Triggers Reference
5 min read
Triggers are the events that wake an automation rule. This page lists every trigger the engine supports, what context each one provides, and example use cases. Rules have exactly one trigger; conditions and actions then determine whether and how the rule responds.
Customer Lifecycle Triggers #
Customer Score Changed #
Fires when a trust score recalculation produces a different score than before.
- Event ID:
score_changed - Context: customer hash, old score, new score, signals
- Use case: Alert when a Trusted customer drops to Caution
Segment Changed #
Fires only when the score crosses a segment boundary.
- Event ID:
segment_changed - Context: customer hash, old segment, new segment, current score
- Use case: Block customer automatically on transition to Critical
Customer Allowlisted / De-allowlisted #
Fires when an admin toggles the allowlist flag.
- Event IDs:
allowlisted,de_allowlisted - Context: customer hash, admin user, timestamp
- Use case: Sync to CRM when a customer is allowlisted as VIP
Customer Blocked / Unblocked #
Fires when block state changes.
- Event IDs:
blocked,unblocked - Context: customer hash, admin user, reason
- Use case: Webhook to internal system when a customer is blocked
Order Lifecycle Triggers #
Order Placed #
Fires on every new WooCommerce order.
- Event ID:
order_placed - Context: order ID, customer hash, total, items, billing/shipping
- Use case: Hold orders from Risk/Critical customers automatically
Order Status Changed #
Fires on any order status transition.
- Event ID:
order_status_changed - Context: order ID, customer hash, old status, new status
- Use case: Notify when held order moves to processing
Order Refunded #
Fires when a refund is created on an order.
- Event ID:
order_refunded - Context: order ID, refund amount, full or partial, customer hash
- Use case: Alert when a high-value refund pushes return rate over threshold
Order Cancelled #
Fires when an order is cancelled (admin or customer-initiated).
- Event ID:
order_cancelled - Context: order ID, customer hash, who cancelled
- Use case: Tag customers with high cancellation rates
Detection Module Triggers #
Chargeback Filed #
Fires when a new dispute is recorded (auto-ingested or manually entered).
- Event ID:
chargeback_filed - Context: dispute ID, customer hash, brand, amount, reason
- Use case: Auto-block customers on first chargeback if score is low
Dispute Status Changed #
Fires when an existing dispute transitions (open → won/lost).
- Event ID:
dispute_status_changed - Context: dispute ID, customer hash, old status, new status
- Use case: Alert when a dispute is lost, escalate enforcement
Linked Accounts Detected #
Fires when the Linked Accounts module records a new link between customer records.
- Event ID:
linked_accounts_detected - Context: primary customer hash, linked customer hashes, fingerprint types
- Use case: Slack alert when a customer is linked to a Critical-segment account
Card Testing Attack Detected #
Fires when velocity rules trip a fingerprint lockout.
- Event ID:
card_testing_attack - Context: fingerprint hash, decline count, decline codes
- Use case: Send Slack alert; tag any associated customer email for review
Auto-Escalated (Pro) #
Fires when Card-Testing auto-escalation triggers Panic Freeze.
- Event ID:
auto_escalated - Context: contributing fingerprints, geographic distribution, threshold values
- Use case: Page on-call engineer; create incident in PagerDuty
Panic Freeze Activated #
Fires when Panic Freeze is manually or automatically activated.
- Event ID:
panic_freeze_activated - Context: trigger source (manual / auto), admin user (if manual), expected end time
- Use case: Wide notification (Slack, SMS, email) to ops team
Shipping Anomaly Detected #
Fires when the Shipping Anomalies module fires a signal.
- Event ID:
shipping_anomaly - Context: customer hash, anomaly type (address_hopping / country_mismatch / velocity), severity
- Use case: Hold orders shipping internationally on a country mismatch + low trust score
Coupon Triggers #
Coupon Applied #
Fires when any coupon is applied at checkout.
- Event ID:
coupon_applied - Context: coupon code, customer hash, order context
- Use case: Reject high-value coupon if customer is Risk-segment
Coupon Abuse Detected #
Fires when the Coupons module records a new abuse signal (first-order coupon repeat, coupon-then-refund, etc.).
- Event ID:
coupon_abuse - Context: customer hash, abuse type, associated orders
- Use case: Disable the abused coupon for new customers
Chargeback Ratio Triggers #
Chargeback Ratio Threshold Crossed #
Fires when the blended or per-brand monthly ratio crosses the warn threshold.
- Event ID:
chargeback_ratio_threshold_crossed - Context: brand (or “blended”), current ratio, threshold, dispute count
- Use case: Auto-enable aggressive auto-block-after-N-lost-disputes setting
Trigger Context Variables #
Every trigger provides a context object that conditions and actions can reference. Common variables:
| Variable | Available In |
|---|---|
customer.email_hash |
Most triggers |
customer.score |
Most triggers |
customer.segment |
Most triggers |
customer.total_orders |
Most triggers |
customer.total_disputes |
Most triggers |
order.id, order.total, etc. |
Order triggers |
dispute.brand, dispute.amount |
Dispute triggers |
fingerprint.hash |
Card-testing triggers |
See Conditions Reference for the full variable list per trigger.
Picking the Right Trigger #
Choose the most specific trigger that fits. If you want to act on chargebacks, use chargeback_filed — not customer_score_changed filtered by “score dropped.” The specific trigger is faster, clearer, and less brittle.
Use generic triggers (like score_changed) for cross-cutting workflows where the cause matters less than the effect.
Trigger Combinations #
Rules have one trigger. To respond to multiple triggers with the same actions, create multiple rules pointing to the same outcome. The save-time validator will warn if rules collide unproductively, but the engine doesn’t prevent multiple rules firing on overlapping events.
Common pattern: a “block customer” effect achieved by three rules with triggers segment_changed (to Critical), chargeback_filed (with conditions), and linked_accounts_detected (with conditions on linked account quality). Same actions; different entry points.
