Browse the docs

Get event

GET /v1/api-gateway/event/{event_id}

Returns one event by id, with the payload the delivery carried and its delivery state. The id is the webhook_event_id of the delivered body. Same contract as V2 GET /events/{event_id}.

Request

Authentication: your API key in the x-api-key header.

Path parameters

Field	Type	Description
`event_id` required	string, uuid	Event UUID.

Example request

cURL

curl --request GET \
     --url 'https://api.themooncard.com/v1/api-gateway/event/8d2cd518-5ef2-4280-91e8-63b1a0e672e7' \
     --header 'x-api-key: YOUR_API_KEY'

Responses

200 Success

Field	Type	Description
`id` required	string	Event UUID. The same value the delivered payload carries as `webhook_event_id`, so it can be used to reconcile against what you already received.
`type` required	string	Event type, identical to the delivered `type`.One of: `CARD_TRANSACTION`, `CARD_AUTHORIZATION_REFUND`, `CARD_DECLINE`, `MOON_CREDIT_FUNDS_CREDITED`, `KYC_UPDATE`, `THREE_DS_OTP`, `DEPOSIT_CREDITED`, `DEPOSIT_UNDER_REVIEW`, `DEPOSIT_ABANDONED`, `DEPOSIT_BELOW_MINIMUM`, `DEPOSIT_KYT_PENDING`, `DEPOSIT_KYT_FINAL`, `THREE_DS_AUTHENTICATION_RESULT`, `THREE_DS_OOB_CHALLENGE`, `VELOCITY_CONTROL_WATCHED`, `PURCHASE_INTENT_REQUESTED`, `PURCHASE_INTENT_APPROVED`, `PURCHASE_INTENT_DENIED`, `PURCHASE_INTENT_EXPIRED`, `PURCHASE_INTENT_CANCELLED`, `ASK_FIRST_DISABLE_REQUESTED`, `ASK_FIRST_DISABLED`, `ASK_FIRST_DISABLE_DENIED`, `ASK_FIRST_DISABLE_EXPIRED`, `ASK_FIRST_DISABLE_CANCELLED`, `AUTONOMY_GRANT_REQUESTED`, `AUTONOMY_GRANT_ACTIVATED`, `AUTONOMY_GRANT_DENIED`, `AUTONOMY_GRANT_REVOKED`, `AUTONOMY_GRANT_EXPIRED`, `AUTONOMY_GRANT_CANCELLED`, `CARD_WALLET_TOKEN_UPDATED`, `CARD_WALLET_TOKEN_OTP`, `CARD_RENEWED`
`created_at` required	string	ISO-8601 UTC timestamp with milliseconds, e.g. "2026-08-17T12:00:00.000Z".
`delivery` required	object
`delivery.status` required	string	Delivery state. `pending` — attempts are still scheduled; `delivered` — your endpoint answered 2xx; `failed` — every attempt was used and none succeeded.One of: `pending`, `delivered`, `failed`
`delivery.attempts` required	integer	Delivery attempts made so far.
`delivery.max_attempts` required	integer	Total attempts an event gets before delivery is abandoned.
`delivery.last_attempt_at` required	string, nullable	ISO-8601 UTC timestamp of the most recent attempt, or null if none was made yet.
`delivery.next_attempt_at` required	string, nullable	ISO-8601 UTC timestamp of the next scheduled attempt. Null once the event is settled — delivered, or out of attempts — so this single field tells you whether anything more is coming.
`delivery.delivered_at` required	string, nullable	ISO-8601 UTC timestamp of the successful delivery, or null.
`delivery.response_status_code` required	integer, nullable	HTTP status your endpoint returned on the most recent attempt, or null when the attempt did not get a reply at all (connection refused, timeout).
`data` required	object	The event body, byte-identical to the `data` object of the webhook delivery — including any `deprecated_fields`. Its shape depends on `type`; see the webhook event catalog.

JSON

{
  "id": "9f8b7a6c-5d4e-4f3a-8b2c-1d0e9f8a7b6c",
  "type": "CARD_TRANSACTION",
  "created_at": "2026-08-17T12:00:00.000Z",
  "delivery": {
    "status": "delivered",
    "attempts": 1,
    "max_attempts": 9,
    "last_attempt_at": "2026-08-17T12:00:01.000Z",
    "next_attempt_at": null,
    "delivered_at": "2026-08-17T12:00:01.000Z",
    "response_status_code": 200
  },
  "data": {
    "id": "3f1c2d4e-5a6b-4c7d-8e9f-0a1b2c3d4e5f",
    "transaction_id": "3f1c2d4e-5a6b-4c7d-8e9f-0a1b2c3d4e5f",
    "transaction_status": "SETTLED",
    "merchant": "EXAMPLE STORE",
    "amount": 24.5,
    "transaction_currency": "USD",
    "ledger_currency": "USD"
  }
}

400 Error

Validation failed (errors[] lists each offending field) or a domain rule rejected the request ({ message, code }).

The body is the standard error object: see Errors.

401 Error

Missing or invalid credentials, e.g. { "message": "Invalid API Key", "code": "UNAUTHORIZED" }.

The body is the standard error object: see Errors.

404 Error

No such event for this organization (WEBHOOK_EVENT_NOT_FOUND).

The body is the standard error object: see Errors.

500 Error

Unexpected server error. Body is { message: "Internal server error", code: "INTERNAL_SERVER_ERROR" }.

The body is the standard error object: see Errors.

Last updated September 4, 2026