Test Webhook
curl --request POST \
--url https://api.fyatu.com/api/v3/webhooks/test \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"event": "card.created"
}
'import requests
url = "https://api.fyatu.com/api/v3/webhooks/test"
payload = { "event": "card.created" }
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({event: 'card.created'})
};
fetch('https://api.fyatu.com/api/v3/webhooks/test', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.fyatu.com/api/v3/webhooks/test",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'event' => 'card.created'
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.fyatu.com/api/v3/webhooks/test"
payload := strings.NewReader("{\n \"event\": \"card.created\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.fyatu.com/api/v3/webhooks/test")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"event\": \"card.created\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.fyatu.com/api/v3/webhooks/test")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"event\": \"card.created\"\n}"
response = http.request(request)
puts response.read_body{
"success": true,
"status": 200,
"message": "Test webhook sent",
"data": {
"event": "card.funded",
"webhookUrl": "https://example.com/webhooks/fyatu",
"delivered": true,
"testData": {
"appId": "D0H6R7Z6R1C2N5O5",
"timestamp": "2026-01-15T10:30:00+00:00",
"_test": true,
"cardId": "CRD8a7b6c5d4e3f2a1",
"cardholderId": "CH4a3b2c1d5e6f",
"type": "VIRTUAL",
"brand": "MASTERCARD",
"currency": "USD",
"last4": "4242",
"status": "ACTIVE"
},
"note": "This is a simulated test event. Verify using the signature below.",
"signature": "c580cd5259a8d2289a22ca6f97af56ed5ebd8a7a783bf56636761ef9d59b1830"
},
"meta": {
"requestId": "req_abc123xyz789",
"timestamp": "2026-01-15T10:30:00+00:00"
}
}
{
"success": true,
"status": 200,
"message": "Test webhook sent",
"data": {
"event": "card.funded",
"webhookUrl": "https://example.com/webhooks/fyatu",
"delivered": false,
"testData": {
"appId": "D0H6R7Z6R1C2N5O5",
"timestamp": "2026-01-15T10:30:00+00:00",
"_test": true,
"cardId": "CRD8a7b6c5d4e3f2a1",
"cardholderId": "CH4a3b2c1d5e6f",
"type": "VIRTUAL",
"brand": "MASTERCARD",
"currency": "USD",
"last4": "4242",
"status": "ACTIVE"
},
"note": "This is a simulated test event. Verify using the signature below.",
"signature": "c580cd5259a8d2289a22ca6f97af56ed5ebd8a7a783bf56636761ef9d59b1830"
},
"meta": {
"requestId": "req_def456uvw123",
"timestamp": "2026-01-15T10:30:00+00:00"
}
}
{
"success": false,
"status": 400,
"message": "No webhook URL configured. Update your webhook URL first.",
"error": {
"code": "WEBHOOK_NOT_CONFIGURED"
},
"meta": {
"requestId": "req_ghi789rst456",
"timestamp": "2026-01-15T10:30:00+00:00"
}
}
Configuration
Test Webhook
Send a test webhook event to verify your endpoint is receiving and processing notifications correctly. POST /webhooks/test.
POST
/
webhooks
/
test
Test Webhook
curl --request POST \
--url https://api.fyatu.com/api/v3/webhooks/test \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"event": "card.created"
}
'import requests
url = "https://api.fyatu.com/api/v3/webhooks/test"
payload = { "event": "card.created" }
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({event: 'card.created'})
};
fetch('https://api.fyatu.com/api/v3/webhooks/test', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.fyatu.com/api/v3/webhooks/test",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'event' => 'card.created'
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.fyatu.com/api/v3/webhooks/test"
payload := strings.NewReader("{\n \"event\": \"card.created\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.fyatu.com/api/v3/webhooks/test")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"event\": \"card.created\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.fyatu.com/api/v3/webhooks/test")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"event\": \"card.created\"\n}"
response = http.request(request)
puts response.read_body{
"success": true,
"status": 200,
"message": "Test webhook sent",
"data": {
"event": "card.funded",
"webhookUrl": "https://example.com/webhooks/fyatu",
"delivered": true,
"testData": {
"appId": "D0H6R7Z6R1C2N5O5",
"timestamp": "2026-01-15T10:30:00+00:00",
"_test": true,
"cardId": "CRD8a7b6c5d4e3f2a1",
"cardholderId": "CH4a3b2c1d5e6f",
"type": "VIRTUAL",
"brand": "MASTERCARD",
"currency": "USD",
"last4": "4242",
"status": "ACTIVE"
},
"note": "This is a simulated test event. Verify using the signature below.",
"signature": "c580cd5259a8d2289a22ca6f97af56ed5ebd8a7a783bf56636761ef9d59b1830"
},
"meta": {
"requestId": "req_abc123xyz789",
"timestamp": "2026-01-15T10:30:00+00:00"
}
}
{
"success": true,
"status": 200,
"message": "Test webhook sent",
"data": {
"event": "card.funded",
"webhookUrl": "https://example.com/webhooks/fyatu",
"delivered": false,
"testData": {
"appId": "D0H6R7Z6R1C2N5O5",
"timestamp": "2026-01-15T10:30:00+00:00",
"_test": true,
"cardId": "CRD8a7b6c5d4e3f2a1",
"cardholderId": "CH4a3b2c1d5e6f",
"type": "VIRTUAL",
"brand": "MASTERCARD",
"currency": "USD",
"last4": "4242",
"status": "ACTIVE"
},
"note": "This is a simulated test event. Verify using the signature below.",
"signature": "c580cd5259a8d2289a22ca6f97af56ed5ebd8a7a783bf56636761ef9d59b1830"
},
"meta": {
"requestId": "req_def456uvw123",
"timestamp": "2026-01-15T10:30:00+00:00"
}
}
{
"success": false,
"status": 400,
"message": "No webhook URL configured. Update your webhook URL first.",
"error": {
"code": "WEBHOOK_NOT_CONFIGURED"
},
"meta": {
"requestId": "req_ghi789rst456",
"timestamp": "2026-01-15T10:30:00+00:00"
}
}
Test Webhook
Send a test webhook event to your configured endpoint. This is useful for:- Verifying your webhook handler is working correctly
- Testing signature verification
- Developing and debugging your integration
All test data is simulated and marked with
_test: true in the payload data. These are not real transactions, cards, or cardholders. The only real values are:- Your
appId - The webhook signature (signed with your real webhook secret)
Request
string
The event type to simulate. Use List Events to see available events for your app type. Optional — if omitted, defaults to
card.funded for issuing apps and collection.initiated for collection apps.curl -X POST https://api.fyatu.com/api/v3/webhooks/test \
-H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"event": "card.funded"
}'
Response
boolean
Whether the request was successful
object
Show properties
Show properties
string
The event type that was sent
string
The URL where the webhook was sent
boolean
Whether the webhook was delivered successfully (HTTP 200 response)
object
The exact payload that was sent to your webhook endpoint
string
Reminder that this is a simulated test event
string
The HMAC-SHA256 signature (hex) computed over the
testData payload with your webhook secret. Use it to verify your signature-checking code.{
"success": true,
"status": 200,
"message": "Test webhook sent",
"data": {
"event": "card.funded",
"webhookUrl": "https://example.com/webhooks/fyatu",
"delivered": true,
"testData": {
"appId": "D0H6R7Z6R1C2N5O5",
"timestamp": "2026-01-15T10:30:00+00:00",
"_test": true,
"cardId": "CRD8a7b6c5d4e3f2a1",
"cardholderId": "CH4a3b2c1d5e6f",
"type": "VIRTUAL",
"brand": "MASTERCARD",
"currency": "USD",
"last4": "4242",
"status": "ACTIVE"
},
"note": "This is a simulated test event. Verify using the signature below.",
"signature": "c580cd5259a8d2289a22ca6f97af56ed5ebd8a7a783bf56636761ef9d59b1830"
},
"meta": {
"requestId": "req_abc123xyz789",
"timestamp": "2026-01-15T10:30:00+00:00"
}
}
{
"success": true,
"status": 200,
"message": "Test webhook sent",
"data": {
"event": "card.funded",
"webhookUrl": "https://example.com/webhooks/fyatu",
"delivered": false,
"testData": {
"appId": "D0H6R7Z6R1C2N5O5",
"timestamp": "2026-01-15T10:30:00+00:00",
"_test": true,
"cardId": "CRD8a7b6c5d4e3f2a1",
"cardholderId": "CH4a3b2c1d5e6f",
"type": "VIRTUAL",
"brand": "MASTERCARD",
"currency": "USD",
"last4": "4242",
"status": "ACTIVE"
},
"note": "This is a simulated test event. Verify using the signature below.",
"signature": "c580cd5259a8d2289a22ca6f97af56ed5ebd8a7a783bf56636761ef9d59b1830"
},
"meta": {
"requestId": "req_def456uvw123",
"timestamp": "2026-01-15T10:30:00+00:00"
}
}
{
"success": false,
"status": 400,
"message": "No webhook URL configured. Update your webhook URL first.",
"error": {
"code": "WEBHOOK_NOT_CONFIGURED"
},
"meta": {
"requestId": "req_ghi789rst456",
"timestamp": "2026-01-15T10:30:00+00:00"
}
}
Test Payload Structure
All test webhooks follow the standard webhook format:{
"event": "card.funded",
"version": "3.0",
"eventId": "112dff51-8275-4d60-9cd4-ad9aeb930478",
"sign": "hmac_sha256_signature_here",
"data": {
"appId": "YOUR_REAL_APP_ID",
"timestamp": "2026-01-15T10:30:00+00:00",
"_test": true,
// ... event-specific test data
}
}
Identifying Test Webhooks
Test webhooks can be identified by the_test: true field in the data payload.
Your webhook handler should check for _test: true if you want to handle test webhooks differently in production.
Available Test Events
Issuing App Events
# Card events
card.funded
card.funded
card.unloaded
card.frozen
card.unfrozen
card.terminated
card.terminated
card.maintenance_fee_paid
# Card transaction events
card.transaction.approved
card.transaction.declined
card.transaction.reversed
card.transaction.cross_border_fee
card.transaction.decline_fee_domestic
card.transaction.decline_fee_international
# Cardholder events
cardholder.created
cardholder.updated
cardholder.kyc_submitted
cardholder.kyc_approved
cardholder.kyc_rejected
cardholder.suspended
cardholder.activated
Collection App Events
# Collection events
collection.initiated
collection.received
collection.failed
collection.expired
# Payout events
payout.initiated
payout.completed
payout.failed
# Refund events
refund.initiated
refund.completed
refund.failed
Verifying the Signature
Even test webhooks are signed with your real webhook secret. Use this to verify your signature verification code:const crypto = require('crypto');
function verifyWebhook(payload, signature, secret) {
const expectedSignature = crypto
.createHmac('sha256', secret)
.update(JSON.stringify(payload.data))
.digest('hex');
return signature === expectedSignature;
}
// In your webhook handler
app.post('/webhooks/fyatu', (req, res) => {
const { event, sign, data } = req.body;
if (!verifyWebhook(req.body, sign, process.env.WEBHOOK_SECRET)) {
return res.status(401).send('Invalid signature');
}
// Check if it's a test webhook
if (data._test) {
console.log('Received test webhook:', event);
return res.status(200).send('Test webhook received');
}
// Process real webhook...
res.status(200).send('OK');
});
Your webhook endpoint must return HTTP 200 within 10 seconds for the delivery to be considered successful.
Authorizations
JWT access token obtained from /auth/token
Body
application/json
The event type to simulate. Use List Events endpoint to see available events.
Example:
"card.created"

