> ## Documentation Index
> Fetch the complete documentation index at: https://docs.wede.pt/llms.txt
> Use this file to discover all available pages before exploring further.

# Offline policy

> Your own limits for operations your devices accept without network

## What it is

When the network is down, a device cannot ask your systems whether to accept an operation. The offline policy is how your organisation answers that question in advance: your own limits, which every device keeps and applies on its own, with no network.

wede never sets a limit. You write the rules, wede carries them to your devices and checks afterwards that every device followed them.

There is no limit of time without network. A device keeps working with the policy it has for as long as the network is down, whether that is a few minutes or several weeks. A policy never expires; it is only replaced by a newer version.

Without a policy, nothing changes: devices accept every operation without network, as before.

## The rules

One rule per operation type and currency:

| Field | Required | What it limits |
| - | - | - |
| `operation_type` | Yes | An operation type of your [catalog](https://docs.wede.pt/concepts/execution.md) |
| `currency` | Yes | ISO 4217 code, for example `EUR` |
| `max_amount_minor` | Yes | The amount of one operation, in minor units of the currency (cents for EUR) |
| `cumulative.max_amount_minor` | No | The total amount one device accepts for this type and currency since its last sync |
| `cumulative.max_count` | No | How many operations one device accepts for this type and currency since its last sync |

An example: payments up to 50.00 EUR each, and at most 200.00 EUR or 10 payments per device until it syncs again.

```json theme={null}
[
  {
    "operation_type": "payment_offline",
    "currency": "EUR",
    "max_amount_minor": 5000,
    "cumulative": { "max_amount_minor": 20000, "max_count": 10 }
  }
]
```

An operation without a rule for its type and currency, or without an amount, goes ahead. The amount is read from the payload exactly as wede reads it everywhere else: `amount_minor`, or `amount` in the decimals of its currency, with `currency`.

The cumulative of a device starts again from zero once everything it captured has reached wede.

## On the device

From version 2.9.0, the wede SDKs fetch the policy in use after every sync with network and keep it on the device. Each operation captured without network is decided on the device before it is kept:

* **allowed**: the operation is queued and syncs as usual, with the decision and the version of the policy it was decided under;
* **refused**: nothing is queued, and your app receives `WedePolicyDeclined` with the rule that refused it (`max_amount`, `cumulative_amount` or `cumulative_count`), so it can tell the user.

A device installed and used for the first time with no network has never received the policy. Your organisation chooses what it does then, with the SDK option `whenNoPolicy` (`when_no_policy` in Python): `allow` (default) lets operations go ahead, as before; `decline` refuses every operation with an amount and a currency until the policy arrives. See [SDKs](https://docs.wede.pt/sdks/overview.md#your-limits-without-network).

## What wede checks

When the operations reach wede, wede checks every decision against the same rules. An operation that does not match is marked, never refused: it is kept like any other, and you decide what to do with it.

| Reason | What wede found |
| - | - |
| `over_max_amount` | Allowed on the device, but above the maximum per operation |
| `over_cumulative_amount` | Allowed, but above the cumulative amount |
| `over_cumulative_count` | Allowed, but above the cumulative number |
| `declined_but_sent` | Refused on the device, and sent anyway |
| `unknown_version` | A version of the policy that does not exist in your organisation |
| `policy_altered` | The policy on the device is not the one wede sent |
| `cumulative_missing` | A rule with a cumulative, and the device did not send what it had accepted |
| `cumulative_chain` | What a device declared it had accepted does not add up across its operations |
| `decision_invalid` | The decision cannot be read |

Operations captured by an SDK earlier than 2.9.0 carry no decision and are not checked.

In the dashboard, **Offline policy** shows the decisions that did not match, in production or in the sandbox, with a count for each reason. With the API, use [`GET /v1/policies/decisions`](https://docs.wede.pt/api-reference/policies#decisions).

## Versions

A version never changes once saved. A new version takes the next number; one version is in use at a time, and devices receive it at their next sync. Archiving the version in use turns the policy off, and devices stop applying limits once they sync. Nothing is deleted, and every change is recorded in the audit log.

Each version has a `sha256`, computed on its document in canonical JSON (object keys sorted at every level, no spaces), the same way as the seal of the [proof kit](https://docs.wede.pt/concepts/proof-kit.md#the-seal). The SDKs keep a policy only when its `sha256` matches.

## Who can use it

The policy belongs to your organisation. Administrators and technical staff write it, choose the version in use and read the decisions, in the dashboard or with an API key. Devices read the version in use with the credential they sync with.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.