Card By Link Webhook

Card By Link Guide

Send secure card capture links via email or SMS

When you create a Card By Link request with a CallBackURL, PCI Booking sends a POST request to that URL when the request reaches one of the statuses listed below. Your endpoint must accept the following payload.

Callback Payload

{
  "RequestID": "uC1efRTOpU4p3hmhH7fbY3J6A9LYL3j5",
  "LastNotifiedStatus": "CardStored",
  "LastNotifiedTime": "2017-12-19T20:07:32"
}

string

The unique identifier for the Card By Link request.

string

The current status of the request. Possible values:

Channel	Value	Description
SMS only	`MessageSent`	The message was sent to the recipient.
SMS only	`MessageFailed`	Message delivery to the recipient failed.
SMS only	`MessageDelivered`	Message was successfully delivered to the recipient.
Email / SMS	`FormViewed`	Recipient viewed the capture form.
Email / SMS	`CardStored`	Card was captured and tokenized successfully.
Email / SMS	`StoreFailed`	Recipient submitted the form and the capture failed: the card was rejected, 3DS failed with `UnavailThreeDSAuth` set to `Reject`, the form was submitted after its one-time token had already been used, or the recipient’s form session timed out.

string

Timestamp of the status change (ISO 8601 format).

No callback is sent when the request is created, when a link expires without being used, or when you cancel a request. To find out whether a request has expired, call Retrieve Request.

What to Do on `CardStored`

Once you receive a callback with LastNotifiedStatus: CardStored, call Retrieve Request to get the full request details including the CardUri (token URL).

For CVV-only requests, PCI Booking creates a new token that is a full copy of the original card details plus the captured CVV. The original token is not modified and does not contain the CVV. You should delete the original token if it is no longer needed, otherwise it will continue to incur monthly storage fees.

Remember to set the CVV Retention Policy on the token once CardStored is received.

Expected Response

Your callback endpoint must return 200 OK to acknowledge receipt.

Start Here

Authentication & General

Capture Cards

Manage Tokens

Use Tokens

Additional Functions

Payments Library

Card By Link Guide

Callback Payload

What to Do on `CardStored`

Expected Response

Card By Link Guide

​Callback Payload

​What to Do on CardStored

​Expected Response

Callback Payload

What to Do on `CardStored`

Expected Response