Decionis Checkout Gate
Decionis Checkout Gate is a lightweight, API-first policy bridge for WooCommerce. It evaluates checkout economics immediately before order execution and blocks an order only when the Decionis service returns an explicit BLOCK decision.
The plugin supports classic shortcode checkout and Cart and Checkout Blocks. It uses WooCommerce CRUD APIs for decision metadata and declares compatibility with High-Performance Order Storage (HPOS).
Key behavior
- Sends the active cart to Decionis with a strict 120 millisecond request timeout.
- Blocks only an explicit, valid
BLOCKresponse. - Fails open on timeouts, network failures, non-success HTTP responses, invalid JSON, and unknown decisions.
- Includes native WooCommerce cost-of-goods data when available.
- Does not send customer names, email addresses, billing addresses, or shipping addresses.
- Stores non-secret decision, dossier, rule, bypass, and latency metadata on the WooCommerce order.
Zero-config connection
Select Connect Decionis on the settings screen and approve WooCommerce’s native authorization request. Decionis provisions an isolated organization, workspace, and least-privilege runtime key automatically — there is nothing to copy or paste, and new connections start in shadow mode. Stores that are not publicly reachable over HTTPS can paste an API key manually instead. With no connection and no API key, checkout proceeds normally.
External services
This plugin connects to the Decionis service (https://api.decionis.com) in two situations.
Checkout evaluation (/v1/intercept): when a customer submits WooCommerce checkout and the store is connected, the service receives product and variation IDs, SKU, quantity, price, line totals, available cost of goods, cart totals, discounts, shipping and tax totals, currency, applied coupon codes, a cart hash, WordPress/WooCommerce/plugin versions, guest status, and WordPress role slugs. It does not receive customer names, email addresses, billing addresses, shipping addresses, or payment credentials. This data is used to evaluate the merchant’s configured transaction and margin policies and to produce decision evidence.
Connection setup (/v1/woo/install/start and /v1/woo/install/status): when an administrator selects Connect Decionis, the service receives the store URL and store name to register an expiring install, and the plugin later exchanges one-time install tokens for the provisioned organization id and runtime key. During the native WooCommerce authorization the administrator approves, WooCommerce itself delivers the generated read/write REST API credentials to https://api.decionis.com/v1/woo/auth/callback; Decionis verifies them, provisions an isolated organization and workspace, stores the credentials encrypted, and registers order and product webhooks. Disconnecting from the Decionis workspace removes the registered webhooks and sealed credentials.
Service provider: Decionis Inc.
- Privacy policy: https://decionis.com/privacy
- Terms of service: https://decionis.com/terms