We’ve solved the issue now, thank you.
Our site is loaded with ajax, utilizing hashbang urls. We made use of the escaped_fragment url get parameter which is used by the twitter bot to determine the content for meta tags, but we did not used meta tags for the root url. The card is approved after changing that.
Also, we did not use og:url property in the first setup. Including that might have solved the issue as well.