Accounts shared
after signup
Send usage events to spot account pools, network spread and fast credit burn.
Decision trace
ExampleUsage abuse
- Input signalsA verified account uses 90 of its 100-credit quota within its first day.
- Reason ids
fast_burn - DecisionThe usage response flags the account; it does not stop the request.
- What to doReview usage or cap access in your backend.
How it works
Send usage
Post accountId with units, and optional IP, user agent and quota.
Find the pattern
Hourly buckets expose shared networks, browser spread and early credit burn.
Carry it forward
Linked device keys add linked_usage_abuse on later verifies.
API
Example request and response. Keep the secret on your backend.
POST https://nolgard.com/v1/usage
Content-Type: application/json
{
"secret": "SITE_SECRET",
"events": [{
"accountId": "user_123",
"units": 90,
"quota": 100
}]
}
// Example: account verified less than a day ago
{
"accepted": 1,
"flagged": [{ "accountId": "user_123",
"reasons": ["fast_burn"] }]
}Limits
account_networks: more than 10 network prefixes on one account in a UTC hour.account_pool: more than five accounts share a prefix in that hour.ua_spread: more than five user-agent families across the queried day buckets.fast_burn: at least 90% of quota during the first 24 hours of a known account.- Fast burn needs a quota and a prior verified account using the same account id. Network and browser detectors need the matching optional fields.
- Maximum 500 events per batch; 120 requests per minute per site. Hourly usage is retained for 30 days.
- These are flags; no API request is blocked automatically. Your application decides what to do.