Possible values for status are: new, modify, cancel, message
The status modify could be sent for new or cancelled bookings if multiple fields are changed before the webhook sends, i.e. the first webhook you receive may have the status modified = modify instead of new and a cancelled booking may have a webhook with status = modify , do not use status = modify reported by a webhook to assume anything about the status of the booking.
The card CVV and a token to retrieve it from the JSON getCard API function can be included as form url encoded POST data in the body of the push.