20 "plugin-specific subscription routes (e.g. Mailchimp/MailPoet list-membership tables) -- not yet mapped by this repo"
21 ],
22 "confidence": "medium"
23 },
24 {
25 "sourceSystem": "woocommerce",
26 "sourceEntity": "order.meta_data",
27 "routes": [
28 "/wc/v3/orders -- meta_data entries with a checkout-consent-checkbox key, value '1'"
29 ],
30 "confidence": "high",
31 "note": "LIVE-VERIFIED 2026-09-16: a source store's marketing-consent checkout checkbox is recorded as ORDER meta, not on the customer object, and the key is present only when checked -- absence means not consented (or not asked), never an explicit '0'. Applies identically to registered-customer and guest-checkout orders, so scan orders, not customers, and match back to a customer_id when present."
49 "decision": "The MECHANICAL write is live-verified: keyed by EMAIL ADDRESS, not contactId, so it covers guest-checkout consent with no Contact behind it just as well as a known contact; a live batch of both known-customer and guest emails landed with subscriptionStatus SUBSCRIBED on query-back; the write only sets a status and does not itself send any confirmation/marketing email, so it is safe to run even while the site's notifications are muted. importSafe is true (no notification is sent). Cleared for import: every order for an email ticked writes SUBSCRIBED; no order ticked writes nothing; mixed ticked and unticked orders keep that email pending for the operator at cutover."
50 },
51 "fallbacks": [
52 {
53 "classification": "cms",
54 "when": "Use for consent evidence and source subscription audit history."
55 }
56 ],
57 "reliability": {
58 "status": "reliable",
59 "flags": []
60 },
61 "pitfalls": [
62 {
63 "code": "consent-proof-required",
64 "severity": "blocker",
65 "summary": "Only set subscribed states when the migration has consent evidence. A real per-order checkout-consent-checkbox flag (see the woocommerce order.meta_data sourceAlias above) is sufficient evidence; do not infer consent from mere presence as a customer or from having placed an order with no consent flag."
66 },
67 {
68 "code": "bulk-endpoint-caps-at-100-per-call",
69 "severity": "warning",
70 "summary": "bulkUpsertEmailSubscriptions accepts 1-100 subscriptions per call and returns per-item results with `metadata.totalSuccess`/`totalFailure` -- batch upstream past 100 and check each item's `error` field rather than trusting an overall 200."
75 "summary": "A per-ORDER consent signal (see the woocommerce order.meta_data sourceAlias above) is not the same shape as a per-subscriber consent field: one buyer can place several orders, agreeing on one and staying silent on later ones. The key is present only when ticked, so an absent key means 'not consented or not asked', never a decline. No fold rule is decided. Per email: every order ticked writes SUBSCRIBED; no order ticked writes nothing; ticked and unticked mixed must not be resolved by an invented rule: keep that email's subscription pending with its order evidence (record held, not sent) so the operator decides it at cutover."
80 "summary": "A separate, newer Wix Marketing Consent API models a proof-of-consent trail (state CONFIRMED/PENDING/REVOKED, optInLevel single-vs-double-confirmation, lastConfirmationActivity source+timestamp) rather than this entity's bare subscribed/unsubscribed flag. An identity-team comment says a sign-up form's consent checkbox is copied onto the Contact, which is what email marketing reads, favoring Email Subscriptions; that has not been confirmed against both APIs' full schemas. The import writes Email Subscriptions (this entity's live-verified writer); the comparison stays open."
81 }
82 ],
83 "mappingGuidance": [
84 "Dedupe by lowercased email BEFORE writing: the same address can appear as both a known customer's email and a guest order's billing email across different orders. Prefer the known-customer identity when both exist for the same address.",
85 "Keep consent evidence and source timestamps available for review."
86 ],
87 "setupRequirements": [
88 "Consent evidence available per email before writing a subscribed state (consent-proof-required)."
99 "note": "confirmed endpoint, batch cap and per-item result shape, 2026-09-16"
100 },
101 {
102 "type": "live-verification",
103 "path": "anonymized-live-verification",
104 "note": "the full set of a store's checkout-consent-flagged orders (registered customers and guests) written via bulkUpsertEmailSubscriptions and confirmed by queryEmailSubscriptions read-back, zero failures"