Cards (real time)

Register or rotate the real-time cards webhook

Creates or updates the webhook URL of the customer for the card_transaction.created and card_enrollment.confirmed events (see the cards-webhook-delivery schema for the delivery format and signature). On first setup, or when rotate_secret is true, a new webhook_secret (64 hex characters) is generated and returned once; in any other case webhook_secret comes back as null in the response and cannot be retrieved again. webhook_url must always be https:// and must resolve to a publicly routable host: localhost, private, loopback, link-local (including the cloud metadata address), CGNAT, multicast and reserved addresses are rejected, in any notation (hexadecimal, decimal, octal, short dotted or IPv4-mapped IPv6), and so is a hostname that does not resolve at all. The same check runs again right before every delivery, not only at registration: if the host is repointed at an internal address afterwards (DNS rebinding) the delivery is closed as failed with response_excerpt "blocked_host". Sending null in webhook_url disables webhooks for that customer; omitting the field leaves the stored URL untouched, which is how the secret is rotated without changing the URL.

post/cards/webhook/

Request

  • Base URL: https://api.wealthreader.com
  • URL: https://api.wealthreader.com/cards/webhook/
  • Auth: none declared

Request body

api_keystring required

API key of the customer.

webhook_urlstring nullable

https:// URL that will receive the events, on a publicly routable host that resolves in DNS. null disables webhooks; omitting the field leaves the stored URL unchanged.

rotate_secretboolean

When true, generates and returns a new webhook_secret.

Example request

{
  "api_key": "a1b2c3d4",
  "webhook_url": "https://cliente.example.com/webhooks/wealthreader-cards",
  "rotate_secret": false
}

Response

Webhook registered or updated

successboolean

Changes

No recorded changes to this operation across all 1 revision of this API.