# Approve or reject card payments

Receive purchase authorisation events and choose if to approve or decline them by replying to the event.
Switch on Authorisation Forwarding in your Sandbox Innovator Portal and configure the Authorisation Forwarding URL to start receiving these events. Weavr will send webhook events on the following URL {Authorisation Forwarding URL}/managed_cards_authorisation_forwarding.
A response is expected in 1.5s, after which the Default Timeout Response configured in the card profile or the card `authForwardingDefaultTimeoutDecision` parameter will be used.

Endpoint: POST /managed_cards/authorisation_request
Version: v3
Security: webhooks_key

## Security:

  - `webhooks_key` (unknown)
    apiKey in header webhooks-key

## Header parameters:

  - `call-ref` (string)
    A call reference generated by the caller and unique to the caller to provide correlation between the caller and system with a maximum length of 255

  - `published-timestamp` (integer, required)
    The timestamp, expressed in Epoch timestamp using millisecond precision, when this event was published.

  - `signature` (string, required)
    The signature to verify the authenticity of this request.  This is the base64 hash (HmacSHA256) of the `published-timestamp` using your API key.

  - `signature-v2` (string, required)
    The signature to verify the authenticity of this request.  This is the base64 hash (HmacSHA256) of the `call-ref + payload + published-timestamp` using your API key.

## Request fields (application/json):

  - `cardId` (string, required)
    The unique identifier of the card on which an authorisation is being performed

  - `transactionId` (string, required)
    The id of this transaction, for reference.

  - `authorisationType` (string, required)
    Enum: "AUTHORISED", "AUTHORISED_CREDIT"

  - `sourceAmount` (object, required)
    The object representing a monetary amount in a particular currency.

  - `sourceAmount.currency` (string, required)
    The currency expressed in ISO-4217 code. Example: GBP, EUR, USD.

  - `sourceAmount.amount` (integer, required)
    The monetary amount, scaled to the lowest denomination of the currency.

Example, an amount of 1000 for a EUR currency is actually 1000 Euro cents or EUR 10.00.

  - `transactionTimestamp` (integer, required)
    The timestamp of the transaction, using epoch timestamp with millisecond precision.

  - `merchantData` (object, required)

  - `merchantData.merchantName` (string, required)
    The name of the merchant where the authorisation has been made.

  - `merchantData.merchantCategoryCode` (string, required)
    The merchant category code.

  - `merchantData.merchantId` (string, required)
    The merchant ID.

  - `merchantData.merchantDescription` (string)
    The merchant description

  - `merchantData.merchantStreet` (string)
    The merchant street address (if available)

  - `merchantData.merchantCity` (string)
    The merchant city (if available)

  - `merchantData.merchantState` (string)
    The merchant state address (if available)

  - `merchantData.merchantPostalCode` (string)
    The merchant postal code (if available)

  - `merchantData.merchantCountry` (string)
    The merchant country address

  - `merchantData.merchantTelephone` (string)
    The merchant telephone number

  - `merchantData.merchantURL` (string)
    The merchant URL

  - `merchantData.merchantNameOther` (string)
    The alternative merchant name

  - `merchantData.merchantNetworkId` (string)
    The merchant's network id

  - `merchantData.merchantContact` (string)
    The merchant's contact (if available)

  - `owner` (object, required)

  - `owner.type` (string, required)
    Indicates the identity type.
    Enum: "CONSUMER", "CORPORATE"

  - `owner.id` (string, required)
    The identifier for the identity.

  - `cardholderPresent` (string)
    Enum: "PRESENT", "NOT_PRESENT", "PRESENCE_UNKNOWN"

  - `cardPresent` (boolean)
    Optional detail indicating if the card was present when the authorisation occurred.

  - `authCode` (string)
    The authorisation code associated with this authorisation.

  - `mode` (string)
    The card can be created in prepaid mode or debit mode.
- A prepaid mode card has its own balance and can have funds transferred to or from it.
- A debit mode card does not have its own balance but will be able to spend funds belonging to its parent managed account, subject to a configurable spend limit.
    Enum: "PREPAID_MODE", "DEBIT_MODE"

  - `transactionType` (string)
    Enum: "SALE_PURCHASE", "MAIL_OR_TELEPHONE_ORDER", "CASH_WITHDRAWAL", "ORIGINAL_CREDIT_TRANSACTION", "ACCOUNT_FUNDING_TRANSACTION", "CASH_DISBURSEMENT", "PURCHASE_REFUND", "BALANCE_INQUIRY", "PIN_CHANGE", "PIN_UNBLOCK"

  - `parentManagedAccountId` (string, required)
    Id of the managed account holding funds which the managed card can access, up to a configurable spend limit.

  - `availableToSpend` (array)
    The amount of funds from the parent managed account that are available to be spent through the card, in a given time interval, *before* this transaction is performed.

  - `availableToSpend.interval` (string)
    The time period for which the `spendLimit` is valid.
- DAILY: starting from 00:00:00 UTC of current day to 23:59:59 UTC of current day
- WEEKLY: 00:00:00 UTC Monday of current week to following Sunday 23:59:59 UTC
- MONTHLY: 1st of current calendar month to end of current calendar month
- QUARTERLY: starting from beginning of current quarter where quarters are defined as follows:
- 1 January 00:00:00 UTC to 31 March 23:59:59 UTC
- 1 April 00:00:00 UTC to 30 Jun 23:59:59 UTC
- 1 July 00:00:00 UTC to 30 September 23:59:59 UTC
- 1 October 00:00:00 UTC to 31 December 23:59:59 UTC
- YEARLY: 1 January 00:00:00 UTC of current calendar year to 31 December 23:59:59 UTC of current calendar year.
- ALWAYS: This indicates that the `spendLimit` is the total amount that can be spent through the card throughout the whole lifetime of the card.
    Enum: "DAILY", "WEEKLY", "MONTHLY", "QUARTERLY", "YEARLY", "ALWAYS"

## Response 200:

  - `200` (unknown)
    Authorisation event received with `APPROVED` or `DECLINED` decision.

## Response 200 fields (application/json):

  - `result` (string)
    Enum: "APPROVED", "DENIED"

## Response 404:

  - `404` (unknown)
    Not found - The requested resource couldn't be found.

## Response 404 fields (application/json):

  - `code` (string)

  - `message` (string)

## Response 404 headers (application/json):

  - `request-ref` (string, required)
    A request identifier. Providing this reference when contacting our support team will help us investigate your query.

## Response default:

  - `default` (unknown)
    Error

## Response default fields (application/json):

  - `code` (string)

  - `message` (string)