Webhooks

Card transaction

Webhook that is called on every lifecycle update of a card CardTransaction. Fires when an authorization is approved (CARD_TRANSACTION.AUTHORIZED), as clearings settle against it (CARD_TRANSACTION.PARTIALLY_SETTLED, CARD_TRANSACTION.SETTLED), when the authorization is declined (CARD_TRANSACTION.DECLINED), when an authorization is fully reversed or expires (CARD_TRANSACTION.VOIDED), and when a transaction settles to the card network but the funding-source pull fails (CARD_TRANSACTION.EXCEPTION). The payload carries the full CardTransaction resource.

A merchant return is its own CardTransaction row (direction: CREDIT) linked to the purchase via originalTransactionId, and fires its own CARD_TRANSACTION.* deliveries on that row — the purchase row is not re-fired for the return.

This endpoint should be implemented by clients of the Grid API.

Authentication

The webhook includes a signature in the X-Grid-Signature header that allows you to verify that the webhook was sent by Grid. To verify the signature:

  1. Get the Grid public key provided to you during integration
  2. Decode the base64 signature from the header
  3. Create a SHA-256 hash of the request body
  4. Verify the signature using the public key and the hash

If the signature verification succeeds, the webhook is authentic. If not, it should be rejected.

postWebhookcard-transaction

Payload

idstring required

Unique identifier for this webhook delivery (can be used for idempotency)

type'CARD_TRANSACTION.AUTHORIZED' | 'CARD_TRANSACTION.PARTIALLY_SETTLED' | 'CARD_TRANSACTION.SETTLED' | 'CARD_TRANSACTION.DECLINED' | 'CARD_TRANSACTION.VOIDED' | 'CARD_TRANSACTION.EXCEPTION' required

Type of webhook event in OBJECT.EVENT dot-notation. The part before the dot identifies the resource, the part after identifies the event. This lets consumers route purely on type without inspecting data.status.

timestampstring date-time required

ISO 8601 timestamp of when the webhook was sent

Example payload

{
  "id": "Webhook:019542f5-b3e7-1d02-0000-000000000007",
  "timestamp": "2025-08-15T14:32:00Z",
  "data": {
    "id": "Transaction:019542f5-b3e7-1d02-0000-000000000100",
    "cardId": "Card:019542f5-b3e7-1d02-0000-000000000010",
    "customerId": "Customer:019542f5-b3e7-1d02-0000-000000000001",
    "platformCustomerId": "18d3e5f7b4a9c2",
    "issuerTransactionToken": "lithic_txn_b81c2a4f",
    "originalTransactionId": "Transaction:019542f5-b3e7-1d02-0000-000000000099",
    "description": "BLUE BOTTLE COFFEE SF",
    "merchant": {
      "descriptor": "BLUE BOTTLE COFFEE SF",
      "mcc": "5814",
      "city": "San Francisco",
      "state": "CA",
      "country": "US"
    },
    "authorizedAmount": {
      "amount": 12550,
      "currency": {
        "code": "USD",
        "name": "United States Dollar",
        "symbol": "$",
        "decimals": 2
      }
    },
    "settledAmount": {
      "amount": 12550,
      "currency": {
        "code": "USD",
        "name": "United States Dollar",
        "symbol": "$",
        "decimals": 2
      }
    },
    "refundedAmount": {
      "amount": 12550,
      "currency": {
        "code": "USD",
        "name": "United States Dollar",
        "symbol": "$",
        "decimals": 2
      }
    },
    "accountId": "InternalAccount:019542f5-b3e7-1d02-0000-000000000002",
    "authorizedAt": "2026-05-08T14:30:00Z",
    "createdAt": "2026-05-08T14:30:00Z",
    "updatedAt": "2026-05-08T15:42:11Z"
  }
}

Response

Webhook received successfully

Changes

Webhooks have no change history: a webhook is keyed by its event name rather than a path and method, so no recorded change can name it.