The External Decision module calls a configured external endpoint and exposes the returned decision value for routing Conditions. Use this module to incorporate signals you own, such as account status, risk, or eligibility, into identity verification. This is commonly used in cases where identity alone is not enough to determine what happens next.
Integrations
:white_check_mark: Web | :white_check_mark: iOS | :white_check_mark: Android
This module is not exposed as a standalone SDK module and has no end-user-facing UI.
How It Works
External Decision is a process node: when the Workflow engine reaches it, the Incode backend calls the configured endpoint synchronously, receives a single decision string in response, and routes the Workflow based on that value using standard business rules. Nothing is shown to the end user.
On each execution, Incode sends a fixed payload with the session context (sessionId, identityId, flowId, and timestamp). The client endpoint returns a single string representing its decision; the value is client-defined, and Incode does not interpret or constrain it. An optional reason field is supported for observability and does not affect routing.
The node can be placed anywhere in the Workflow. Place it after an authentication module only when the decision depends on identityId; otherwise it runs using sessionId, flowId, and timestamp alone.
Failure handling
The Incode backend waits up to 30 seconds for a response from the client endpoint. If the endpoint does not respond within that window, is unavailable, returns an error, returns an invalid format, or returns a string that matches no configured condition, the decision value is set to the reserved value INCODE_UNRESOLVED. This value is available in Conditions like any other, so you decide how to handle it (terminate the session, proceed, or trigger a step-up).
The 30-second timeout is fixed and cannot be adjusted. Endpoints that may take longer than 30 seconds to respond are not compatible with the External Decision module.
Authentication
Incode authenticates to the client endpoint using OAuth 2.0 (client credentials). The client stands up a standard OAuth token endpoint and issues Incode a Client ID and Secret. On each execution, Incode requests an access token from the client's authorization URL using the client-credentials grant, then calls the client endpoint with that token.
Use External Decision
For instructions on configuring the External Decision module in Dashboard, see: