When a real person
gets blocked
Owners keep sites in observe because a falsely blocked human has nowhere to go. Appeals give that person one way out and you one place to resolve it.
How it works
Offer the appeal
On a block, challenge or limit, your page calls
await Nolgard.appeal({ ref })with theev_…reference from verify. A modal shows the reference, runs the step-up check for that event and takes an optional message of up to 500 characters.One appeal per event
The call returns
submittedorduplicate, and rejects if the user cancels. Unknown, foreign, allowed and shadowed events get one indistinguishable answer; shadowed users are never told.Resolve it
The dashboard → Appeals lists open and resolved reviews. Approve applies the same legit label as feedback; reject applies fraud.
appeal.openedandappeal.resolvedwebhooks tell your backend when to restore access or credits.
API
POST /v1/appeal
{"siteKey":"pk_…","ref":"ev_…","stepUpToken":"…","message":"I was setting up my own account."}
{"status":"submitted"}The browser SDK posts this for you. The call must come from one of the site's allowed origins and is limited to 20 appeals an hour per IP. Appeal messages are deleted after 30 days and resolved appeals after 90 days.
Limits
- Appeals are interactive only. They need a browser and the reference your application displayed.
- Allowed and shadowed events are never appealable, and the answer is the same as for an unknown reference.
- A passed step-up is evidence; it does not prove identity. An appeal without one is still reviewable.
- One appeal per event; a second call returns
duplicaterather than opening a new review. - Review is manual. Nothing is restored until an owner resolves the appeal and your backend acts on the webhook.
- The rate limit is per IP, so users behind one NAT share it.