Responsible Gaming

The RGS provides a set of responsible-gaming (RG) controls that operators can configure per market: reality checks, session time limits, bet limits, and self-exclusion enforcement. All RG events are audited and available in reporting.

The RGS is the enforcement point, not the system of record for player limits. You own the player relationship and decide who is excluded and what limits apply per jurisdiction; the RGS enforces those decisions at launch and during play, and records an audit trail.

Per-Jurisdiction Configuration

Reality-check intervals and session time limits are configured per operator and per jurisdiction. The jurisdiction is the countryCode supplied at launch (ISO 3166-1 alpha-2, or an ISO 3166-2 region such as CA-ON).

Configuration is a map keyed by jurisdiction code, with a * entry as the default for any jurisdiction without an explicit entry:

{
  "responsibleGaming": {
    "GB": { "realityCheckMinutes": 60, "realityCheckEnforced": true, "sessionLimitMinutes": 180, "maxBetUsd": "50" },
    "MT": { "realityCheckMinutes": 60, "realityCheckEnforced": true, "sessionLimitMinutes": 0 },
    "*":  { "realityCheckMinutes": 30, "sessionLimitMinutes": 0 }
  }
}

Resolution is: exact jurisdiction match → * default → disabled. A jurisdiction with no entry and no * default has all RG controls disabled.

Self-Exclusion

To refuse launches for a self-excluded player, return excluded: true from your /callback/authenticate response. The RGS then rejects POST /operator/launch with HTTP 403 and error code player_self_excluded, and records a self_exclusion_blocked audit event. No session is created.

{
  "requestId": "unique-request-id",
  "status": "OK",
  "balance": "100.00",
  "excluded": true,
  "excludedUntil": "2026-12-31"
}

Bet Limits

Bet limits cap the worst-case payout (exposure) of a bet. They are enforced on every POST /game/play and come from three sources, applied so each only ever tightens the limit:

• Operator exposure limits — the maxExposure map on your operator config sets a per-game (and per-side-bet) cap in USD. Configured via onboarding or backoffice.
• Per-session overrides — an optional betLimits object on POST /operator/launch narrows the limits for a single session.
• Per-jurisdiction cap — maxBetUsd in the responsible-gaming config caps the worst-case payout for a market. When it is the most restrictive of the three, it is the binding limit and rejections are audited with limitSource: "jurisdiction".

{
  "playerId": "player-1",
  "currency": "USD",
  "gameCode": "dice-alpha",
  "countryCode": "GB",
  "betLimits": { "minBet": "1", "maxWin": "200" }
}

Session overrides must satisfy 0 <= minBet <= maxWin <= operator maxExposure for the game, otherwise the launch is rejected with invalid_bet_limits. Limits are stored in USD and converted to the session currency before enforcement. A bet whose worst-case payout exceeds the limit is rejected with bet_limit_exceeded and recorded as a bet_limit_rejected audit event; a bet below the session minimum is rejected with bet_below_min.

Reality Checks & Session State

The game client reads the current RG state from POST /game/current, which includes a responsibleGaming block. This lets the client render the reality-check prompt (session duration and net win/loss) and any session-time warning.

{
  "balance": "98.50",
  "active": false,
  "responsibleGaming": {
    "realityCheckIntervalMinutes": 60,
    "realityCheckDue": true,
    "realityCheckEnforced": true,
    "sessionLimitMinutes": 180,
    "sessionElapsedSeconds": 3720,
    "sessionTimeRemainingSeconds": 7080,
    "netWager": "120.00",
    "netPayout": "95.00",
    "netWinLoss": "-25.00"
  }
}

The play session is a continuous unit of play. It survives session-token refresh, so reality-check intervals, the session limit, and net win/loss are measured across the whole play session rather than resetting on each token rotation.

Acknowledging a Reality Check

When the player acknowledges the reality-check prompt, the client calls POST /session/acknowledge-reality-check. This resets the interval (the next reality check is measured from the acknowledgement), records a reality_check_acknowledged audit event, and returns a refreshed responsibleGaming snapshot.

Advisory vs enforced. By default a due reality check is advisory: the RGS surfaces realityCheckDue and the client is responsible for showing the prompt and suspending play. When realityCheckEnforced is set for the jurisdiction, the RGS enforces it: starting a new round is refused with HTTP 409 and error code reality_check_required until the player acknowledges (an in-progress round may still finish). The session is not terminated — play resumes immediately after acknowledgement. Choose enforced mode for markets whose regulators require the reality check to suspend play (e.g. MGA).

Session Time Limits

When a play session reaches its configured sessionLimitMinutes, the session is terminated gracefully:

• An in-progress round (e.g. an open Blackjack or Mines round) may still be played to completion so its state is saved.
• Starting a new round is refused with HTTP 409 and error code session_limit_reached, and the session is terminated. A session_limit_reached audit event is recorded.

The player must launch a new session to continue playing.

sequenceDiagram
    participant Client as Game Client (iframe)
    participant RGS as RGS API
    participant Op as Your Server

    Client->>RGS: POST /game/current
    RGS-->>Client: responsibleGaming { realityCheckDue: true, ... }
    Note over Client: Show reality check (duration + net win/loss)
    Client->>RGS: POST /session/acknowledge-reality-check
    RGS-->>Client: refreshed responsibleGaming { realityCheckDue: false }

    Note over Client,RGS: ...time passes, session limit reached...
    Client->>RGS: POST /game/play (new round)
    RGS-->>Client: 409 session_limit_reached
    Note over RGS: Session terminated, audit event recorded

Audit & Reporting

Every RG action is recorded as an append-only audit event, available via the backoffice reporting endpoint GET /backoffice/operators/{operatorId}/rg-events (filterable by playerId, type, and date range, cursor-paginated).

Error Codes

Next Steps