> ## Documentation Index
> Fetch the complete documentation index at: https://developers.pcibooking.net/llms.txt
> Use this file to discover all available pages before exploring further.

# Card Entry Form Webhook

> PCI Booking sends a POST request to your callback URL each time the status of a card entry form session changes.

<Card title="Hosted Card Entry Form Guide" icon="book" href="/capture-cards/hosted-card-entry-form#option-2-api-session">
  API session approach for embedded card capture
</Card>

When you create a session-based card entry form with a `CallBackURL`, PCI Booking sends a POST request to that URL each time the session status changes. Your endpoint must accept the following payload.

## Webhook Payload

```json theme={null}
{
  "CaptureCardRequestID": "uC1efRTOpU4p3hmhH7fbY3J6A9LYL3j5",
  "CaptureCardRequestStatus": "OK",
  "CardUri": "https://service.pcibooking.net/api/payments/paycard/G54Cvv0GZddE4TTr44mHj12DssAzb5Dp"
}
```

<ParamField body="CaptureCardRequestID" type="string">
  The ID of the card entry form session. Matches the `RequestID` returned by [Create Card Entry Form Session](/api-reference/tokenize-cards/create-card-entry-form-session).
</ParamField>

<ParamField body="CaptureCardRequestStatus" type="string">
  The current status of the session. Possible values:

  | Status       | Value     | Description                                                                                                   |
  | ------------ | --------- | ------------------------------------------------------------------------------------------------------------- |
  | Card stored  | `OK`      | Card was tokenized successfully. The `CardUri` field contains the token URL.                                  |
  | Store failed | `Failure` | Card storage failed due to a general error.                                                                   |
  | Bad data     | `BadData` | Card storage failed because the cardholder entered invalid data (e.g. a card type not in the supported list). |
  | Expired      | `Expired` | The session exceeded its `TTL` without a successful submission.                                               |
</ParamField>

<ParamField body="CardUri" type="string">
  The PCI Booking token URL for the stored card. Only present when `CaptureCardRequestStatus` is `OK`.
</ParamField>

## Expected Response

Your callback endpoint must return **200 OK** to acknowledge receipt. If PCI Booking does not receive a 200 response, the notification is not retried.