Guides
Handle decisions
What to do with approve, review and deny, and how to fail safely.
Every response has one overall decision in overallRecommendation: the most cautious decision among the scenarios that applied to your data.
| Decision | Meaning | Typical action |
|---|---|---|
APPROVE | Nothing worrying | Continue as normal |
REVIEW | Some risk, not conclusive | Add a light extra step, or limit what is granted until verified |
DENY | Strong signs of abuse | Block, with a neutral message |
Good review steps#
Review is where most of the value is: you keep honest users and slow down abusers without a hard block.
- Ask for email or phone verification before granting free credits.
- Grant a smaller trial, or none, until the user upgrades.
- Queue the account for a quick manual look.
Explaining decisions#
Each scenario result lists rule reports with a status (PASSED, FLAGGED, SKIPPED or ERROR) and findings with a code and a human-readable message. Log them so your support team can answer "why was I blocked?". Don't show the details to the end user.
Fail open#
If isCredible is unreachable or times out, treat the request as approved and log the error. Abuse checks should never take down your signup flow. The SDK has a timeout (10 seconds by default) and retries rate-limit and server errors.
const iscredible = new IsCredibleClient({ apiKey, timeoutMs: 3000, maxRetries: 1 });