Browse the docs

List events

GET /v1/api-gateway/event

Lists the events generated for your organization, newest first, paginated with current_page / per_page. Filter by type, by delivery status, and by a start_date / end_date range. Each entry carries the same type and data the webhook delivery carries, plus its id, creation time and delivery state — so an event that never reached your endpoint can be read back and processed by the same handler. Events are recorded from the moment a webhook URL is registered; nothing is kept for an organization that has never registered one. Same contract as V2 GET /events.

Request

Authentication: your API key in the x-api-key header.

Query parameters

Field	Type	Description
`current_page`	integer	Page number, starting at `1`. Default `1`. Maximum `10000` — past that, narrow the range with `start_date` / `end_date` or a `type` filter rather than paging deeper.
`per_page`	integer	Events per page. Minimum `1`, maximum `100`. Default `10`. A larger value is rejected with a 400 — it is not silently reduced.
`type`	string	Only events of this type. Omit for every type.One of: `CARD_TRANSACTION`, `CARD_AUTHORIZATION_REFUND`, `CARD_DECLINE`, `MOON_CREDIT_FUNDS_CREDITED`, `KYC_UPDATE`, `THREE_DS_OTP`, `DEPOSIT_CREDITED`, `DEPOSIT_UNDER_REVIEW`, `DEPOSIT_ABANDONED`, `DEPOSIT_BELOW_MINIMUM`, `DEPOSIT_KYT_PENDING`, `DEPOSIT_KYT_FINAL`, `THREE_DS_AUTHENTICATION_RESULT`, `THREE_DS_OOB_CHALLENGE`, `VELOCITY_CONTROL_WATCHED`, `PURCHASE_INTENT_REQUESTED`, `PURCHASE_INTENT_APPROVED`, `PURCHASE_INTENT_DENIED`, `PURCHASE_INTENT_EXPIRED`, `PURCHASE_INTENT_CANCELLED`, `ASK_FIRST_DISABLE_REQUESTED`, `ASK_FIRST_DISABLED`, `ASK_FIRST_DISABLE_DENIED`, `ASK_FIRST_DISABLE_EXPIRED`, `ASK_FIRST_DISABLE_CANCELLED`, `AUTONOMY_GRANT_REQUESTED`, `AUTONOMY_GRANT_ACTIVATED`, `AUTONOMY_GRANT_DENIED`, `AUTONOMY_GRANT_REVOKED`, `AUTONOMY_GRANT_EXPIRED`, `AUTONOMY_GRANT_CANCELLED`, `CARD_WALLET_TOKEN_UPDATED`, `CARD_WALLET_TOKEN_OTP`, `CARD_RENEWED`
`status`	string	Only events in this delivery state. `pending` is still being attempted, `delivered` was accepted by your endpoint, `failed` ran out of attempts.One of: `pending`, `delivered`, `failed`
`start_date`	string	Inclusive start of the range, as a calendar day (`YYYY-MM-DD`, taken as UTC) or an ISO-8601 timestamp. A calendar day starts at `00:00:00Z`. A timestamp must carry an explicit offset (`2026-08-01T09:15:00Z` or `2026-08-01T09:15:00+00:00`) — without one the instant it names would depend on which server read it, so it is rejected.
`end_date`	string	Inclusive end of the range, as a calendar day (`YYYY-MM-DD`, taken as UTC) or an ISO-8601 timestamp with an explicit offset. A calendar day ends at `23:59:59Z`, so a single day given on both bounds returns that whole day.

Example request

cURL

curl --request GET \
     --url 'https://api.themooncard.com/v1/api-gateway/event' \
     --header 'x-api-key: YOUR_API_KEY'

Responses

200 Success

Field	Type	Description
`events` required	array of object
`events[].id` required	string	Event UUID. The same value the delivered payload carries as `webhook_event_id`, so it can be used to reconcile against what you already received.
`events[].type` required	string	Event type, identical to the delivered `type`.One of: `CARD_TRANSACTION`, `CARD_AUTHORIZATION_REFUND`, `CARD_DECLINE`, `MOON_CREDIT_FUNDS_CREDITED`, `KYC_UPDATE`, `THREE_DS_OTP`, `DEPOSIT_CREDITED`, `DEPOSIT_UNDER_REVIEW`, `DEPOSIT_ABANDONED`, `DEPOSIT_BELOW_MINIMUM`, `DEPOSIT_KYT_PENDING`, `DEPOSIT_KYT_FINAL`, `THREE_DS_AUTHENTICATION_RESULT`, `THREE_DS_OOB_CHALLENGE`, `VELOCITY_CONTROL_WATCHED`, `PURCHASE_INTENT_REQUESTED`, `PURCHASE_INTENT_APPROVED`, `PURCHASE_INTENT_DENIED`, `PURCHASE_INTENT_EXPIRED`, `PURCHASE_INTENT_CANCELLED`, `ASK_FIRST_DISABLE_REQUESTED`, `ASK_FIRST_DISABLED`, `ASK_FIRST_DISABLE_DENIED`, `ASK_FIRST_DISABLE_EXPIRED`, `ASK_FIRST_DISABLE_CANCELLED`, `AUTONOMY_GRANT_REQUESTED`, `AUTONOMY_GRANT_ACTIVATED`, `AUTONOMY_GRANT_DENIED`, `AUTONOMY_GRANT_REVOKED`, `AUTONOMY_GRANT_EXPIRED`, `AUTONOMY_GRANT_CANCELLED`, `CARD_WALLET_TOKEN_UPDATED`, `CARD_WALLET_TOKEN_OTP`, `CARD_RENEWED`
`events[].created_at` required	string	ISO-8601 UTC timestamp with milliseconds, e.g. "2026-08-17T12:00:00.000Z".
`events[].delivery` required	object
`events[].delivery.status` required	string	Delivery state. `pending` — attempts are still scheduled; `delivered` — your endpoint answered 2xx; `failed` — every attempt was used and none succeeded.One of: `pending`, `delivered`, `failed`
`events[].delivery.attempts` required	integer	Delivery attempts made so far.
`events[].delivery.max_attempts` required	integer	Total attempts an event gets before delivery is abandoned.
`events[].delivery.last_attempt_at` required	string, nullable	ISO-8601 UTC timestamp of the most recent attempt, or null if none was made yet.
`events[].delivery.next_attempt_at` required	string, nullable	ISO-8601 UTC timestamp of the next scheduled attempt. Null once the event is settled — delivered, or out of attempts — so this single field tells you whether anything more is coming.
`events[].delivery.delivered_at` required	string, nullable	ISO-8601 UTC timestamp of the successful delivery, or null.
`events[].delivery.response_status_code` required	integer, nullable	HTTP status your endpoint returned on the most recent attempt, or null when the attempt did not get a reply at all (connection refused, timeout).
`events[].data` required	object	The event body, byte-identical to the `data` object of the webhook delivery — including any `deprecated_fields`. Its shape depends on `type`; see the webhook event catalog.
`pagination` required	object
`pagination.total` required	integer	Total number of items across all pages.
`pagination.last_page` required	integer	Number of the last page (0 when there are no items).
`pagination.prev_page` required	integer, nullable	Previous page number, or null on the first page.
`pagination.next_page` required	integer, nullable	Next page number, or null on the last page.
`pagination.per_page` required	integer	Page size that was applied.
`pagination.current_page` required	integer	1-based current page.
`pagination.from` required	integer	1-based index of the first item on this page (0 when empty).
`pagination.to` required	integer	1-based index of the last item on this page (0 when empty).

JSON

{
  "events": [
    {
      "id": "9f8b7a6c-5d4e-4f3a-8b2c-1d0e9f8a7b6c",
      "type": "CARD_TRANSACTION",
      "created_at": "2026-08-17T12:00:00.000Z",
      "delivery": {
        "status": "delivered",
        "attempts": 1,
        "max_attempts": 9,
        "last_attempt_at": "2026-08-17T12:00:01.000Z",
        "next_attempt_at": null,
        "delivered_at": "2026-08-17T12:00:01.000Z",
        "response_status_code": 200
      },
      "data": {
        "id": "3f1c2d4e-5a6b-4c7d-8e9f-0a1b2c3d4e5f",
        "transaction_id": "3f1c2d4e-5a6b-4c7d-8e9f-0a1b2c3d4e5f",
        "transaction_status": "SETTLED",
        "merchant": "EXAMPLE STORE",
        "amount": 24.5,
        "transaction_currency": "USD",
        "ledger_currency": "USD"
      }
    }
  ],
  "pagination": {
    "total": 1,
    "last_page": 1,
    "prev_page": null,
    "next_page": null,
    "per_page": 10,
    "current_page": 1,
    "from": 1,
    "to": 1
  }
}

400 Error

Validation failed (errors[] lists each offending field) or a domain rule rejected the request ({ message, code }).

The body is the standard error object: see Errors.

401 Error

Missing or invalid credentials, e.g. { "message": "Invalid API Key", "code": "UNAUTHORIZED" }.

The body is the standard error object: see Errors.

500 Error

Unexpected server error. Body is { message: "Internal server error", code: "INTERNAL_SERVER_ERROR" }.

The body is the standard error object: see Errors.

Last updated September 4, 2026