Test Webhook
curl --request POST \
--url https://api.fyatu.com/api/v3/webhooks/test \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"event": "card.created"
}
'import requests
url = "https://api.fyatu.com/api/v3/webhooks/test"
payload = { "event": "card.created" }
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({event: 'card.created'})
};
fetch('https://api.fyatu.com/api/v3/webhooks/test', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.fyatu.com/api/v3/webhooks/test",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'event' => 'card.created'
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.fyatu.com/api/v3/webhooks/test"
payload := strings.NewReader("{\n \"event\": \"card.created\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.fyatu.com/api/v3/webhooks/test")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"event\": \"card.created\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.fyatu.com/api/v3/webhooks/test")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"event\": \"card.created\"\n}"
response = http.request(request)
puts response.read_body{
"success": true,
"status": 200,
"message": "Test webhook delivered successfully",
"data": {
"event": "card.created",
"webhookUrl": "https://example.com/webhooks/fyatu",
"delivered": true,
"testData": {
"appId": "D0H6R7Z6R1C2N5O5",
"timestamp": "2026-01-15T10:30:00+00:00",
"_test": true,
"_note": "This is simulated test data for development purposes only.",
"cardId": "TEST_CRD8A7B6C5D4E3F2",
"cardholderId": "TEST_CH4a3b2c1d5e6f",
"type": "VIRTUAL",
"brand": "MASTERCARD",
"currency": "USD",
"last4": "4532",
"status": "ACTIVE"
},
"note": "This is TEST DATA for development purposes only. All IDs and values are simulated and do not represent real transactions.",
"signature": {
"algorithm": "HMAC-SHA256",
"signedWith": "Your webhook secret",
"verifyUsing": "hash_hmac(\"sha256\", json_encode($data), $webhookSecret)"
}
},
"meta": {
"requestId": "req_abc123xyz789",
"timestamp": "2026-01-15T10:30:00+00:00"
}
}
{
"success": true,
"status": 200,
"message": "Test webhook delivery attempted but failed",
"data": {
"event": "card.created",
"webhookUrl": "https://example.com/webhooks/fyatu",
"delivered": false,
"testData": {
"appId": "D0H6R7Z6R1C2N5O5",
"timestamp": "2026-01-15T10:30:00+00:00",
"_test": true,
"_note": "This is simulated test data for development purposes only.",
"cardId": "TEST_CRD8A7B6C5D4E3F2",
"cardholderId": "TEST_CH4a3b2c1d5e6f",
"type": "VIRTUAL",
"brand": "MASTERCARD",
"currency": "USD",
"last4": "4532",
"status": "ACTIVE"
},
"note": "This is TEST DATA for development purposes only. All IDs and values are simulated and do not represent real transactions.",
"signature": {
"algorithm": "HMAC-SHA256",
"signedWith": "Your webhook secret",
"verifyUsing": "hash_hmac(\"sha256\", json_encode($data), $webhookSecret)"
},
"error": "Webhook delivery failed. Check that your endpoint is accessible and returns HTTP 200."
},
"meta": {
"requestId": "req_def456uvw123",
"timestamp": "2026-01-15T10:30:00+00:00"
}
}
{
"success": false,
"status": 400,
"message": "Webhook URL not configured. Set a webhook URL first.",
"error": {
"code": "WEBHOOK_NOT_CONFIGURED"
},
"meta": {
"requestId": "req_ghi789rst456",
"timestamp": "2026-01-15T10:30:00+00:00"
}
}
Configuration
Test Webhook
Send a test webhook event to verify your endpoint is receiving and processing notifications correctly. POST /webhooks/test.
POST
/
webhooks
/
test
Test Webhook
curl --request POST \
--url https://api.fyatu.com/api/v3/webhooks/test \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"event": "card.created"
}
'import requests
url = "https://api.fyatu.com/api/v3/webhooks/test"
payload = { "event": "card.created" }
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({event: 'card.created'})
};
fetch('https://api.fyatu.com/api/v3/webhooks/test', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.fyatu.com/api/v3/webhooks/test",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'event' => 'card.created'
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.fyatu.com/api/v3/webhooks/test"
payload := strings.NewReader("{\n \"event\": \"card.created\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.fyatu.com/api/v3/webhooks/test")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"event\": \"card.created\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.fyatu.com/api/v3/webhooks/test")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"event\": \"card.created\"\n}"
response = http.request(request)
puts response.read_body{
"success": true,
"status": 200,
"message": "Test webhook delivered successfully",
"data": {
"event": "card.created",
"webhookUrl": "https://example.com/webhooks/fyatu",
"delivered": true,
"testData": {
"appId": "D0H6R7Z6R1C2N5O5",
"timestamp": "2026-01-15T10:30:00+00:00",
"_test": true,
"_note": "This is simulated test data for development purposes only.",
"cardId": "TEST_CRD8A7B6C5D4E3F2",
"cardholderId": "TEST_CH4a3b2c1d5e6f",
"type": "VIRTUAL",
"brand": "MASTERCARD",
"currency": "USD",
"last4": "4532",
"status": "ACTIVE"
},
"note": "This is TEST DATA for development purposes only. All IDs and values are simulated and do not represent real transactions.",
"signature": {
"algorithm": "HMAC-SHA256",
"signedWith": "Your webhook secret",
"verifyUsing": "hash_hmac(\"sha256\", json_encode($data), $webhookSecret)"
}
},
"meta": {
"requestId": "req_abc123xyz789",
"timestamp": "2026-01-15T10:30:00+00:00"
}
}
{
"success": true,
"status": 200,
"message": "Test webhook delivery attempted but failed",
"data": {
"event": "card.created",
"webhookUrl": "https://example.com/webhooks/fyatu",
"delivered": false,
"testData": {
"appId": "D0H6R7Z6R1C2N5O5",
"timestamp": "2026-01-15T10:30:00+00:00",
"_test": true,
"_note": "This is simulated test data for development purposes only.",
"cardId": "TEST_CRD8A7B6C5D4E3F2",
"cardholderId": "TEST_CH4a3b2c1d5e6f",
"type": "VIRTUAL",
"brand": "MASTERCARD",
"currency": "USD",
"last4": "4532",
"status": "ACTIVE"
},
"note": "This is TEST DATA for development purposes only. All IDs and values are simulated and do not represent real transactions.",
"signature": {
"algorithm": "HMAC-SHA256",
"signedWith": "Your webhook secret",
"verifyUsing": "hash_hmac(\"sha256\", json_encode($data), $webhookSecret)"
},
"error": "Webhook delivery failed. Check that your endpoint is accessible and returns HTTP 200."
},
"meta": {
"requestId": "req_def456uvw123",
"timestamp": "2026-01-15T10:30:00+00:00"
}
}
{
"success": false,
"status": 400,
"message": "Webhook URL not configured. Set a webhook URL first.",
"error": {
"code": "WEBHOOK_NOT_CONFIGURED"
},
"meta": {
"requestId": "req_ghi789rst456",
"timestamp": "2026-01-15T10:30:00+00:00"
}
}
Test Webhook
Send a test webhook event to your configured endpoint. This is useful for:- Verifying your webhook handler is working correctly
- Testing signature verification
- Developing and debugging your integration
All test data is simulated and clearly marked with
TEST_ prefixes. These are not real transactions, cards, or cardholders. The only real values are:- Your
appId - The webhook signature (signed with your real webhook secret)
Request
string
required
The event type to simulate. Use List Events to see available events for your app type.
curl -X POST https://api.fyatu.com/api/v3/webhooks/test \
-H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"event": "card.created"
}'
Response
boolean
Whether the request was successful
object
Show properties
Show properties
string
The event type that was sent
string
The URL where the webhook was sent
boolean
Whether the webhook was delivered successfully (HTTP 200 response)
object
The exact payload that was sent to your webhook endpoint
string
Reminder that this is test data
object
Information about how the webhook was signed
string
Error message if delivery failed (only present on failure)
{
"success": true,
"status": 200,
"message": "Test webhook delivered successfully",
"data": {
"event": "card.created",
"webhookUrl": "https://example.com/webhooks/fyatu",
"delivered": true,
"testData": {
"appId": "D0H6R7Z6R1C2N5O5",
"timestamp": "2026-01-15T10:30:00+00:00",
"_test": true,
"_note": "This is simulated test data for development purposes only.",
"cardId": "TEST_CRD8A7B6C5D4E3F2",
"cardholderId": "TEST_CH4a3b2c1d5e6f",
"type": "VIRTUAL",
"brand": "MASTERCARD",
"currency": "USD",
"last4": "4532",
"status": "ACTIVE"
},
"note": "This is TEST DATA for development purposes only. All IDs and values are simulated and do not represent real transactions.",
"signature": {
"algorithm": "HMAC-SHA256",
"signedWith": "Your webhook secret",
"verifyUsing": "hash_hmac(\"sha256\", json_encode($data), $webhookSecret)"
}
},
"meta": {
"requestId": "req_abc123xyz789",
"timestamp": "2026-01-15T10:30:00+00:00"
}
}
{
"success": true,
"status": 200,
"message": "Test webhook delivery attempted but failed",
"data": {
"event": "card.created",
"webhookUrl": "https://example.com/webhooks/fyatu",
"delivered": false,
"testData": {
"appId": "D0H6R7Z6R1C2N5O5",
"timestamp": "2026-01-15T10:30:00+00:00",
"_test": true,
"_note": "This is simulated test data for development purposes only.",
"cardId": "TEST_CRD8A7B6C5D4E3F2",
"cardholderId": "TEST_CH4a3b2c1d5e6f",
"type": "VIRTUAL",
"brand": "MASTERCARD",
"currency": "USD",
"last4": "4532",
"status": "ACTIVE"
},
"note": "This is TEST DATA for development purposes only. All IDs and values are simulated and do not represent real transactions.",
"signature": {
"algorithm": "HMAC-SHA256",
"signedWith": "Your webhook secret",
"verifyUsing": "hash_hmac(\"sha256\", json_encode($data), $webhookSecret)"
},
"error": "Webhook delivery failed. Check that your endpoint is accessible and returns HTTP 200."
},
"meta": {
"requestId": "req_def456uvw123",
"timestamp": "2026-01-15T10:30:00+00:00"
}
}
{
"success": false,
"status": 400,
"message": "Webhook URL not configured. Set a webhook URL first.",
"error": {
"code": "WEBHOOK_NOT_CONFIGURED"
},
"meta": {
"requestId": "req_ghi789rst456",
"timestamp": "2026-01-15T10:30:00+00:00"
}
}
Test Payload Structure
All test webhooks follow the standard webhook format:{
"event": "card.created",
"version": "2.0",
"sign": "hmac_sha256_signature_here",
"data": {
"appId": "YOUR_REAL_APP_ID",
"timestamp": "2026-01-15T10:30:00+00:00",
"_test": true,
"_note": "This is simulated test data for development purposes only.",
// ... event-specific test data with TEST_ prefixes
}
}
Identifying Test Webhooks
Test webhooks can be identified by:- The
_test: truefield in the data payload - The
_notefield explaining itβs test data - All IDs prefixed with
TEST_
_test: true if you want to handle test webhooks differently in production.
Available Test Events
Issuing App Events
# Card events
card.created
card.funded
card.unloaded
card.frozen
card.unfrozen
card.terminated
card.replaced
card.maintenance_fee_paid
# Card transaction events
card.transaction.approved
card.transaction.declined
card.transaction.reversed
card.transaction.cross_border_fee
card.transaction.decline_fee_domestic
card.transaction.decline_fee_international
# Cardholder events
cardholder.created
cardholder.updated
cardholder.kyc_submitted
cardholder.kyc_approved
cardholder.kyc_rejected
cardholder.suspended
cardholder.activated
Collection App Events
# Collection events
collection.initiated
collection.received
collection.failed
collection.expired
# Payout events
payout.initiated
payout.completed
payout.failed
# Refund events
refund.initiated
refund.completed
refund.failed
Verifying the Signature
Even test webhooks are signed with your real webhook secret. Use this to verify your signature verification code:const crypto = require('crypto');
function verifyWebhook(payload, signature, secret) {
const expectedSignature = crypto
.createHmac('sha256', secret)
.update(JSON.stringify(payload.data))
.digest('hex');
return signature === expectedSignature;
}
// In your webhook handler
app.post('/webhooks/fyatu', (req, res) => {
const { event, sign, data } = req.body;
if (!verifyWebhook(req.body, sign, process.env.WEBHOOK_SECRET)) {
return res.status(401).send('Invalid signature');
}
// Check if it's a test webhook
if (data._test) {
console.log('Received test webhook:', event);
return res.status(200).send('Test webhook received');
}
// Process real webhook...
res.status(200).send('OK');
});
Your webhook endpoint must return HTTP 200 within 10 seconds for the delivery to be considered successful.
Authorizations
JWT access token obtained from /auth/token
Body
application/json
The event type to simulate. Use List Events endpoint to see available events.
Example:
"card.created"
βI

