired when a customers perform any virtual card action.

Virtual Card creation failed

This is a webhook that is fired when virtual card creation fails

1
eventString

The specific webhook event type triggered. For example, 'virtualcard.created.failed' indicates a failed attempt to create a virtual card.

2
idUUID

Unique identifier for the failed virtual card creation attempt. Useful for referencing the failed transaction in logs or support cases.

3
reasonString

Detailed message describing why the virtual card creation failed. Often used for debugging or notifying the user about the issue.

4
companyIdUUID

The unique identifier of the company that initiated the virtual card creation request.

5
referenceString

A unique identifier for the specific card creation request. This can be used to cross-reference requests in internal systems.

Virtual Card Creation Failed - Webhook Payload

Virtual Card creation successful

This is a webhook that is fired when virtual card creation is successful

1
eventString

Type of webhook event. Indicates the creation of a virtual card was successful. This helps identify the nature of the action that triggered the webhook.

2
idString (UUID)

The unique identifier of the newly created virtual card. This ID can be used to retrieve card details, track card-related activities, or reference the card in support tickets and internal systems.

3
statusString

Current status of the virtual card. Typically 'active' if successfully created. This indicates whether the card is ready for transactions or needs further activation steps.

4
companyIdString (UUID)

The UUID of the company associated with the newly created card. It links the virtual card to the specific organization that initiated the creation request.

5
referenceString

Unique reference string used to identify the card creation request. It can be used for deduplication, auditing, reconciliation, and tracking purposes across systems.

6
createdStatusString

Status of the creation process. Should be 'success' if the card was created without issues. This field provides a final confirmation of the card generation outcome and can be used to validate the process.

Virtual Card Created Successfully - Webhook Payload

Virtual Cards Top

Virtual Card Top-up Success

This is a webhook that is fired when a virtual card top-up is successful

1
eventString

Webhook event type. This event indicates that a virtual card was successfully topped up. It is useful for identifying the nature of the transaction and triggering downstream actions.

2
idString (UUID)

Unique identifier for the top-up transaction. This can be used to reference the transaction in your database, audit logs, or support queries.

3
amountNumber

The amount that was credited to the virtual card. This value is typically in the card’s currency and reflects the exact top-up amount.

4
cardIdString (UUID)

The unique identifier of the virtual card that was topped up. This allows you to associate the transaction with the correct card and user account.

5
statusString

Status of the top-up transaction. Expected value: 'success'. Helps confirm that the transaction was completed and funds are available.

6
companyIdString (UUID)

The UUID of the company that owns the virtual card. Useful for identifying which organization's card was involved in the top-up.

7
narrativeString

A brief description or note for the top-up transaction. This may include the purpose of the top-up or additional metadata for internal reporting.

8
referenceString

A unique reference ID used to trace the top-up event. Helpful for reconciling transactions and resolving issues if they arise.

Virtual Card Top-up Successful - Webhook Payload

Virtual Card Top-up Failed

This is a webhook that is fired when a virtual card top-up fails

Note

The response is identical to that of Virtual Card Top-up Success. Refer to the Virtual Card Top-up Success section for field explanations.

Virtual Card Top-up failed - Webhook Payload

Virtual Cards Withdrawal

Virtual Card Withdrawal Success

This webhook is fired when a withdrawal on a virtual card succeeds.

1
eventString

Webhook event type indicating a successful virtual card withdrawal (virtualcard.withdrawal.success). This is useful for filtering or routing webhook handling logic.

2
statusString

Overall status of the withdrawal transaction. Expected value is 'success', confirming the operation completed without errors.

3
cardIdString (UUID)

Unique identifier of the virtual card from which funds were withdrawn. This helps identify the specific card affected by the transaction.

4
idString (UUID)

Unique identifier for this withdrawal transaction. It can be used for transaction lookup, reconciliation, and auditing.

5
companyIdString (UUID)

UUID of the company that owns the virtual card. This helps associate the withdrawal with the correct organizational context.

6
amountNumber

Amount of money that was successfully withdrawn from the virtual card. This reflects the debit value for the transaction.

7
referenceString

Unique reference ID used to trace or correlate the withdrawal event across systems and logs.

8
narrativeString

A brief note, description, or purpose for the withdrawal. It can aid in reporting or user-facing transaction histories.

9
isTerminatedBoolean

Indicates whether the virtual card was terminated following the withdrawal. A value of 'false' means the card is still active.

Virtual Card Withdrawal Successful - Webhook Payload

Virtual Card Withdrawal Failed

This webhook is fired when a withdrawal on a virtual card fails.

Note

The response is identical to that of Virtual Card Withdrawal Success. Refer to the Virtual Card Withdrawal Success section for field explanations.

Virtual Card Withdrawal Failed - Webhook Payload

Virtual Cards Transaction

Virtual Card Transaction - Debit

This webhook is fired when there is a debit transaction on a virtual card.

1
eventString

The webhook event type for a debit transaction. This helps you identify and route this webhook (e.g., 'virtualcard.transaction.debit').

2
idUUID

The unique identifier of the debit transaction. Useful for reconciliation and tracking in transaction history.

3
amountNumber

The amount of money that was debited from the virtual card as part of this transaction.

4
cardIdUUID

The unique identifier of the virtual card that was charged in this debit transaction.

5
reasonString or null

The explanation or note regarding the debit transaction, if any. May be null if no specific reason is provided.

6
statusString

The outcome of the transaction. Typically 'success', but may vary depending on processing results.

7
companyIdUUID

The unique identifier of the company that owns the virtual card associated with this transaction.

8
narrativeString

A human-readable description of the transaction, often including the merchant or payment processor name.

9
referenceString

A unique reference string assigned to this transaction. It can be used to trace or query the transaction across systems.

virtualcard.transaction.debit

Virtual Card Withdrawal - Failed

This webhook is fired when a virtual card withdrawal fails.

1
eventString

The webhook event type for a failed withdrawal. Example: 'virtualcard.withdrawal.failed'. This helps identify the nature of the webhook event.

2
idUUID

The unique identifier for the specific withdrawal attempt. Useful for transaction logging and debugging.

3
amountNumber

The amount that was attempted to be withdrawn from the virtual card. This value was not successfully debited.

4
cardIdUUID

The identifier of the virtual card involved in the withdrawal attempt. Links the failed transaction to the card.

5
statusString

The status of the withdrawal transaction. Expected value for this event is 'failed'.

6
companyIdUUID

The UUID of the company that owns the virtual card. Helps map the transaction back to a specific business account.

7
narrativeString

A brief human-readable description of the transaction, such as the transaction purpose or source.

8
referenceString

A unique reference string associated with this withdrawal transaction. Useful for reconciliation and tracking.

9
isTerminatedBoolean

Indicates whether the card was terminated as a result of the failed withdrawal. 'false' means the card remains active.

virtualcard.withdrawal.failed

Virtual Card Transaction - Reversed

This webhook is fired when there is a reversed transaction on a virtual card.

1
eventString

The webhook event type indicating that a previous debit transaction on a virtual card has been successfully reversed. Event value: 'virtualcard.transaction.reversed'.

2
idUUID

The unique identifier for the reversal transaction. This ID helps trace the specific reversal event in your records.

3
amountNumber

The amount of money that was refunded back to the virtual card as part of the reversal.

4
cardIdUUID

The unique identifier of the virtual card involved in the reversed transaction.

5
reasonString or null

An optional field that may include a short explanation or code detailing the cause of the reversal. Can be null if not provided.

6
statusString

Indicates the outcome of the reversal process. Expected value: 'success'.

7
companyIdUUID

The UUID of the company that owns or issued the virtual card involved in the reversal.

8
narrativeString

A human-readable description of the transaction. Typically includes the merchant name or reason for the original charge.

9
referenceString

A unique reference identifier that ties this reversal transaction to the original debit or purchase transaction.

virtualcard.transaction.reversed

Virtual Card Transaction - Declined

This webhook is fired when a purchase attempt is declined.

Note

The response is identical to that of Virtual Card Transaction - Reversed. Refer to the Virtual Card Transaction - Reversed section for field explanations.

virtualcard.transaction.declined

Virtual Card Transaction Declined - Frozen

This webhook is triggered when a virtual card is frozen due to suspected fraud or insufficient funds during authorization.

1
eventString

The webhook event type indicating that a virtual card transaction was declined and the card was frozen as a result. Typically triggered for security reasons such as suspected fraud.

2
cardIdUUID

The unique identifier of the virtual card that was frozen due to the declined transaction. This ID allows you to track or take further action on the affected card.

3
reasonString

A descriptive message explaining why the card was frozen. Example: 'Suspected Fraud' or 'Multiple failed attempts'.

4
companyIdUUID

The UUID of the company that owns or issued the virtual card. Useful for identifying which business account the frozen card belongs to.

5
referenceString

A unique reference ID associated with the declined transaction that triggered the card freeze. It can be used for logging or auditing purposes.

virtualcard.transaction.declined.frozen

Virtual Card Transaction Declined - Terminated

This webhook is triggered when a virtual card is permanently terminated due to multiple failed transactions from insufficient funds.

1
eventString

The webhook event type indicating that a virtual card transaction was declined and the card was frozen as a result. Typically triggered for security reasons such as suspected fraud.

2
cardIdUUID

The unique identifier of the virtual card that was frozen due to the declined transaction. This ID allows you to track or take further action on the affected card.

3
reasonString

A descriptive message explaining why the card was frozen. Example: 'Suspected Fraud' or 'Multiple failed attempts'.

4
companyIdUUID

The UUID of the company that owns or issued the virtual card. Useful for identifying which business account the frozen card belongs to.

5
referenceString

A unique reference ID associated with the declined transaction that triggered the card freeze. It can be used for logging or auditing purposes.

6
balanceBeforeTerminationNumber

Balance available before the card was terminated.

virtualcard.transaction.declined.terminated

Virtual Card Transaction Authorization Failed

This webhook is fired when a virtual card transaction fails during authorization due to insufficient funds.

1
eventString

The webhook event type for a failed authorization transaction. Indicates that a virtual card transaction could not be completed during the authorization phase.

2
idUUID

Unique identifier for the failed authorization attempt. Useful for tracking and debugging.

3
amountNumber

The amount that was attempted during the failed authorization.

4
cardIdUUID

The unique ID of the virtual card used in the failed authorization attempt.

5
reasonString

Explanation for why the authorization failed. Example: 'insufficient funds'.

6
statusString

The transaction status field. May still return 'success' for webhook delivery even if authorization failed.

7
companyIdUUID

Unique identifier of the company that owns the virtual card involved in the transaction.

8
referenceString

Unique reference string to help trace the failed transaction in logs or support tickets.

virtualcard.transaction.authorization.failed

Virtual Card Transaction Crossborder

This webhook is fired when a cross-border fee is charged to your USD wallet due to a virtual card transaction.

1
eventString

The webhook event type for a cross-border charge. Indicates that a fee was applied due to an international transaction.

2
amountNumber

The original amount of the transaction that triggered the cross-border charge. This is the actual purchase amount before fees.

3
cardIdUUID

The unique identifier of the virtual card used in the cross-border transaction.

4
statusString

The processing status of the cross-border charge (e.g., 'success' if the charge was applied successfully).

5
companyIdUUID

The unique ID of the company that owns the virtual card used in the transaction.

6
narrativeString

The merchant name or description associated with the transaction. This typically helps identify the vendor or service.

7
chargedAmountNumber

The specific amount deducted as a cross-border fee from the wallet or card.

virtualcard.transaction.crossborder

Virtual Card Created Success

This webhook is fired when a virtual card is created successfully.

1
eventString

The webhook event name triggered when a virtual card is created successfully. Typically: 'virtualcard.created.success'.

2
idUUID

The unique identifier assigned to the newly created virtual card. Useful for referencing and tracking the card.

3
statusString

The current operational status of the virtual card. Usually 'active' immediately after a successful creation.

4
companyIdUUID

The unique identifier of the company or organization that owns the newly created virtual card.

5
referenceString

A unique string reference generated during the card creation process. Used for tracking and reconciliation.

6
createdStatusString

The outcome of the card creation request. A value of 'success' indicates the card was issued without errors.

virtualcard.created.success

Virtual Card KYC Failed

This webhook is fired when a virtual card user's KYC is rejected.

Note

The response is identical to that of Virtual Card KYC Success. Refer to the Virtual Card KYC Success section for field explanations.

virtualcard.user.kyc.failed

Virtual Card Transaction Terminated Refund

This webhook is fired when a terminated virtual card transaction is refunded.

1
eventString

Webhook event name indicating that a refund was issued for a transaction on a terminated virtual card. Typically: 'virtualcard.transaction.terminated.refund'.

2
idUUID

A unique identifier representing the refund transaction. Used for tracking and reconciliation.

3
dateISO 8601 String

The timestamp when the refund was processed, formatted in ISO 8601 (e.g., '2024-08-04T20:51:57.290Z').

4
amountString

The monetary amount refunded to the cardholder or company account. Represented as a string to maintain precision.

5
cardIdUUID

The unique identifier of the virtual card that was terminated and refunded.

6
reasonString or null

An optional field that provides additional context on why the refund was issued. Can be null if no specific reason is recorded.

7
statusString

Indicates the final status of the refund process. Example: 'success'.

8
companyIdUUID

The UUID of the company that owns the terminated virtual card.

9
narrativeString

A short description or message associated with the refund transaction, providing context for the refund.

10
referenceString

A unique reference code used to trace and audit the refund operation.

virtualcard.transaction.terminated.refund

Virtual Card Transaction Verification

This webhook is triggered when a merchant initiates a zero-amount authorization to verify the virtual card is active.

1
eventString

Webhook event name indicating a card verification attempt. Value: 'virtualcard.transaction.verification'.

2
idUUID

A unique identifier for the verification transaction.

3
dateISO 8601 String

The timestamp when the verification was processed.

4
amountString

The authorization amount. Typically '0' for verification checks.

5
cardIdUUID

The unique identifier of the virtual card being verified.

6
reasonString

A message describing the result of the verification. Example: 'Card Account Successfully Verified'.

7
statusString

The status of the verification. Example: 'success'.

8
companyIdUUID

The UUID of the company that owns the virtual card.

9
narrativeString

A short description of the merchant or source that initiated the verification.

10
referenceString

A unique reference code for the verification transaction.

virtualcard.transaction.verification

Virtual Card Transaction Declined Charge

This webhook is triggered when a card receives an unsettled transaction or a reversed authorization.

1
eventString

Webhook event name indicating a declined charge on a virtual card. Value: 'virtualcard.transaction.declined.charge'.

2
idUUID

A unique identifier for the declined charge transaction.

3
amountNumber

The monetary amount of the declined charge.

4
cardIdUUID

The unique identifier of the virtual card that received the declined charge.

5
statusString

The status of the event. Example: 'success'.

6
companyIdUUID

The UUID of the company that owns the virtual card.

7
referenceString

A unique reference code for the declined charge transaction.

8
violationCountNumber

The number of declined charge violations recorded on this card.

virtualcard.transaction.declined.charge

Did you find this page useful?

Join our Discord