document:read, or any ops scope that creates documents (cards:issue / cards:read / cards:topup / cards:freeze / withdraw / gift:purchase / esim:* / reconciliation:read).
Every create that uses ext_id can be polled:
Document types
Document
status moves from processing toward terminal values (done / failed / card_issued / … by type). Operation details live in response (for example card_id, business status, error).
How to check status
- Polling: call this endpoint until
statusis terminal (a few seconds between polls; respect rate limits). - Webhook: on terminal
ext_doc, IMBA sends*.status_changed(at-least-once; idempotent byevent_id). Keep polling as a fallback. - Secrets (PAN/CVV, LPA, gift code) are not required in webhooks or
document_get— use the product GET (/cards/{card_id},/esims/{esim_id},/gift-cards/{purchase_id}).
Stuck card_issue
A card_issue that remains processing with no card / charge progress is closed by IMBA as failed with error=issue_timeout (see Cards). You get a webhook and a terminal document. Funds were not charged. Retry with a new ext_id — the same ext_id replays the stored failed result. Documents are not deleted.
Use documents for in-flight work keyed by your ext_id (this is the order / reference lookup). There is no other universal transaction-search path. Card merchant authorizations are not listed here. Product secrets stay on the product GET endpoints (step 3 above).