---
title: "Merchant Decision"
method: POST
path: "/api/decision"
tags: ["Automation Endpoints"]
---

# Merchant Decision

`POST /api/decision`

Notify Riskified of the final external status of an order. Use this call to update Riskified when the merchant’s or payment gateway’s final decision differs from Riskified’s recommendation — for example, if the order was declined, canceled, or successfully captured after review. This ensures Riskified maintains full visibility into the complete order lifecycle and can continuously improve decision accuracy.

## Headers

- `x-riskified-shop-domain` string, required
- `x-riskified-hmac-sha256` string, required
- `content_type` 'application/json', required
- `accept` 'application/vnd.riskified.com; version=2', required

## Request body

- DecisionOrderWrapper
  - `order` DecisionOrder, required
    - `id` string, required — The unique identifier of the order the decision is on.
    - `gateway` string — Use if the final gateway was unknown during order submission. If the transaction was processed using 3D Secure (3DS), append `_3ds` to the gateway name, for example, `adyen_3ds`.
    - `decision` DecisionDetails, required
      - `external_status` 'approved' | 'declined' | 'cancelled' | 'declined_fraud' | 'declined_business', required
      - `decided_at` string, date-time — When the order was decided, ISO8601 format.
      - `reason` string — A reason for the decision.
      - `amount` number, float — The amount the decision is relevant on.
      - `currency` string — The three letter code (ISO 4217) for the currency used for the payment.
      - `notes` string — Free text for describing the decision.

## Response `200`

Successful operation

- DecisionResponse — Decision Response
  - `order` object
    - `id` string, required — Unique ID of order being acted upon. Note: This value should be later reflected also as order.id on the subsequent calls
    - `status` 'approved' | 'declined', required — Textual status describing the result of Riskified analysis.
    - `description` string, required — Additional context on Riskified decision.
    - `old_status` string, required — Old order status

## Other responses

- `400` — Bad request
- `401` — Unauthorized
- `404` — Not found
- `429` — Too many requests
- `500` — Contact Riskified support
- `504` — Temporary error, please retry

---

[API](https://skmtc.dev/riskified/apis/chargeback-guarantee.md) · [All operations](https://skmtc.dev/riskified/apis/chargeback-guarantee/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/riskified/chargeback-guarantee/revisions/2b7df5bce861/schema)