Skip to main content

APIs and Hooks

AJAX Endpoints​

All endpoints use admin-ajax.php and require nonce:

  • nonce action: suma_security_checkout_otp
  • parameter: security

suma_security_send_checkout_verification_code​

Actions:

  • wp_ajax_suma_security_send_checkout_verification_code
  • wp_ajax_nopriv_suma_security_send_checkout_verification_code

Purpose:

  • send OTP code to billing email

suma_security_verify_checkout_verification_code​

Actions:

  • wp_ajax_suma_security_verify_checkout_verification_code
  • wp_ajax_nopriv_suma_security_verify_checkout_verification_code

Purpose:

  • verify 6-digit OTP and unlock checkout state

suma_security_get_checkout_verification_state​

Actions:

  • wp_ajax_suma_security_get_checkout_verification_state
  • wp_ajax_nopriv_suma_security_get_checkout_verification_state

Purpose:

  • return requires_verification boolean for frontend polling

WooCommerce and WP Hooks Used​

Checkout Gate Hooks​

  • woocommerce_checkout_process
  • cfw_before_process_checkout
  • woocommerce_after_checkout_validation
  • woocommerce_before_checkout_form
  • init (request hard-block for locked checkout POSTs)

Failed Payment Hooks​

  • woocommerce_order_status_changed
  • woocommerce_order_status_failed
  • woocommerce_payment_failed
  • woocommerce_suma_test_gateway_payment_declined

Order and Checkout Hooks​

  • woocommerce_checkout_order_created (persist fingerprint/email meta)
  • woocommerce_checkout_order_processed (IP correction)

Frontend Script Hooks​

  • wp_enqueue_scripts (fingerprint script)
  • wp_footer (OTP script enqueue/localization)

Admin Hooks​

  • admin_init (register settings)
  • admin_menu (settings + tools pages)

Logger Sources​

WooCommerce logger channels:

  • checkout-session-rate-limit
  • checkout-verification