Lifecycle Event Hooks

Learn how to setup and use Lifecycle Event Hooks to integrate your customer facing applications with any other homegrown systems or 3rd-party products that you may own, such as CRM or Marketing Hubs

Overview

Fusion's Lifecycle Event Hooks (LEH) provide a complete integration capability so that you can integrate your customer facing applications with any other homegrown systems or third-party products.

Lifecycle Event Hooks can be used in many different ways. Some of the more common use cases involve customizing registration, updating or fetching data from remote systems such as CRMs during certain lifecycle events, or alerting third-party systems on specific events of interest such as:

  • Deep customization of registration - Brands often require extensive customization of the registration process. Information from external systems, such as CRMs, may be required to keep multiple disparate databases in sync. Often a brand will pull this in during a pre-registration hook to allow it to be submitted during the Registration process. New or additional information can be easily synchronized back to an external system in real time.

  • Customer data synchronization - Brands may require keeping disparate customer databases in sync, such as the customer identity store and a remote CRM system. Customer Lifecycle Event Hooks can be used to dispatch information about events of interest to these remote systems.

  • Alerting - Brands may desire to be alerted when an event of interest occurs, such as a password reset request.

  • Consume and use threat information - Insert threat detection and mitigation into any point in the customer lifecycle, giving security teams highly contextual alerting when threats are detected. Existing threat information can be used to make risk analysis decisions.

An actual Lifecycle Event Hook is a brand provided snippet of javascript code that executes at predefined points in a customers lifecycle, such as registration, logon, consent opt in or out, or account deletion. A full listing of events and how they can be used is provided below. All snippet code executes within the context of the Fusion platform in a safe and secure sandboxed environment. Two modes are supported:

  • Synchronous - Control is transferred to the script for execution. Upon completion, control is returned to Fusions normal workflow execution.

  • Asynchronous - The script is executed but control is not transferred, and Fusion continues on with its normal workflow execution.

The brand decides and can configure, in the administration console, whether an event hook should execute synchronously or asynchronously.

Result Codes

The following codes can be returned from synchronous event hooks to Fusion to direct workflow appropriately.

Code

‚Äč

Description

0

Continue

Direct Fusion to continue workflow as normal.

1

Stop

Direct Fusion o stop workflow immediately. The current session will end and the account will be logged out.

2

Error

Inform Fusion that an error has occurred. This will stop the workflow and direct Fusion to display an error screen.

3

Redirect

Transfer control away from Fusion to a URL that is supplied via the callback from the event hook.

Supported Events

The following table shows a summary of the events that are supported by Fusion with examples of how they can be used:

Event Type

Purpose

Pre-ID Token Generation

Used to add additional claims to OIDC and OAUTH by fetching data from an external systems before the ID token is generated

Pre-Account Registration

Fetch data from an external system so it can be used and stored with a customers account during the account registration process

Post-Account Registration

Once a customer has successfully completed the account registration process this even is triggered to trigger an external event or fetch/update data with an external system

Post-Account Login

Trigger an external event of fetch data from an external system after the customer has successfully authenticated and they have an ID token

Post-Social Login

Trigger an external event or fetch data from an external system once a customer has successfully completed registration using a social login provider

Post-Account Activation

Used to trigger an external event once a customer has clicked the account activation link sent via Email during self-service registration

Post-Identification

This event is triggered once the customer has provided their identifier (email address or username) and before they are asked for any factor of authentication. This can be used to step-up or step-down the authentication journey based on an external event, risk data from an external system, or other account attribute information for that customer

Pre-Password Reset

This event is triggered after the customer has initiated the Forgot my Password process from the login screen, and before the customer completes the password reset workflow

Post-Password Reset

This event is triggered after the the customer has successfully reset their password. You can use this event to trigger an external event or write data to a 3rd party system

Post-Forgotten Username

This event is triggered after a customer has completed a Forgotten Username request using the forgot my username via the login screen.

Post-MFA Factor Change

Trigger an external event or fetch data from an external system once the customer has completed the verification of a new/additional MFA factor during enrollment or removed a factor.

Pre-MFA Method Dispatch

Trigger an external event or fetch data before the MFA transaction has reached the customer, e.g. before an SMS or Email is sent. You can use this to notify based on step-up authentication event occurring but not yet completing - a sign of suspicious account activity.

Post-MFA Method Dispatch

Once an MFA transaction has completed, i.e. verification was successful you can use this to trigger an external event or notification based on that step-up authentication event occurring and completing.

Post-Account Deletion

Once a customer account has been deleted you can use this to trigger an external event of notification or account deletion process in other systems.

Post-Account Disabled

Once a customer account has been disabled then you can use this to trigger an account disabled event of notification or account disable process in other systems.

Consent Opt-in/Opt-Out

This event is triggered after a customer opts into or opts our of any consents at registration or self-service. Use this event to synchronize consents with other third-party systems such as marketing hubs, email advertising platforms or CRMs.

Missing Mandatory Attribute or Consent Post-Authentication

This event is triggered post-authentication and can be used to request mandatory user attributes and/or consents that may not be populated. For consents, this hook can be used to request opt-in to new consents of subscriptions, or changes/updates to consents. For missing/enforcement of attributes - this can be used for progressive profiling purposes to request certain information from the customer during login.

How It Works

Click to Enlarge

Example Usage Scenarios

  • Customize registration by bringing in and persisting external data

  • Establish a single source of truth and synchronize customer data across multiple systems

  • Insert threat detection and response into any point in the customer lifecycle

  • Alert your customer service or security teams to events of interest

  • Trigger workflow in external orchestration systems when customers perform specific actions