---
title: SFCC Reference Architecture
slug: extensions/sfcc-reference-architecture
docTags: 
createdAt: 2026-09-22T18:20:22.602Z
---

The cartridge integrates via SFRA hooks and controller extensions. SFRA's base controllers and templates are never modified.

## The two cartridges

| Cartridge         | Role                                                                                                                                            |
| ----------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- |
| `int_forter_sfra` | Core storefront integration — hooks, controller extensions, DTOs, services, the device-fingerprint template, and the order-status sync job.     |
| `bm_forter`       | Business Manager extension — credential verification, order search by Forter decision, abuse-policy configuration, account-protection settings. |

## Hooks (`hooks.json`)

| Hook                       | Script                         | Purpose                                                                         |
| -------------------------- | ------------------------------ | ------------------------------------------------------------------------------- |
| `app.template.afterFooter` | `templateHooks.js`             | Device-fingerprint JS injection                                                 |
| `app.validate.order`       | `validateOrder.js`             | Pre-authorization fraud decision                                                |
| `app.post.auth`            | `postAuthorizationHandling.js` | Post-authorization fraud decision, plus pre-auth-decision mirror onto the order |
| `app.payment.saved`        | `paymentSavedHandling.js`      | Payment-save capture for PSP flows that bypass the standard save-payment route  |

## Beyond the hooks

- **Controller extensions** for account-protection events — `Account.js`, `Address.js`, `PaymentInstruments.js` — extend the base SFRA controllers.
- **DTOs** (`scripts/lib/forter/dto/`) — the cartridge sends a raw snapshot of the order/customer; Forter maps it to its canonical schema server-side.
- **Order-status sync job** (`ForterOrderUpdateSFRA`) — a scheduled job that reports lifecycle changes (shipped, cancelled, refunded) back to Forter asynchronously.