Spend controls

Approve or reject card payments

Receive purchase authorization events and choose whether to approve or decline them by replying to the event.

Enable Authorization Forwarding and configure the Authorization Forwarding URL in the Embedder Portal. Weavr sends this event to {Authorization Forwarding URL}/managed_cards_authorisation_forwarding.

A response is expected within 1.5 seconds. If no response is received, the Default Timeout Response configured in the card profile or the card authForwardingDefaultTimeoutDecision parameter is used.

postWebhook/managed_cards/authorisation_request

Headers

call-refstring

A call reference generated by the caller and unique to the caller to provide correlation between the caller and system with a maximum length of 255

published-timestampinteger required

The timestamp, expressed in Epoch timestamp using millisecond precision, when this event was published.

signaturestring required

The signature to verify the authenticity of this request. This is the base64 hash (HmacSHA256) of the published-timestamp using your API key.

signature-v2string required

The signature to verify the authenticity of this request. This is the base64 hash (HmacSHA256) of the call-ref + payload + published-timestamp using your API key.

Payload

cardIdstring required

The unique identifier of the card on which an authorization is being performed

transactionIdstring required

The id of this transaction, for reference.

authorisationType'AUTHORISED' | 'AUTHORISED_CREDIT' required
transactionTimestampinteger required

The timestamp of the transaction, using epoch timestamp with millisecond precision.

cardholderPresent'PRESENT' | 'NOT_PRESENT' | 'PRESENCE_UNKNOWN'
cardPresentboolean

Optional detail indicating if the card was present when the authorization occurred.

authCodestring

The authorization code associated with this authorization.

modestring

The card can be created in prepaid mode or debit mode.

  • A prepaid mode card has its own balance and can have funds transferred to or from it.
  • A debit mode card does not have its own balance but will be able to spend funds belonging to its parent managed account, subject to a configurable spend limit.
transactionType'SALE_PURCHASE' | 'MAIL_OR_TELEPHONE_ORDER' | 'CASH_WITHDRAWAL' | 'ORIGINAL_CREDIT_TRANSACTION' | 'ACCOUNT_FUNDING_TRANSACTION' | 'CASH_DISBURSEMENT' | 'PURCHASE_REFUND' | 'BALANCE_INQUIRY' | 'PIN_CHANGE' | 'PIN_UNBLOCK'

Example payload

{
  "cardId": "234567890",
  "transactionId": "123456789",
  "sourceAmount": {
    "currency": "GBP",
    "amount": 1250
  },
  "transactionAmount": {
    "currency": "GBP",
    "amount": 1250
  },
  "totalTransactionCost": {
    "currency": "GBP",
    "amount": 1250
  },
  "transactionTimestamp": 1786118400000,
  "merchantData": {
    "merchantName": "Coffee Corner",
    "merchantCategoryCode": "5812",
    "merchantId": "MID123456",
    "merchantDescription": "Coffee shop",
    "merchantStreet": "1 High Street",
    "merchantCity": "London",
    "merchantState": "Greater London",
    "merchantPostalCode": "W1A 1AA",
    "merchantCountry": "GB",
    "merchantTelephone": "+442079460000",
    "merchantURL": "https://www.coffeecorner.example",
    "merchantNameOther": "Coffee Corner Ltd",
    "merchantNetworkId": "NET123456",
    "merchantContact": "info@coffeecorner.example"
  },
  "owner": {
    "type": "CONSUMER",
    "id": "123456789"
  },
  "cardPresent": true,
  "authCode": "123456",
  "forexPadding": {
    "currency": "GBP",
    "amount": 1250
  },
  "forexFee": {
    "currency": "GBP",
    "amount": 1250
  },
  "mode": "PREPAID_MODE"
}

Response

Authorization event received with an APPROVED or DENIED decision.

result'APPROVED' | 'DENIED'

Changes

Webhooks have no change history: a webhook is keyed by its event name rather than a path and method, so no recorded change can name it.