Webhooks

The Disputes API ends at Create Dispute. Everything after that is Casap's work, and webhooks are how it reaches you: one event, dispute.updated, sent to the HTTPS endpoint you register every time a dispute changes. Each message carries the full state of the dispute and requiredActions, what you are expected to do for that dispute right now.

What Casap does

Investigates the claim, contacts the merchant, files with the card network or ACH operator where the rail allows, tracks every regulatory clock, decides, and closes the dispute. None of it needs a call from you.

What Casap asks of you

Four things, because they touch the cardholder's account and card, which stay with you:

• issue a provisional credit while the investigation runs,
• replace the card when the claim is unauthorized use,
• issue the final credit when the cardholder wins,
• reverse the provisional credit when they do not.

Each arrives as an entry in requiredActions with the amount, the transaction and the deadline. You do the work in your core and Casap sees it on the next message. Two more are optional: Casap collects documents and sends every cardholder communication itself, in your branding, and an organization that would rather use its own channels can ask for those as actions too.

The message

Every message has the same four top-level fields. Messages are signed; verify before you trust them.

{
  "type": "dispute.updated",
  "disputeUuid": "228d0a21-68d0-4ce5-8efd-c8deaf2912df",
  "occurredAt": "2026-09-28T19:21:55Z",
  "data": {
    "dispute": { },
    "statusMessage": "Your dispute is under review.",
    "timeline": [ ],
    "requiredActions": [ ]
  }
}

• type (string) - Always dispute.updated.
• disputeUuid (string) - The dispute this message is about.
• occurredAt (string) - RFC 3339 timestamp of the change.
• data.dispute (object) - Full dispute state after the change.
• data.statusMessage (string) - Cardholder-facing summary of the current state.
• data.timeline (array) - Cardholder-facing milestones for the dispute.
• data.requiredActions (array) - What you need to do. Absent when nothing is outstanding.