Webhooks

Taappa sends HTTPS POST events to your configured endpoints. Manage endpoints and signing secrets in the Developer portal.

Events

Event	Description
`wallet.unlinked`	Wallet unlinked
`wallet.frozen`	Card frozen
`wallet.unfrozen`	Card unfrozen
`physical_card_request.pending`	Physical request is `PENDING`
`physical_card_request.in_production`	Physical request is `IN_PRODUCTION`
`physical_card_request.rejected`	Physical request is `REJECTED`
`physical_card_request.completed`	Physical request is `COMPLETED`
`physical_card_request.failed`	Physical request is `FAILED`

Payload

json

{
  "id": "evt_abc123",
  "type": "physical_card_request.completed",
  "created_at": "2026-08-31T18:00:00Z",
  "data": {
    "request_id": "...",
    "wallet_id": "...",
    "card_series": "ABCD123456",
    "card_number": "****1234",
    "provider": "telebirr",
    "status": "COMPLETED",
    "environment": "test"
  }
}

Wallet events use the same envelope with type set to wallet.unlinked, wallet.frozen, or wallet.unfrozen.

Verifying signatures

Each delivery includes:

http

Taappa-Signature: t=<unix_timestamp>,v1=<hex_hmac>

Compute HMAC-SHA256 of {timestamp}.{raw_request_body} with your endpoint signing secret (whsec_*), then compare to v1.

Reject deliveries whose timestamp is too far from your server clock.

Retries

Failed deliveries are retried with backoff. After the final attempt, status is FAILED and can be resent from the Developer portal.