Data sources you can use
You watch an application reach the decision flow and see the same problem again. A customer with a long history is being treated like a stranger because the rule cannot see the record held by core banking. That team says the record is already available through an API on the gateway. The provider offers another useful signal, device intelligence, but its key is still tucked into your team password manager. Your integration ticket sits in the platform backlog with a question about which fields the rules will read. The information is nearby, yet the decision has very little of it.
What counts as a data source
A data source is a call to a REST API or SOAP web service on the public internet. You define the call as a data source, and the whole decision reads its answer, whether the endpoint belongs to a provider or to a service your company runs.
| Method | When you use it |
|---|---|
| GET | A simple lookup, parameters in the URL |
| POST | Larger requests, as form fields, JSON or a raw body template |
| PUT | Telling another system about a decision result |
| SOAP | An older web service with a WSDL and a method name |
You can set parameters to fixed values or map them from the data object. Selecting “Flow” exposes the parameter on the decision flow step for mapping. A placeholder in the URL takes the value of a parameter with the same name. You can also send headers with the request, including authorization keys.
A POST can send form fields, JSON, or a raw body template. In a raw body template, you write the format the API expects and use placeholders for values that come from parameters. The API can return JSON or XML. The engine converts an XML response into a JSON structure and adds it to the data object.
You set a timeout for each source. The maximum is 15 seconds. If the API does not reply in time, the flow carries on and your rules read the failed call like any other value.
Where the answer goes
The engine writes the full response into the data object under $.output, then the step name, then the data source name. A rule, a decision table, a scorecard or a function reads any returned field by its path.
In a demo case, a source named ip_check sits in a step named checks and answers with an AbuseIPDB response, so a rule reads $.output.checks.ip_check.abuseConfidenceScore.
The engine also records details about the call beside the response. These include __http_code, __attempts and __cached. If the call fails, the output includes __error and __error_details.
How the call authenticates
Choose the authentication method the endpoint expects. The data source screen offers “HTTP Authentication” for a username and password, and “OAuth2 Authentication” for a token endpoint, client ID, and secret. OAuth2 supports the client credentials grant or the password grant, with optional scope, audience, or realm.
The engine caches the OAuth2 token and requests another when needed. If the API rejects a token with a 401 response, the engine discards it and requests a replacement once during that call. An API key can go in a header or a parameter.
A key, token or password field takes a credential from the vault, and the configuration keeps a reference such as secret:openai_main. The value itself is in no export and no release.
Your own services
Your decision flow can call a company service in the same way it calls a provider. These are the kinds of call a lender or insurer makes from a decision, as examples:
- The core system's customer record: existing products, arrears and months on book, so a ten-year customer stops looking like a stranger.
- A balance or exposure service, for the current balances across products that cap a new limit.
- The pricing or product service that holds the rate grid or the product catalogue, so the grid lives in one place.
- The CRM or case system, for whether an application, a complaint or a fraud case is already open for this person.
- Your own document or KYC service, for whether identity documents were verified and when.
- A PUT back to another system with the decision result.
Decisimo calls addresses on the public internet, so give the service an address through your API gateway and secure it with a key or OAuth2. Loopback, private ranges 10/8, 172.16/12 and 192.168/16, and link-local addresses are refused before the call. A refused address comes back with __error_details.type set to ssrf_blocked. Redirects are not followed, so configure the final URL directly.
Older core systems often speak SOAP. You configure the WSDL URL and the method name, then map nested parameters by path. The SOAP version comes from the WSDL binding, and the response is converted to JSON like a REST response.
Several calls, failure and retries
A single step can contain several data sources. The engine calls them together, and the step waits for the slowest response. So the cheap checks go in one step, and the applicant waits only for the slowest of them.
A timeout, connection failure, blocked endpoint, or HTTP error does not stop the whole decision flow. The output records an error and its reason, then the flow carries on. A rule can route the application to a fallback branch or a manual queue. The rules for that fallback are the subject of a decision strategy that keeps working when a provider fails.
Use “Retry this call if it fails” only when a second call is safe to charge and record. For a source marked for retry, the engine makes a second attempt after a connection failure or an HTTP 408, 425, 429, 502, 503, or 504 response. It waits between 200 milliseconds and 2 seconds, retries only while the step's time allows, and __attempts records the count.
You can also cache a source's response per decision step in a Data cache destination in a PostgreSQL database you own. The default cache duration is 30 days. The match can use the request or a set of parameters you choose. Credentials do not form part of the match, and errors are not stored. __cached says whether a stored answer served the step.
Let the assistant write the definition
The “AI Assistant” button on the data source screen opens a chat where you describe the API and the assistant proposes the configuration. The proposal appears beside the current settings for you to review. “Apply Configuration” fills the form, and Save stores the data source.
If the API needs a key, a “Credential needed” box lets you choose an existing credential or add one to the vault. The chat carries the credential's name. The flow assistant can also add a data source task as you build the decision flow.
Choose “Run test” to call the source and see its response.
Providers people connect
A Fingerprint response carries a visitor ID and whether the device looks like a bot. MaxMind minFraud returns a risk score and whether the email is disposable. Trestle returns whether an email is valid and what kind of line a phone number is.
For email checks, Have I Been Pwned returns the breaches an address appears in, with their dates and data classes, and Email Hippo assesses the address itself. For IP and device checks, AbuseIPDB returns an abuse confidence score from 0 to 100, and the guides for macaddress.io and WhatIsMyBrowser connect two more device checks the same way.
Other guides cover BINLIST for cards, Companies House for company information, and Google Places for geography and address data. All of them sit on the integrations page, grouped by what they check.
Beside data sources, a flow can call an LLM model, with a prompt template filled from the decision and an optional output format, or your own trained model as a flow step. Your own block, allow and watch lists stay in your database, and the flow checks them as it runs.
Frequently asked questions
Can Decisimo call a service on our private network?
Give the service an address through your API gateway so it is reachable on the public internet. Private network addresses are refused before the call.
What happens when a provider is slow?
You set the timeout, up to 15 seconds. If the provider does not respond in time, the flow carries on with an error and its reason, and your rules determine what happens next.
Who holds the provider contract?
You hold the contract and key with the provider. Decisimo does not supply the provider data.
Can one step call two providers?
The sources are called together, and the step waits for the slowest of them.
