API Reference

The RetentionPlay /v1 HTTP API as described by the canonical OpenAPI document (backend/crates/api/openapi/playflow-v1.openapi.json).

Interactive Swagger UI

The running API also serves a live, "try it out" Swagger UI at /docs (for example http://api.localhost/docs locally), backed by the same spec at /docs/openapi.json.

v1.0.0

RetentionPlay API

Download OpenAPI Document

JSON

Download OpenAPI Document

YAML

RetentionPlay embed gamification / retention API: widget, progression, rewards, admin.

• Anonymous free-play — one loader script plus project_id; no customer secret in the browser.
• Session token — issued by POST /v1/server/session-token with a session:issue server API key, then sent as Authorization: Bearer for play/events.
• Preview — no-write previews use GET /v1/admin/widget-preview and require an authenticated project owner with verified 2FA.
• Admin JWT — from POST /v1/admin/auth/login for /v1/admin/*.
• Server API key — X-PlayFlow-Server-Key or Bearer for /v1/server/events, /v1/server/session-token and /v1/economy/grant.

Servers

http://localhost:8080Local API

---

health

Health & status

Operations

GET/v1/healthGET/v1/readyGET/v1/status

---

Liveness check

GET

/v1/health

Responses

OK

GET

/v1/health

Playground

Samples

---

Readiness (Postgres + Dragonfly)

GET

/v1/ready

Responses

Ready

GET

/v1/ready

Playground

Samples

---

Public status page data

GET

/v1/status

Responses

Status JSON

GET

/v1/status

Playground

Samples

---

play

Player progression & events

Operations

GET/v1/demo/tokenPOST/v1/server/session-tokenPOST/v1/eventsPOST/v1/server/eventsPOST/v1/server/business-eventsGET/v1/progress/statePOST/v1/game-runsGET/v1/game-runs/{run_id}POST/v1/game-runs/{run_id}/commandsGET/v1/project-game-assets/{project_id}/{asset_id}GET/v1/lobbyGET/v1/game-runs/{run_id}/rewardPOST/v1/client-telemetry

---

Dev helper: signed session token for proj_demo (disabled when ENABLE_DEMO_ENDPOINTS=0)

GET

/v1/demo/token

Responses

session_token

GET

/v1/demo/token

Playground

Samples

---

Issue verified player session token (API key scope session:issue)

POST

/v1/server/session-token

Authorizations

ServerBearer

Server API key scoped to the project; preferred over compatibility headers

Type

HTTP (bearer)

or

ServerApiKey

Legacy header; Authorization Bearer or X-RetentionPlay-Server-Key also accepted

Type

API Key (header: X-PlayFlow-Server-Key)

Request Body

application/json

{

  

"project_id": "string",

  

"external_user_id": "string",

  

"ttl_seconds": 3600

}

Responses

session_token, expires_at, subject_type=verified

POST

/v1/server/session-token

Playground

Authorization

ServerBearer

Body

Samples

---

Ingest widget event

POST

/v1/events

Authorizations

SessionBearer

Platform-issued identified or anonymous player session token

Type

HTTP (bearer)

Request Body

application/json

{

  

"type": "streak.ui_ack",

  

"payload": {

  

},

  

"session_id": "string"

}

Responses

Accepted

POST

/v1/events

Playground

Authorization

SessionBearer

Body

Samples

---

Server-confirmed gameplay event (e.g. streak.server_confirm)

POST

/v1/server/events

Authorizations

ServerApiKey

Legacy header; Authorization Bearer or X-RetentionPlay-Server-Key also accepted

Type

API Key (header: X-PlayFlow-Server-Key)

Request Body

application/json

{

  

"type": "streak.ui_ack",

  

"payload": {

  

},

  

"session_id": "string"

}

Responses

Accepted

POST

/v1/server/events

Playground

Authorization

ServerApiKey

Body

Samples

---

Analytics-only business events (product_click, favorite, merchant_click, purchase)

POST

/v1/server/business-events

Authorizations

ServerApiKey

Legacy header; Authorization Bearer or X-RetentionPlay-Server-Key also accepted

Type

API Key (header: X-PlayFlow-Server-Key)

Parameters

Header Parameters

Idempotency-Key*

Type

string

Required

Request Body

application/json

{

  

"project_id": "string",

  

"external_user_id": "string",

  

"type": "string",

  

"payload": {

  

}

}

Responses

Accepted (idempotent)

POST

/v1/server/business-events

Playground

Authorization

ServerApiKey

Headers

Idempotency-Key*

Body

Samples

---

Current progression state

GET

/v1/progress/state

Authorizations

SessionBearer

Platform-issued identified or anonymous player session token

Type

HTTP (bearer)

Parameters

Query Parameters

session_token

Legacy fallback; use Authorization to avoid token URLs

Type

string

Responses

Progress JSON

GET

/v1/progress/state

Playground

Authorization

SessionBearer

Variables

Key

Value

session_token

Samples

---

Start or resume a game run

POST

/v1/game-runs

Механика и уровень выбираются сервером; Origin должен совпадать с origin API. Повтор создавшего партию start_id разбирается до лимитов. intent=next возвращает активную партию с resumed=true. HTTP body ≤2097152байт. Ошибки JSON/Content-Type/UUID в теле: безопасный JSON validation_error с request_id (400/415/422), превышение HTTP-предела —413.

Authorizations

SessionBearer

Platform-issued identified or anonymous player session token

Type

HTTP (bearer)

Request Body

application/json

{

  

"start_id": "string",

  

"replace_active": false,

  

"intent": "next",

  

"level_number": 0,

  

"expected_mechanic": "match3_v1",

  

"supported_game_versions": [

  

  

[

  

  

  

1

  

  

]

  

]

}

Responses

Партия начата, возвращена активная или найдена по повтору start_id

Content-Type

application/json

{

  

"run_id": "string",

  

"game_id": "match3_v1",

  

"mechanic": "match3_v1",

  

"game_version": 1,

  

"level": {

  

  

"id": "level-001",

  

  

"version": 1,

  

  

"number": 0,

  

  

"best_score": 0,

  

  

"cycle_round": 0

  

},

  

"status": "string",

  

"sequence": 0,

  

"is_replay": true,

  

"end_reason": "string",

  

"expires_at": "string",

  

"resumable": true,

  

"started_at": "string",

  

"server_time": "string",

  

"view": {

  

  

"additionalProperties": "string"

  

},

  

"resumed": true

}

POST

/v1/game-runs

Playground

Authorization

SessionBearer

Body

Samples

---

Fetch the current game run state

GET

/v1/game-runs/{run_id}

Чтение по механике партии, в том числе после смены механики проекта. Активная просроченная партия закрывается abandoned/expired; чтение может изменить её состояние. Origin не проверяется. Лимит 60/мин на игрока.

Authorizations

SessionBearer

Platform-issued identified or anonymous player session token

Type

HTTP (bearer)

Parameters

Path Parameters

run_id*

Type

string

Required

Format

"uuid"

Responses

Актуальное состояние

Content-Type

application/json

{

  

"run_id": "string",

  

"game_id": "match3_v1",

  

"mechanic": "match3_v1",

  

"game_version": 1,

  

"level": {

  

  

"id": "level-001",

  

  

"version": 1,

  

  

"number": 0,

  

  

"best_score": 0,

  

  

"cycle_round": 0

  

},

  

"status": "string",

  

"sequence": 0,

  

"is_replay": true,

  

"end_reason": "string",

  

"expires_at": "string",

  

"resumable": true,

  

"started_at": "string",

  

"server_time": "string",

  

"view": {

  

  

"additionalProperties": "string"

  

}

}

GET

/v1/game-runs/{run_id}

Playground

Authorization

SessionBearer

Variables

Key

Value

run_id*

Samples

---

Apply one game command

POST

/v1/game-runs/{run_id}/commands

Origin должен совпадать с origin API. Механика берётся из партии. Match3 payload ≤512 байт под общим потолком конверта 8192 байт. Игровой отказ — HTTP 200 accepted=false. progression есть у завершающего хода уровня. Просроченная партия закрывается abandoned/expired, новая команда получает 409 run_not_active. HTTP body ≤2097152байт; сохранённый конверт command_id/sequence/action/payload ≤8192байт по Postgres jsonb::text проверяется до FraudGate. Ошибки JSON/Content-Type возвращают безопасный JSON с request_id, ошибки path UUID остаются текстовыми.

Authorizations

SessionBearer

Platform-issued identified or anonymous player session token

Type

HTTP (bearer)

Parameters

Header Parameters

X-RetentionPlay-Client-Version

Диагностическая версия клиента; не входит в payload/fingerprint и не влияет на результат. Произвольные значения не журналируются.

Type

string

Pattern

"^(r[0-9a-f]{12}|legacy-v1)$"

Path Parameters

run_id*

Type

string

Required

Format

"uuid"

Request Body

application/json

{

  

"command_id": "string",

  

"sequence": 0,

  

"action": "swap",

  

"payload": {

  

  

"additionalProperties": "string"

  

}

}

Responses

Команда обработана

Content-Type

application/json

{

  

"run_id": "string",

  

"sequence": 0,

  

"accepted": true,

  

"rejection_code": "string",

  

"status": "string",

  

"view": {

  

  

"additionalProperties": "string"

  

},

  

"animation_steps": [

  

  

{

  

  

  

"additionalProperties": "string"

  

  

}

  

],

  

"facts": [

  

  

{

  

  

  

"additionalProperties": "string"

  

  

}

  

],

  

"progression": {

  

  

"level_number": 1,

  

  

"first_completion": true,

  

  

"is_replay": true,

  

  

"next_level_number": 2,

  

  

"levels_total": 3,

  

  

"track_complete": true,

  

  

"cycle_round": 0,

  

  

"best_score": 0,

  

  

"new_best": true

  

}

}

POST

/v1/game-runs/{run_id}/commands

Playground

Authorization

SessionBearer

Headers

X-RetentionPlay-Client-Version

Variables

Key

Value

run_id*

Body

Samples

---

Serve an uploaded project background

GET

/v1/project-game-assets/{project_id}/{asset_id}

Файл отдаётся с домена сервиса по идентификатору, выведенному из содержимого, поэтому кэшируется как неизменяемый.

Parameters

Path Parameters

project_id*

Type

string

Required

asset_id*

Type

string

Required

Responses

Изображение

Content-Type

GET

/v1/project-game-assets/{project_id}/{asset_id}

Playground

Variables

Key

Value

project_id*

asset_id*

Samples

---

Lobby state for the current player

GET

/v1/lobby

Состояние лобби одним запросом: режим показа, механика «Играть», следующий уровень, незавершённая партия и итог последней партии. Прогресс и награды не меняет; при превышении лимита сохраняется fraud flag rate_exceeded. Origin не проверяется. Лимит — 60 запросов в минуту на игрока.

Authorizations

SessionBearer

Platform-issued identified or anonymous player session token

Type

HTTP (bearer)

Responses

Состояние лобби

Content-Type

application/json

{

  

"schema": 1,

  

"config_revision": 0,

  

"entry_mode": "string",

  

"server_time": "string",

  

"viewport": {

  

  

"width": 420,

  

  

"height": 760

  

},

  

"theme": {

  

  

"accent": "#d79a3c"

  

},

  

"assets": {

  

  

"lobby_background": {

  

  

  

"url": "/v1/project-game-assets/proj_demo/3f2a9c",

  

  

  

"width": 840,

  

  

  

"height": 1520

  

  

}

  

},

  

"play": {

  

  

"mechanic": "match3_v1",

  

  

"title": "string",

  

  

"available": true,

  

  

"unavailable_reason": "string",

  

  

"next_level": {

  

  

  

"number": 1,

  

  

  

"id": "level-001",

  

  

  

"cycle_round": 0,

  

  

  

"preview": {

  

  

  

  

"additionalProperties": "string"

  

  

  

}

  

  

},

  

  

"levels_total": 3,

  

  

"track_complete": true,

  

  

"active_run": {

  

  

  

"run_id": "string",

  

  

  

"level_number": 0,

  

  

  

"sequence": 0,

  

  

  

"started_at": "string",

  

  

  

"resumable": true

  

  

}

  

},

  

"last_result": {

  

  

"run_id": "string",

  

  

"mechanic": "match3_v1",

  

  

"status": "string",

  

  

"level_number": 0,

  

  

"reward": {

  

  

  

"status": "string"

  

  

}

  

},

  

"wheel": {

  

  

"enabled": true,

  

  

"wheel_id": "string",

  

  

"version": 0,

  

  

"entitlement": {

  

  

  

"additionalProperties": "string"

  

  

},

  

  

"pending": {

  

  

  

"additionalProperties": "string"

  

  

}

  

}

}

GET

/v1/lobby

Playground

Authorization

SessionBearer

Samples

---

Player-facing reward status of a run

GET

/v1/game-runs/{run_id}/reward

Статус награды за партию для показа игроку. Только владелец партии; работает и после смены механики проекта. Причины, счёт риска и срок удержания не раскрываются. Несколько заявок одной партии сводятся в один статус по приоритету pending > checking > delayed > confirmed > unavailable. Для free_play и партий без заявки — none. Прогресс и заявки не меняет; при превышении лимита сохраняется fraud flag rate_exceeded. Лимит — 30 запросов в минуту.

Authorizations

SessionBearer

Platform-issued identified or anonymous player session token

Type

HTTP (bearer)

Parameters

Path Parameters

run_id*

Type

string

Required

Format

"uuid"

Responses

Статус

Content-Type

application/json

{

  

"status": "string",

  

"label_key": "reward.status.pending",

  

"updated_at": "string"

}

GET

/v1/game-runs/{run_id}/reward

Playground

Authorization

SessionBearer

Variables

Key

Value

run_id*

Samples

---

Обезличенная диагностика транспорта клиента

POST

/v1/client-telemetry

До256 байт, неизвестные поля запрещены. Origin API и действующий токен игрока. Максимум3 сообщения/мин на сессию и300 на проект. Журнал содержит только enum/status/build_version; без token/IP/player/game payload. Клиент отправляет выборку5% и не ждёт отправки. Legacy передаёт только диагностический header версии команды.

Authorizations

SessionBearer

Platform-issued identified or anonymous player session token

Type

HTTP (bearer)

Request Body

application/json

{

  

"build_version": "string",

  

"kind": "string",

  

"status": 0

}

Responses

Принято

POST

/v1/client-telemetry

Playground

Authorization

SessionBearer

Body

Samples

---

widget

Widget loader & config

Operations

POST/v1/widget/sessionGET/v1/widget.jsGET/v1/widget/configGET/v1/widget/exposureGET/v1/playGET/v1/templates/{template_id}/bundle.jsGET/v1/games/{game_id}/entry.jsGET/v1/game-assets/{game_id}/{version}/{file}

---

Issue origin-bound anonymous free_play session token

POST

/v1/widget/session

Request Body

application/json

{

  

"project_id": "string",

  

"anonymous_id": "string"

}

Responses

session_token, external_user_id, expires_at, subject_type=anonymous

POST

/v1/widget/session

Playground

Body

Samples

---

Widget loader script

GET

/v1/widget.js

Parameters

Header Parameters

If-None-Match

Type

string

Responses

JavaScript; no-cache, max-age=0, must-revalidate

GET

/v1/widget.js

Playground

Headers

If-None-Match

Samples

---

Widget config (preview or play)

GET

/v1/widget/config

Parameters

Query Parameters

project_id*

Type

string

Required

session_token

Type

string

Responses

Config JSON

GET

/v1/widget/config

Playground

Variables

Key

Value

project_id*

session_token

Samples

---

A/B exposure bucket

GET

/v1/widget/exposure

Parameters

Query Parameters

project_id*

Type

string

Required

external_user_id

Type

string

session_token

Type

string

Responses

show_widget, cohort

GET

/v1/widget/exposure

Playground

Variables

Key

Value

project_id*

external_user_id

session_token

Samples

---

Play shell HTML (iframe)

GET

/v1/play

Токен сессии в адресе не передаётся: окно получает его рукопожатием postMessage (retentionplay:ready -> retentionplay:bootstrap). Параметр mode обязателен.

Parameters

Query Parameters

project_id*

Type

string

Required

mode*

Настоящая партия. Публичный preview запрещён (403); предпросмотр владельца — /v1/admin/widget-preview.

Type

string

Required

Valid values

"play"

template_id

Type

string

Responses

HTML

GET

/v1/play

Playground

Variables

Key

Value

project_id*

mode*

template_id

Samples

---

Template UI bundle

GET

/v1/templates/{template_id}/bundle.js

Parameters

Path Parameters

template_id*

Type

string

Required

Responses

JavaScript bundle

GET

/v1/templates/{template_id}/bundle.js

Playground

Variables

Key

Value

template_id*

Samples

---

Точка входа клиента игры

GET

/v1/games/{game_id}/entry.js

Обычный скрипт, который подключает текущий собранный модуль клиента. Отдаётся без кеша, потому что имя собранного файла меняется со сборкой.

Parameters

Path Parameters

game_id*

Type

string

Required

Example"match3_v1"

Responses

JavaScript

GET

/v1/games/{game_id}/entry.js

Playground

Variables

Key

Value

game_id*

Samples

---

Собранный файл клиента игры

GET

/v1/game-assets/{game_id}/{version}/{file}

Имя файла содержит хэш содержимого, поэтому ответ кешируется на год (public, max-age=31536000, immutable). Выпуск shell/ отдаётся с заранее сжатыми br/gzip по Accept-Encoding, Vary: Accept-Encoding. Прямой запрос .br/.gz — 404. Старая сборка сжимается gzip на лету.

Parameters

Path Parameters

game_id*

Type

string

Required

Example"match3_v1"

version*

Версия старой сборки (1) или id выпуска оболочки (r + 12 hex) при game_id = shell.

Type

string

Required

Example"r0123456789ab"

Pattern

"^[A-Za-z0-9_-]{1,64}$"

file*

Путь внутри сборки. Выход за её пределы запрещён.

Type

string

Required

Responses

Файл сборки

GET

/v1/game-assets/{game_id}/{version}/{file}

Playground

Variables

Key

Value

game_id*

version*

file*

Samples

---

economy

In-game resources

Operations

GET/v1/economy/balancesPOST/v1/economy/spendPOST/v1/economy/grant

---

Resource balances for session user

GET

/v1/economy/balances

Authorizations

SessionBearer

Platform-issued identified or anonymous player session token

Type

HTTP (bearer)

Responses

Balances

GET

/v1/economy/balances

Playground

Authorization

SessionBearer

Samples

---

Spend resource (booster)

POST

/v1/economy/spend

Authorizations

SessionBearer

Platform-issued identified or anonymous player session token

Type

HTTP (bearer)

Request Body

application/json

{

  

"booster_id": "string",

  

"idempotency_key": "string"

}

Responses

effect_token

POST

/v1/economy/spend

Playground

Authorization

SessionBearer

Body

Samples

---

Grant resource (server API key)

POST

/v1/economy/grant

Authorizations

ServerApiKey

Legacy header; Authorization Bearer or X-RetentionPlay-Server-Key also accepted

Type

API Key (header: X-PlayFlow-Server-Key)

Request Body

application/json

{

  

"project_id": "string",

  

"external_user_id": "string",

  

"resource_id": "string",

  

"amount": 0,

  

"idempotency_key": "string"

}

Responses

New balance

POST

/v1/economy/grant

Playground

Authorization

ServerApiKey

Body

Samples

---

admin-auth

Admin authentication

Operations

POST/v1/admin/auth/signupPOST/v1/admin/auth/loginGET/v1/admin/meGET/v1/admin/auth/sessionsDELETE/v1/admin/auth/sessions/{session_id}POST/v1/admin/auth/password

---

Register admin account

POST

/v1/admin/auth/signup

Request Body

application/json

{

  

"email": "string",

  

"password": "string"

}

Responses

Account ID and HttpOnly session cookie backed by Postgres registry; token is not returned in JSON

Content-Type

application/json

{

  

"token": "string",

  

"account_id": "string"

}

POST

/v1/admin/auth/signup

Playground

Body

Samples

---

Admin login

POST

/v1/admin/auth/login

Request Body

application/json

{

  

"email": "string",

  

"password": "string"

}

Responses

JWT

Content-Type

application/json

{

  

"token": "string",

  

"account_id": "string"

}

POST

/v1/admin/auth/login

Playground

Body

Samples

---

Current admin profile

GET

/v1/admin/me

Authorizations

AdminBearer

Admin JWT from signup/login

Type

HTTP (bearer)

Responses

account_id, email

GET

/v1/admin/me

Playground

Authorization

AdminBearer

Samples

---

List own active admin sessions

GET

/v1/admin/auth/sessions

Requires verified 2FA. Only own unrevoked unexpired sessions. UUID ascending pagination; refresh from the beginning to see newly created sessions. No tokens, hashes or IP addresses.

Authorizations

AdminCookie

HttpOnly сессия админки. Изменяющие запросы с cookie требуют допустимый Origin; Bearer — альтернатива.

Type

API Key (cookie: playflow_admin_session)

or

AdminBearer

Admin JWT from signup/login

Type

HTTP (bearer)

Parameters

Query Parameters

limit

Type

integer

Minimum

1

Maximum

50

Default

20

cursor

Type

string

Format

"uuid"

Responses

Active sessions page

Content-Type

application/json

{

  

"sessions": [

  

  

{

  

  

  

"id": "string",

  

  

  

"created_at": "string",

  

  

  

"expires_at": "string",

  

  

  

"current": true

  

  

}

  

],

  

"next_cursor": "string"

}

GET

/v1/admin/auth/sessions

Playground

Authorization

AdminCookie

Variables

Key

Value

limit

cursor

Samples

---

Revoke own active admin session

DELETE

/v1/admin/auth/sessions/{session_id}

Requires verified 2FA and allowed Origin for cookie callers. Revocation and safe audit commit atomically. Revoking current session clears cookies; next request requires login.

Authorizations

AdminCookie

HttpOnly сессия админки. Изменяющие запросы с cookie требуют допустимый Origin; Bearer — альтернатива.

Type

API Key (cookie: playflow_admin_session)

or

AdminBearer

Admin JWT from signup/login

Type

HTTP (bearer)

Parameters

Path Parameters

session_id*

Type

string

Required

Format

"uuid"

Responses

Revoked

Content-Type

application/json

{

  

"revoked": true,

  

"current": true

}

DELETE

/v1/admin/auth/sessions/{session_id}

Playground

Authorization

AdminCookie

Variables

Key

Value

session_id*

Samples

---

Change password and revoke every admin session

POST

/v1/admin/auth/password

Requires active registry session, verified 2FA and current password. Updates password and revokes all sessions in one transaction. Cookie paths are cleared; login again. Cookie callers require allowed Origin.

Authorizations

AdminCookie

HttpOnly сессия админки. Изменяющие запросы с cookie требуют допустимый Origin; Bearer — альтернатива.

Type

API Key (cookie: playflow_admin_session)

or

AdminBearer

Admin JWT from signup/login

Type

HTTP (bearer)

Request Body

application/json

{

  

"current_password": "string",

  

"new_password": "string"

}

Responses

Password updated; all sessions revoked

Content-Type

application/json

{

  

"status": "string",

  

"reauthenticate": true

}

POST

/v1/admin/auth/password

Playground

Authorization

AdminCookie

Body

Samples

---

admin-projects

Projects & API keys

Operations

GET/v1/admin/widget-previewGET/v1/admin/templatesGET/v1/admin/projectsPOST/v1/admin/projectsGET/v1/admin/projects/{project_id}PATCH/v1/admin/projects/{project_id}GET/v1/admin/projects/{project_id}/api-keysPOST/v1/admin/projects/{project_id}/api-keysDELETE/v1/admin/projects/{project_id}/api-keys/{key_id}GET/v1/admin/projects/{project_id}/embedGET/v1/admin/projects/{project_id}/level-goals

---

Предпросмотр игры владельцем проекта

GET

/v1/admin/widget-preview

Требует действующую admin-сессию, подтверждённый второй фактор и владение проектом. Браузер отправляет cookie на /v1/admin; токены в URL запрещены. CSP дополнительно разрешает ADMIN_ORIGIN только для preview. Не создаёт игровые прохождения, прогресс или награды.

Authorizations

AdminCookie

HttpOnly сессия админки. Изменяющие запросы с cookie требуют допустимый Origin; Bearer — альтернатива.

Type

API Key (cookie: playflow_admin_session)

or

AdminBearer

Admin JWT from signup/login

Type

HTTP (bearer)

Parameters

Query Parameters

project_id*

Type

string

Required

mode*

Обязательный режим preview.

Type

string

Required

Valid values

"preview"

template_id

Type

string

primary_color

Preview-only branding override

Type

string

Example"#6c5ce7"

Responses

HTML предпросмотра с HTTP CSP

GET

/v1/admin/widget-preview

Playground

Authorization

AdminCookie

Variables

Key

Value

project_id*

mode*

template_id

primary_color

Samples

---

Game template catalog with stats

GET

/v1/admin/templates

Authorizations

AdminBearer

Admin JWT from signup/login

Type

HTTP (bearer)

Responses

templates[]: engine, selectable, player_title, client_status (ready|disabled|not_built|unsupported_version), allowed_modes, прежние поля/статистика

GET

/v1/admin/templates

Playground

Authorization

AdminBearer

Samples

---

List projects for account

GET

/v1/admin/projects

Authorizations

AdminBearer

Admin JWT from signup/login

Type

HTTP (bearer)

Responses

projects[]

GET

/v1/admin/projects

Playground

Authorization

AdminBearer

Samples

---

Create project

POST

/v1/admin/projects

Authorizations

AdminBearer

Admin JWT from signup/login

Type

HTTP (bearer)

Request Body

application/json

{

  

"name": "string",

  

"allowed_origins": [

  

  

"string"

  

]

}

Responses

project

POST

/v1/admin/projects

Playground

Authorization

AdminBearer

Body

Samples

---

Get project

GET

/v1/admin/projects/{project_id}

Authorizations

AdminBearer

Admin JWT from signup/login

Type

HTTP (bearer)

Parameters

Path Parameters

project_id*

Type

string

Required

Responses

project + play_settings: active_players_24h (distinct активные игроки текущей механики с активностью за 24ч, непросроченные партии), site_wheel_ready, daily_wheel_ready

GET

/v1/admin/projects/{project_id}

Playground

Authorization

AdminBearer

Variables

Key

Value

project_id*

Samples

---

Update project settings

PATCH

/v1/admin/projects/{project_id}

Authorizations

AdminBearer

Admin JWT from signup/login

Type

HTTP (bearer)

Parameters

Path Parameters

project_id*

Type

string

Required

Request Body

application/json

{

  

"name": "string",

  

"allowed_origins": [

  

  

"string"

  

],

  

"active_template_id": "string",

  

"primary_color": "string",

  

"game_mode": "string",

  

"webhook_url": "string",

  

"exposure_mode": "string",

  

"play_mechanic": "match3_v1",

  

"entry_mode": "string",

  

"lobby_wheel_enabled": true

}

Responses

project

PATCH

/v1/admin/projects/{project_id}

Playground

Authorization

AdminBearer

Variables

Key

Value

project_id*

Body

Samples

---

List API keys

GET

/v1/admin/projects/{project_id}/api-keys

Authorizations

AdminBearer

Admin JWT from signup/login

Type

HTTP (bearer)

Parameters

Path Parameters

project_id*

Type

string

Required

Responses

api_keys[]

GET

/v1/admin/projects/{project_id}/api-keys

Playground

Authorization

AdminBearer

Variables

Key

Value

project_id*

Samples

---

Create API key (secret shown once)

POST

/v1/admin/projects/{project_id}/api-keys

Authorizations

AdminBearer

Admin JWT from signup/login

Type

HTTP (bearer)

Parameters

Path Parameters

project_id*

Type

string

Required

Request Body

application/json

{

  

"name": "string",

  

"scopes": [

  

  

"string"

  

]

}

Responses

api_key + secret

POST

/v1/admin/projects/{project_id}/api-keys

Playground

Authorization

AdminBearer

Variables

Key

Value

project_id*

Body

Samples

---

Revoke API key

DELETE

/v1/admin/projects/{project_id}/api-keys/{key_id}

Authorizations

AdminBearer

Admin JWT from signup/login

Type

HTTP (bearer)

Parameters

Path Parameters

project_id*

Type

string

Required

key_id*

Type

string

Required

Format

"uuid"

Responses

revoked

DELETE

/v1/admin/projects/{project_id}/api-keys/{key_id}

Playground

Authorization

AdminBearer

Variables

Key

Value

project_id*

key_id*

Samples

---

Embed snippet

GET

/v1/admin/projects/{project_id}/embed

Authorizations

AdminBearer

Admin JWT from signup/login

Type

HTTP (bearer)

Parameters

Path Parameters

project_id*

Type

string

Required

Responses

snippet, instructions

GET

/v1/admin/projects/{project_id}/embed

Playground

Authorization

AdminBearer

Variables

Key

Value

project_id*

Samples

---

Read published level goals of own project

GET

/v1/admin/projects/{project_id}/level-goals

Exact published level versions for Match3, Memory and Parcel Pilot; no closed run state. Legacy templates return null mechanic, empty levels and safe legacy_goals derived from the runtime defaults merged with project overrides. Wheel has no level goals.

Authorizations

AdminCookie

HttpOnly сессия админки. Изменяющие запросы с cookie требуют допустимый Origin; Bearer — альтернатива.

Type

API Key (cookie: playflow_admin_session)

or

AdminBearer

Admin JWT from signup/login

Type

HTTP (bearer)

Parameters

Path Parameters

project_id*

Type

string

Required

Responses

Published goals

Content-Type

application/json

{

  

"legacy_goals": [

  

  

"string"

  

],

  

"mechanic": "string",

  

"track_version": 0,

  

"levels": [

  

  

{

  

  

  

"number": 0,

  

  

  

"level_id": "string",

  

  

  

"level_version": 0,

  

  

  

"goals": [

  

  

  

  

"string"

  

  

  

],

  

  

  

"constraints": [

  

  

  

  

"string"

  

  

  

]

  

  

}

  

]

}

GET

/v1/admin/projects/{project_id}/level-goals

Playground

Authorization

AdminCookie

Variables

Key

Value

project_id*

Samples

---

admin-promo

Campaigns, webhooks, analytics

Operations

GET/v1/admin/projects/{project_id}/eventsGET/v1/admin/projects/{project_id}/events/exportDELETE/v1/admin/projects/{project_id}/players/{external_user_id}/dataGET/v1/admin/projects/{project_id}/campaignsPOST/v1/admin/projects/{project_id}/campaignsGET/v1/admin/projects/{project_id}/webhooks/deliveriesPOST/v1/admin/projects/{project_id}/webhooks/deliveries/{delivery_id}/retryPOST/v1/admin/projects/{project_id}/webhook-secret/revealPOST/v1/admin/projects/{project_id}/webhook-secret/rotatePOST/v1/admin/projects/{project_id}/webhooks/testGET/v1/admin/projects/{project_id}/players/{external_user_id}/progressGET/v1/admin/projects/{project_id}/analytics/overviewGET/v1/admin/projects/{project_id}/analytics/abGET/v1/admin/projects/{project_id}/analytics/funnelGET/v1/admin/projects/{project_id}/analytics/session-seriesPOST/v1/admin/projects/{project_id}/experiment/restartGET/v1/admin/projects/{project_id}/players/{external_user_id}/sessionsGET/v1/admin/projects/{project_id}/players/{external_user_id}/runsGET/v1/admin/projects/{project_id}/runs/{run_id}/commandsGET/v1/admin/projects/{project_id}/reward-claims

---

Event log

GET

/v1/admin/projects/{project_id}/events

Authorizations

AdminBearer

Admin JWT from signup/login

Type

HTTP (bearer)

Parameters

Path Parameters

project_id*

Type

string

Required

Query Parameters

event_type

Type

string

external_user_id

Type

string

since

Type

string

Format

"date-time"

until

Type

string

Format

"date-time"

limit

Type

integer

Default

50

Maximum

500

cursor

opaque, from a previous response's next_cursor

Type

string

Responses

{events: [], next_cursor: string|null}

GET

/v1/admin/projects/{project_id}/events

Playground

Authorization

AdminBearer

Variables

Key

Value

project_id*

event_type

external_user_id

since

until

limit

cursor

Samples

---

Export event log as CSV (streamed, unlimited rows, same filters as the list)

GET

/v1/admin/projects/{project_id}/events/export

Authorizations

AdminBearer

Admin JWT from signup/login

Type

HTTP (bearer)

Parameters

Path Parameters

project_id*

Type

string

Required

Query Parameters

event_type

Type

string

external_user_id

Type

string

since

Type

string

Format

"date-time"

until

Type

string

Format

"date-time"

Responses

text/csv attachment, streamed; formula-injection-safe (CWE-1236)

GET

/v1/admin/projects/{project_id}/events/export

Playground

Authorization

AdminBearer

Variables

Key

Value

project_id*

event_type

external_user_id

since

until

Samples

---

GDPR delete player data

DELETE

/v1/admin/projects/{project_id}/players/{external_user_id}/data

Authorizations

AdminBearer

Admin JWT from signup/login

Type

HTTP (bearer)

Parameters

Path Parameters

project_id*

Type

string

Required

external_user_id*

Type

string

Required

Responses

Deletion summary

DELETE

/v1/admin/projects/{project_id}/players/{external_user_id}/data

Playground

Authorization

AdminBearer

Variables

Key

Value

project_id*

external_user_id*

Samples

---

List campaigns

GET

/v1/admin/projects/{project_id}/campaigns

Authorizations

AdminBearer

Admin JWT from signup/login

Type

HTTP (bearer)

Parameters

Path Parameters

project_id*

Type

string

Required

Responses

campaigns[]

GET

/v1/admin/projects/{project_id}/campaigns

Playground

Authorization

AdminBearer

Variables

Key

Value

project_id*

Samples

---

Create campaign

POST

/v1/admin/projects/{project_id}/campaigns

Authorizations

AdminBearer

Admin JWT from signup/login

Type

HTTP (bearer)

Parameters

Path Parameters

project_id*

Type

string

Required

Request Body

application/json

{

  

"name": "string",

  

"trigger_type": "game_won",

  

"trigger_params": {

  

},

  

"reward_type": "string",

  

"reward_metadata": {

  

},

  

"max_per_user": 1,

  

"webhook_url": "string",

  

"starts_at": "string",

  

"ends_at": "string"

}

Responses

campaign

POST

/v1/admin/projects/{project_id}/campaigns

Playground

Authorization

AdminBearer

Variables

Key

Value

project_id*

Body

Samples

---

Webhook delivery log

GET

/v1/admin/projects/{project_id}/webhooks/deliveries

Authorizations

AdminBearer

Admin JWT from signup/login

Type

HTTP (bearer)

Parameters

Path Parameters

project_id*

Type

string

Required

Responses

deliveries[]

GET

/v1/admin/projects/{project_id}/webhooks/deliveries

Playground

Authorization

AdminBearer

Variables

Key

Value

project_id*

Samples

---

Retry failed webhook delivery

POST

/v1/admin/projects/{project_id}/webhooks/deliveries/{delivery_id}/retry

Resets the delivery's attempt count and backoff schedule and queues it for another attempt. Scoped to project_id: a delivery_id belonging to a different project returns 404 rather than retrying it.

Authorizations

AdminBearer

Admin JWT from signup/login

Type

HTTP (bearer)

Parameters

Path Parameters

project_id*

Type

string

Required

delivery_id*

Type

string

Required

Format

"uuid"

Responses

queued

POST

/v1/admin/projects/{project_id}/webhooks/deliveries/{delivery_id}/retry

Playground

Authorization

AdminBearer

Variables

Key

Value

project_id*

delivery_id*

Samples

---

Reveal the current webhook signing secret

POST

/v1/admin/projects/{project_id}/webhook-secret/reveal

The secret is never chosen by the integrator — it's derived per project from the platform's own master key and versioned. This is the only way to obtain it.

Authorizations

AdminBearer

Admin JWT from signup/login

Type

HTTP (bearer)

Parameters

Path Parameters

project_id*

Type

string

Required

Responses

{ secret, version }

Content-Type

application/json

{

  

"secret": "string",

  

"version": 0

}

POST

/v1/admin/projects/{project_id}/webhook-secret/reveal

Playground

Authorization

AdminBearer

Variables

Key

Value

project_id*

Samples

---

Rotate the webhook signing secret

POST

/v1/admin/projects/{project_id}/webhook-secret/rotate

Generates a new secret and increments the version. Outbound deliveries already queued re-sign with the new secret on their next attempt (they read the project's current version at send time, not a snapshot from when they were enqueued). The previous version is still accepted by the platform's own test-inbox receiver for a 24-hour grace window.

Authorizations

AdminBearer

Admin JWT from signup/login

Type

HTTP (bearer)

Parameters

Path Parameters

project_id*

Type

string

Required

Responses

{ secret, version }

Content-Type

application/json

{

  

"secret": "string",

  

"version": 0

}

POST

/v1/admin/projects/{project_id}/webhook-secret/rotate

Playground

Authorization

AdminBearer

Variables

Key

Value

project_id*

Samples

---

Send test webhook payload

POST

/v1/admin/projects/{project_id}/webhooks/test

Authorizations

AdminBearer

Admin JWT from signup/login

Type

HTTP (bearer)

Parameters

Path Parameters

project_id*

Type

string

Required

Request Body

application/json

{

  

"webhook_url": "string"

}

Responses

HTTP status from customer endpoint

POST

/v1/admin/projects/{project_id}/webhooks/test

Playground

Authorization

AdminBearer

Variables

Key

Value

project_id*

Body

Samples

---

Player progress per template

GET

/v1/admin/projects/{project_id}/players/{external_user_id}/progress

Authorizations

AdminBearer

Admin JWT from signup/login

Type

HTTP (bearer)

Parameters

Path Parameters

project_id*

Type

string

Required

external_user_id*

Type

string

Required

Responses

templates[]

GET

/v1/admin/projects/{project_id}/players/{external_user_id}/progress

Playground

Authorization

AdminBearer

Variables

Key

Value

project_id*

external_user_id*

Samples

---

Dashboard metrics

GET

/v1/admin/projects/{project_id}/analytics/overview

Authorizations

AdminBearer

Admin JWT from signup/login

Type

HTTP (bearer)

Parameters

Path Parameters

project_id*

Type

string

Required

Responses

dau, wau, d1/d7 return, preview→play funnel, avg session, fraud_flags, webhook_failures

GET

/v1/admin/projects/{project_id}/analytics/overview

Playground

Authorization

AdminBearer

Variables

Key

Value

project_id*

Samples

---

A/B cohort comparison

GET

/v1/admin/projects/{project_id}/analytics/ab

Authorizations

AdminBearer

Admin JWT from signup/login

Type

HTTP (bearer)

Parameters

Path Parameters

project_id*

Type

string

Required

Responses

enabled, cohorts[]

GET

/v1/admin/projects/{project_id}/analytics/ab

Playground

Authorization

AdminBearer

Variables

Key

Value

project_id*

Samples

---

Retention funnel start → day N → complete

GET

/v1/admin/projects/{project_id}/analytics/funnel

Authorizations

AdminBearer

Admin JWT from signup/login

Type

HTTP (bearer)

Parameters

Path Parameters

project_id*

Type

string

Required

Query Parameters

day_n

Type

integer

Default

7

Responses

started, returned_on_day_n, completed_by_day_n

GET

/v1/admin/projects/{project_id}/analytics/funnel

Playground

Authorization

AdminBearer

Variables

Key

Value

project_id*

day_n

Samples

---

Full-range daily session-start series for the dashboard chart

GET

/v1/admin/projects/{project_id}/analytics/session-series

Authorizations

AdminBearer

Admin JWT from signup/login

Type

HTTP (bearer)

Parameters

Path Parameters

project_id*

Type

string

Required

Query Parameters

days

Type

integer

Default

7

Minimum

1

Maximum

90

Responses

{series: [{date, count}], delta_pct: number|null}

GET

/v1/admin/projects/{project_id}/analytics/session-series

Playground

Authorization

AdminBearer

Variables

Key

Value

project_id*

days

Samples

---

Start a new experiment (fresh bucket assignments going forward; past exposures kept)

POST

/v1/admin/projects/{project_id}/experiment/restart

Authorizations

AdminBearer

Admin JWT from signup/login

Type

HTTP (bearer)

Parameters

Path Parameters

project_id*

Type

string

Required

Responses

{experiment_key: string}

POST

/v1/admin/projects/{project_id}/experiment/restart

Playground

Authorization

AdminBearer

Variables

Key

Value

project_id*

Samples

---

Player session history

GET

/v1/admin/projects/{project_id}/players/{external_user_id}/sessions

Authorizations

AdminBearer

Admin JWT from signup/login

Type

HTTP (bearer)

Parameters

Path Parameters

project_id*

Type

string

Required

external_user_id*

Type

string

Required

Query Parameters

limit

Type

integer

Default

50

Responses

sessions[]

GET

/v1/admin/projects/{project_id}/players/{external_user_id}/sessions

Playground

Authorization

AdminBearer

Variables

Key

Value

project_id*

external_user_id*

limit

Samples

---

Player game runs (safe fields only, no closed engine state)

GET

/v1/admin/projects/{project_id}/players/{external_user_id}/runs

Authorizations

AdminBearer

Admin JWT from signup/login

Type

HTTP (bearer)

Parameters

Path Parameters

project_id*

Type

string

Required

external_user_id*

Type

string

Required

Query Parameters

limit

Type

integer

Default

50

Responses

runs[]

GET

/v1/admin/projects/{project_id}/players/{external_user_id}/runs

Playground

Authorization

AdminBearer

Variables

Key

Value

project_id*

external_user_id*

limit

Samples

---

Commands (moves) recorded for one game run, scoped to the owning project

GET

/v1/admin/projects/{project_id}/runs/{run_id}/commands

Authorizations

AdminBearer

Admin JWT from signup/login

Type

HTTP (bearer)

Parameters

Path Parameters

project_id*

Type

string

Required

run_id*

Type

string

Required

Format

"uuid"

Responses

commands[]

GET

/v1/admin/projects/{project_id}/runs/{run_id}/commands

Playground

Authorization

AdminBearer

Variables

Key

Value

project_id*

run_id*

Samples

---

Reward claims state log

GET

/v1/admin/projects/{project_id}/reward-claims

Authorizations

AdminBearer

Admin JWT from signup/login

Type

HTTP (bearer)

Parameters

Path Parameters

project_id*

Type

string

Required

Responses

claims[]

GET

/v1/admin/projects/{project_id}/reward-claims

Playground

Authorization

AdminBearer

Variables

Key

Value

project_id*

Samples

---

admin-billing

Plans & invoices

Operations

GET/v1/admin/billing/plansGET/v1/admin/billingPOST/v1/admin/billing/upgradeGET/v1/admin/billing/invoicesPOST/v1/admin/billing/invoices/{invoice_id}/checkoutPOST/v1/admin/billing/invoices/{invoice_id}/pay-simulated

---

Public plan catalog

GET

/v1/admin/billing/plans

Responses

plans[]

GET

/v1/admin/billing/plans

Playground

Samples

---

Current plan and usage

GET

/v1/admin/billing

Authorizations

AdminBearer

Admin JWT from signup/login

Type

HTTP (bearer)

Responses

plan, usage

GET

/v1/admin/billing

Playground

Authorization

AdminBearer

Samples

---

Upgrade plan

POST

/v1/admin/billing/upgrade

Authorizations

AdminBearer

Admin JWT from signup/login

Type

HTTP (bearer)

Request Body

application/json

{

  

"plan_id": "growth"

}

Responses

ok

POST

/v1/admin/billing/upgrade

Playground

Authorization

AdminBearer

Body

Samples

---

List invoices

GET

/v1/admin/billing/invoices

Authorizations

AdminBearer

Admin JWT from signup/login

Type

HTTP (bearer)

Responses

invoices[]

GET

/v1/admin/billing/invoices

Playground

Authorization

AdminBearer

Samples

---

Create Stripe Checkout session for issued invoice

POST

/v1/admin/billing/invoices/{invoice_id}/checkout

Authorizations

AdminBearer

Admin JWT from signup/login

Type

HTTP (bearer)

Parameters

Path Parameters

invoice_id*

Type

string

Required

Format

"uuid"

Responses

checkout_url, session_id

POST

/v1/admin/billing/invoices/{invoice_id}/checkout

Playground

Authorization

AdminBearer

Variables

Key

Value

invoice_id*

Samples

---

Mark invoice paid (dev only, when Stripe disabled)

POST

/v1/admin/billing/invoices/{invoice_id}/pay-simulated

Authorizations

AdminBearer

Admin JWT from signup/login

Type

HTTP (bearer)

Parameters

Path Parameters

invoice_id*

Type

string

Required

Format

"uuid"

Responses

status paid

POST

/v1/admin/billing/invoices/{invoice_id}/pay-simulated

Playground

Authorization

AdminBearer

Variables

Key

Value

invoice_id*

Samples

---

webhooks

Inbound provider and test-inbox webhooks

Operations

POST/v1/webhooks/stripePOST/v1/webhooks/inbox/{token}

---

Stripe webhook (checkout.session.completed)

POST

/v1/webhooks/stripe

Parameters

Header Parameters

stripe-signature*

Type

string

Required

Responses

received

POST

/v1/webhooks/stripe

Playground

Headers

stripe-signature*

Samples

---

Receive a test webhook by inbox token

POST

/v1/webhooks/inbox/{token}

Локальный тестовый приёмник: секретный token принадлежит проекту. Не путь выдачи награды интегратору.

Parameters

Header Parameters

X-RetentionPlay-Signature

Обязателен этот заголовок или старый X-PlayFlow-Signature; HMAC по сырому телу.

Type

string

Path Parameters

token*

Type

string

Required

Responses

Successful response

POST

/v1/webhooks/inbox/{token}

Playground

Headers

X-RetentionPlay-Signature

Variables

Key

Value

token*

Samples

---

admin-onboarding

Self-serve onboarding

Operations

GET/v1/admin/onboardingPOST/v1/admin/onboarding/{step}/complete

---

Onboarding checklist state

GET

/v1/admin/onboarding

Authorizations

AdminBearer

Admin JWT from signup/login

Type

HTTP (bearer)

Responses

steps, next_step, finished

GET

/v1/admin/onboarding

Playground

Authorization

AdminBearer

Samples

---

Confirm successful embed-code copy

POST

/v1/admin/onboarding/{step}/complete

Authorizations

AdminBearer

Admin JWT from signup/login

Type

HTTP (bearer)

Parameters

Path Parameters

step*

Type

string

Required

Valid values

"embed_copied"

Responses

Updated onboarding state

POST

/v1/admin/onboarding/{step}/complete

Playground

Authorization

AdminBearer

Variables

Key

Value

step*

Samples

---

admin-economy

Economy settings & fraud

Operations

GET/v1/admin/projects/{project_id}/economyPATCH/v1/admin/projects/{project_id}/economyPOST/v1/admin/projects/{project_id}/economy/grantGET/v1/admin/projects/{project_id}/fraud-flags

---

Economy settings

GET

/v1/admin/projects/{project_id}/economy

Authorizations

AdminBearer

Admin JWT from signup/login

Type

HTTP (bearer)

Parameters

Path Parameters

project_id*

Type

string

Required

Responses

economy_enabled, economy_config

GET

/v1/admin/projects/{project_id}/economy

Playground

Authorization

AdminBearer

Variables

Key

Value

project_id*

Samples

---

Update economy settings

PATCH

/v1/admin/projects/{project_id}/economy

Authorizations

AdminBearer

Admin JWT from signup/login

Type

HTTP (bearer)

Parameters

Path Parameters

project_id*

Type

string

Required

Request Body

application/json

{

  

"economy_enabled": true,

  

"economy_config": {

  

}

}

Responses

ok

PATCH

/v1/admin/projects/{project_id}/economy

Playground

Authorization

AdminBearer

Variables

Key

Value

project_id*

Body

Samples

---

Admin grant resources to player

POST

/v1/admin/projects/{project_id}/economy/grant

Authorizations

AdminBearer

Admin JWT from signup/login

Type

HTTP (bearer)

Parameters

Path Parameters

project_id*

Type

string

Required

Request Body

application/json

{

  

"external_user_id": "string",

  

"resource_id": "string",

  

"amount": 0

}

Responses

Granted

POST

/v1/admin/projects/{project_id}/economy/grant

Playground

Authorization

AdminBearer

Variables

Key

Value

project_id*

Body

Samples

---

Fraud flags for project

GET

/v1/admin/projects/{project_id}/fraud-flags

Authorizations

AdminBearer

Admin JWT from signup/login

Type

HTTP (bearer)

Parameters

Path Parameters

project_id*

Type

string

Required

Responses

flags[]

GET

/v1/admin/projects/{project_id}/fraud-flags

Playground

Authorization

AdminBearer

Variables

Key

Value

project_id*

Samples

---

admin

Admin settings and moderation

Operations

PUT/v1/admin/projects/{project_id}/game-assets/{slot}/backgroundDELETE/v1/admin/projects/{project_id}/game-assets/{slot}/backgroundPOST/v1/admin/auth/logoutGET/v1/admin/notificationsGET/v1/admin/searchGET/v1/admin/projects/{project_id}/analytics/caseGET/v1/admin/projects/{project_id}/leaderboardGET/v1/admin/projects/{project_id}/fraud-metricsGET/v1/admin/projects/{project_id}/players/{external_user_id}/fraudPUT/v1/admin/projects/{project_id}/players/{external_user_id}/fraudPATCH/v1/admin/projects/{project_id}/fraud-flags/{flag_id}POST/v1/admin/projects/{project_id}/reward-claims/{claim_id}/releasePOST/v1/admin/projects/{project_id}/reward-claims/{claim_id}/rejectGET/v1/admin/projects/{project_id}/webhooks/inboxDELETE/v1/admin/projects/{project_id}/webhooks/inboxPOST/v1/admin/projects/{project_id}/webhooks/inbox/rotatePATCH/v1/admin/projects/{project_id}/campaigns/{campaign_id}GET/v1/admin/two-factor/statusPOST/v1/admin/two-factor/enrollPOST/v1/admin/two-factor/confirmPOST/v1/admin/two-factor/challengePOST/v1/admin/two-factor/recovery

---

Upload the project background

PUT

/v1/admin/projects/{project_id}/game-assets/{slot}/background

Принимает multipart-поле file. Формат определяется декодированием, а не расширением: PNG, JPEG или WebP, до 5 MiB, портретное изображение от 420×760 до 2160×3840 с отношением сторон 0.50–0.65. Произвольный URL не принимается. Сервер сохраняет оригинал и непрозрачную рантайм-копию WebP 840×1520, cover по центру, q78/70/62, не более220 КиБ; слот и play_config_revision обновляются одной SQL-инструкцией. EXIF-ориентация применяется перед нормализацией; оригинальные байты сохраняются. Габариты проверяются до выделения пиксельного буфера, бюджет декодера 64 MiB. На процесс допускаются две одновременные нормализации; перегрузка возвращает 429 с Retry-After: 1.

Authorizations

AdminCookie

HttpOnly сессия админки. Изменяющие запросы с cookie требуют допустимый Origin; Bearer — альтернатива.

Type

API Key (cookie: playflow_admin_session)

Parameters

Path Parameters

project_id*

Type

string

Required

slot*

lobby или id механики вида run из реестра; колесо и старые шаблоны запрещены.

Type

string

Required

Example"lobby"

Request Body

multipart/form-data

Format"binary"

Responses

Фон сохранён

Content-Type

application/json

{

  

"slot": "string",

  

"background": {

  

  

"asset_id": "string",

  

  

"format": "string",

  

  

"width": 0,

  

  

"height": 0,

  

  

"bytes": 0,

  

  

"sha256": "string",

  

  

"original": "[Circular Reference]"

  

},

  

"config_revision": 0,

  

"url": "string"

}

PUT

/v1/admin/projects/{project_id}/game-assets/{slot}/background

Playground

Authorization

AdminCookie

Variables

Key

Value

project_id*

slot*

Body

Samples

---

Reset the project background to the default

DELETE

/v1/admin/projects/{project_id}/game-assets/{slot}/background

Снимает метаданные фона. Файл на диске остаётся; физическая уборка — отдельная задача. Слот и play_config_revision обновляются одной SQL-инструкцией.

Authorizations

AdminCookie

HttpOnly сессия админки. Изменяющие запросы с cookie требуют допустимый Origin; Bearer — альтернатива.

Type

API Key (cookie: playflow_admin_session)

Parameters

Path Parameters

project_id*

Type

string

Required

slot*

lobby или id механики вида run из реестра; колесо и старые шаблоны запрещены.

Type

string

Required

Example"lobby"

Responses

Возвращён базовый фон

Content-Type

application/json

{

  

"slot": "string",

  

"background": {

  

},

  

"config_revision": 0

}

DELETE

/v1/admin/projects/{project_id}/game-assets/{slot}/background

Playground

Authorization

AdminCookie

Variables

Key

Value

project_id*

slot*

Samples

---

End the cookie admin session

POST

/v1/admin/auth/logout

Requires active registry session; atomically revokes its server record and clears both cookie paths. Cookie callers require allowed Origin.

Authorizations

AdminCookie

HttpOnly сессия админки. Изменяющие запросы с cookie требуют допустимый Origin; Bearer — альтернатива.

Type

API Key (cookie: playflow_admin_session)

or

AdminBearer

Admin JWT from signup/login

Type

HTTP (bearer)

Responses

Successful response

POST

/v1/admin/auth/logout

Playground

Authorization

AdminCookie

Samples

---

List current account notifications

GET

/v1/admin/notifications

Authorizations

AdminBearer

Admin JWT from signup/login

Type

HTTP (bearer)

or

AdminCookie

HttpOnly сессия админки. Изменяющие запросы с cookie требуют допустимый Origin; Bearer — альтернатива.

Type

API Key (cookie: playflow_admin_session)

Parameters

Query Parameters

project_id

Type

string

Responses

Successful response

GET

/v1/admin/notifications

Playground

Authorization

AdminBearer

Variables

Key

Value

project_id

Samples

---

Search current account projects and players

GET

/v1/admin/search

Authorizations

AdminBearer

Admin JWT from signup/login

Type

HTTP (bearer)

or

AdminCookie

HttpOnly сессия админки. Изменяющие запросы с cookie требуют допустимый Origin; Bearer — альтернатива.

Type

API Key (cookie: playflow_admin_session)

Parameters

Query Parameters

q*

Type

string

Required

project_id

Type

string

Responses

Successful response

GET

/v1/admin/search

Playground

Authorization

AdminBearer

Variables

Key

Value

q*

project_id

Samples

---

Project campaign analytics

GET

/v1/admin/projects/{project_id}/analytics/case

Authorizations

AdminBearer

Admin JWT from signup/login

Type

HTTP (bearer)

or

AdminCookie

HttpOnly сессия админки. Изменяющие запросы с cookie требуют допустимый Origin; Bearer — альтернатива.

Type

API Key (cookie: playflow_admin_session)

Parameters

Path Parameters

project_id*

Type

string

Required

Responses

Successful response

GET

/v1/admin/projects/{project_id}/analytics/case

Playground

Authorization

AdminBearer

Variables

Key

Value

project_id*

Samples

---

Project leaderboard

GET

/v1/admin/projects/{project_id}/leaderboard

Authorizations

AdminBearer

Admin JWT from signup/login

Type

HTTP (bearer)

or

AdminCookie

HttpOnly сессия админки. Изменяющие запросы с cookie требуют допустимый Origin; Bearer — альтернатива.

Type

API Key (cookie: playflow_admin_session)

Parameters

Path Parameters

project_id*

Type

string

Required

Responses

Successful response

GET

/v1/admin/projects/{project_id}/leaderboard

Playground

Authorization

AdminBearer

Variables

Key

Value

project_id*

Samples

---

Project fraud metrics

GET

/v1/admin/projects/{project_id}/fraud-metrics

Authorizations

AdminBearer

Admin JWT from signup/login

Type

HTTP (bearer)

or

AdminCookie

HttpOnly сессия админки. Изменяющие запросы с cookie требуют допустимый Origin; Bearer — альтернатива.

Type

API Key (cookie: playflow_admin_session)

Parameters

Path Parameters

project_id*

Type

string

Required

Responses

Successful response

GET

/v1/admin/projects/{project_id}/fraud-metrics

Playground

Authorization

AdminBearer

Variables

Key

Value

project_id*

Samples

---

Read player fraud status

GET

/v1/admin/projects/{project_id}/players/{external_user_id}/fraud

Authorizations

AdminBearer

Admin JWT from signup/login

Type

HTTP (bearer)

or

AdminCookie

HttpOnly сессия админки. Изменяющие запросы с cookie требуют допустимый Origin; Bearer — альтернатива.

Type

API Key (cookie: playflow_admin_session)

Parameters

Path Parameters

project_id*

Type

string

Required

external_user_id*

Type

string

Required

Responses

Successful response

GET

/v1/admin/projects/{project_id}/players/{external_user_id}/fraud

Playground

Authorization

AdminBearer

Variables

Key

Value

project_id*

external_user_id*

Samples

---

Set player fraud status

PUT

/v1/admin/projects/{project_id}/players/{external_user_id}/fraud

Authorizations

AdminBearer

Admin JWT from signup/login

Type

HTTP (bearer)

or

AdminCookie

HttpOnly сессия админки. Изменяющие запросы с cookie требуют допустимый Origin; Bearer — альтернатива.

Type

API Key (cookie: playflow_admin_session)

Parameters

Path Parameters

project_id*

Type

string

Required

external_user_id*

Type

string

Required

Request Body

application/json

{

  

"state": "string",

  

"reason": "string",

  

"expires_at": "string"

}

Responses

Successful response

PUT

/v1/admin/projects/{project_id}/players/{external_user_id}/fraud

Playground

Authorization

AdminBearer

Variables

Key

Value

project_id*

external_user_id*

Body

Samples

---

Resolve a fraud flag

PATCH

/v1/admin/projects/{project_id}/fraud-flags/{flag_id}

Authorizations

AdminBearer

Admin JWT from signup/login

Type

HTTP (bearer)

or

AdminCookie

HttpOnly сессия админки. Изменяющие запросы с cookie требуют допустимый Origin; Bearer — альтернатива.

Type

API Key (cookie: playflow_admin_session)

Parameters

Path Parameters

project_id*

Type

string

Required

flag_id*

Type

string

Required

Request Body

application/json

{

  

"resolution": "string"

}

Responses

Successful response

PATCH

/v1/admin/projects/{project_id}/fraud-flags/{flag_id}

Playground

Authorization

AdminBearer

Variables

Key

Value

project_id*

flag_id*

Body

Samples

---

Release a held or reviewed reward claim

POST

/v1/admin/projects/{project_id}/reward-claims/{claim_id}/release

Authorizations

AdminBearer

Admin JWT from signup/login

Type

HTTP (bearer)

or

AdminCookie

HttpOnly сессия админки. Изменяющие запросы с cookie требуют допустимый Origin; Bearer — альтернатива.

Type

API Key (cookie: playflow_admin_session)

Parameters

Path Parameters

project_id*

Type

string

Required

claim_id*

Type

string

Required

Responses

Successful response

POST

/v1/admin/projects/{project_id}/reward-claims/{claim_id}/release

Playground

Authorization

AdminBearer

Variables

Key

Value

project_id*

claim_id*

Samples

---

Reject a held or reviewed reward claim

POST

/v1/admin/projects/{project_id}/reward-claims/{claim_id}/reject

Authorizations

AdminBearer

Admin JWT from signup/login

Type

HTTP (bearer)

or

AdminCookie

HttpOnly сессия админки. Изменяющие запросы с cookie требуют допустимый Origin; Bearer — альтернатива.

Type

API Key (cookie: playflow_admin_session)

Parameters

Path Parameters

project_id*

Type

string

Required

claim_id*

Type

string

Required

Request Body

application/json

{

  

"reason": "string"

}

Responses

Successful response

POST

/v1/admin/projects/{project_id}/reward-claims/{claim_id}/reject

Playground

Authorization

AdminBearer

Variables

Key

Value

project_id*

claim_id*

Body

Samples

---

Read project test webhook inbox

GET

/v1/admin/projects/{project_id}/webhooks/inbox

Authorizations

AdminBearer

Admin JWT from signup/login

Type

HTTP (bearer)

or

AdminCookie

HttpOnly сессия админки. Изменяющие запросы с cookie требуют допустимый Origin; Bearer — альтернатива.

Type

API Key (cookie: playflow_admin_session)

Parameters

Path Parameters

project_id*

Type

string

Required

Responses

Successful response

GET

/v1/admin/projects/{project_id}/webhooks/inbox

Playground

Authorization

AdminBearer

Variables

Key

Value

project_id*

Samples

---

Clear project test webhook inbox

DELETE

/v1/admin/projects/{project_id}/webhooks/inbox

Authorizations

AdminBearer

Admin JWT from signup/login

Type

HTTP (bearer)

or

AdminCookie

HttpOnly сессия админки. Изменяющие запросы с cookie требуют допустимый Origin; Bearer — альтернатива.

Type

API Key (cookie: playflow_admin_session)

Parameters

Path Parameters

project_id*

Type

string

Required

Responses

Successful response

DELETE

/v1/admin/projects/{project_id}/webhooks/inbox

Playground

Authorization

AdminBearer

Variables

Key

Value

project_id*

Samples

---

Rotate project test inbox token

POST

/v1/admin/projects/{project_id}/webhooks/inbox/rotate

Authorizations

AdminBearer

Admin JWT from signup/login

Type

HTTP (bearer)

or

AdminCookie

HttpOnly сессия админки. Изменяющие запросы с cookie требуют допустимый Origin; Bearer — альтернатива.

Type

API Key (cookie: playflow_admin_session)

Parameters

Path Parameters

project_id*

Type

string

Required

Responses

Successful response

POST

/v1/admin/projects/{project_id}/webhooks/inbox/rotate

Playground

Authorization

AdminBearer

Variables

Key

Value

project_id*

Samples

---

Update a campaign

PATCH

/v1/admin/projects/{project_id}/campaigns/{campaign_id}

Authorizations

AdminBearer

Admin JWT from signup/login

Type

HTTP (bearer)

or

AdminCookie

HttpOnly сессия админки. Изменяющие запросы с cookie требуют допустимый Origin; Bearer — альтернатива.

Type

API Key (cookie: playflow_admin_session)

Parameters

Path Parameters

project_id*

Type

string

Required

campaign_id*

Type

string

Required

Request Body

application/json

{

  

"name": "string",

  

"trigger_type": "game_won",

  

"trigger_params": {

  

},

  

"reward_type": "string",

  

"reward_metadata": {

  

},

  

"max_per_user": 0,

  

"webhook_url": "string",

  

"starts_at": "string",

  

"ends_at": "string"

}

Responses

Successful response

PATCH

/v1/admin/projects/{project_id}/campaigns/{campaign_id}

Playground

Authorization

AdminBearer

Variables

Key

Value

project_id*

campaign_id*

Body

Samples

---

Read account two-factor status

GET

/v1/admin/two-factor/status

Authorizations

AdminBearer

Admin JWT from signup/login

Type

HTTP (bearer)

or

AdminCookie

HttpOnly сессия админки. Изменяющие запросы с cookie требуют допустимый Origin; Bearer — альтернатива.

Type

API Key (cookie: playflow_admin_session)

Responses

Successful response

GET

/v1/admin/two-factor/status

Playground

Authorization

AdminBearer

Samples

---

Begin TOTP enrollment

POST

/v1/admin/two-factor/enroll

Authorizations

AdminBearer

Admin JWT from signup/login

Type

HTTP (bearer)

or

AdminCookie

HttpOnly сессия админки. Изменяющие запросы с cookie требуют допустимый Origin; Bearer — альтернатива.

Type

API Key (cookie: playflow_admin_session)

Responses

Successful response

POST

/v1/admin/two-factor/enroll

Playground

Authorization

AdminBearer

Samples

---

Confirm TOTP enrollment

POST

/v1/admin/two-factor/confirm

Authorizations

AdminBearer

Admin JWT from signup/login

Type

HTTP (bearer)

or

AdminCookie

HttpOnly сессия админки. Изменяющие запросы с cookie требуют допустимый Origin; Bearer — альтернатива.

Type

API Key (cookie: playflow_admin_session)

Request Body

application/json

{

  

"code": "string"

}

Responses

Successful response

POST

/v1/admin/two-factor/confirm

Playground

Authorization

AdminBearer

Body

Samples

---

Verify TOTP or recovery code

POST

/v1/admin/two-factor/challenge

Authorizations

AdminBearer

Admin JWT from signup/login

Type

HTTP (bearer)

or

AdminCookie

HttpOnly сессия админки. Изменяющие запросы с cookie требуют допустимый Origin; Bearer — альтернатива.

Type

API Key (cookie: playflow_admin_session)

Request Body

application/json

{

  

"code": "string"

}

Responses

Successful response

POST

/v1/admin/two-factor/challenge

Playground

Authorization

AdminBearer

Body

Samples

---

Sign in using a one-time recovery code

POST

/v1/admin/two-factor/recovery

Authorizations

AdminBearer

Admin JWT from signup/login

Type

HTTP (bearer)

or

AdminCookie

HttpOnly сессия админки. Изменяющие запросы с cookie требуют допустимый Origin; Bearer — альтернатива.

Type

API Key (cookie: playflow_admin_session)

Request Body

application/json

{

  

"code": "string"

}

Responses

Successful response

POST

/v1/admin/two-factor/recovery

Playground

Authorization

AdminBearer

Body

Samples

---

wheel

Server-computed Reward Wheel R1

Operations

GET/v1/wheelPOST/v1/wheel/spinsGET/v1/wheel/spins/{spin_id}POST/v1/wheel/spins/{spin_id}/seenGET/v1/game-assets/wheel/icons/{icon}GET/v1/admin/projects/{project_id}/wheels/settingsPUT/v1/admin/projects/{project_id}/wheels/settingsGET/v1/admin/projects/{project_id}/wheels/{wheel_id}/draftPUT/v1/admin/projects/{project_id}/wheels/{wheel_id}/draftPOST/v1/admin/projects/{project_id}/wheels/{wheel_id}/publishPOST/v1/admin/projects/{project_id}/wheels/{wheel_id}/simulateGET/v1/admin/projects/{project_id}/wheels/{wheel_id}/stats

---

Read published R1 wheel

GET

/v1/wheel

30 reads/minute/player. Anonymous sessions can use only free-play. no-store response.

Authorizations

SessionBearer

Platform-issued identified or anonymous player session token

Type

HTTP (bearer)

Parameters

Query Parameters

wheel_id

Type

string

Valid values

"daily""site"

Default

"daily"

Responses

JSON response; see /integration/wheel

GET

/v1/wheel

Playground

Authorization

SessionBearer

Variables

Key

Value

wheel_id

Samples

---

Draw and persist one R1 spin

POST

/v1/wheel/spins

512-byte body ceiling. Exact durable spin_id replay before quotas; new spins 6/minute and 30/hour/player plus daily entitlements. R1 tickets/resources only, no material prizes.

Authorizations

SessionBearer

Platform-issued identified or anonymous player session token

Type

HTTP (bearer)

Parameters

Header Parameters

Origin*

Admin site origin for cookie writes; API origin for public writes

Type

string

Required

Request Body

application/json

{

  

"spin_id": "string",

  

"wheel_id": "string",

  

"wheel_version": 0,

  

"source": "string"

}

Responses

JSON response; see /integration/wheel

POST

/v1/wheel/spins

Playground

Authorization

SessionBearer

Headers

Origin*

Body

Samples

---

Read owned spin

GET

/v1/wheel/spins/{spin_id}

Only this project/player can read or acknowledge the spin. 30 reads/minute/player.

Authorizations

SessionBearer

Platform-issued identified or anonymous player session token

Type

HTTP (bearer)

Parameters

Path Parameters

spin_id*

Type

string

Required

Format

"uuid"

Responses

JSON response; see /integration/wheel

GET

/v1/wheel/spins/{spin_id}

Playground

Authorization

SessionBearer

Variables

Key

Value

spin_id*

Samples

---

Acknowledge result (idempotent)

POST

/v1/wheel/spins/{spin_id}/seen

Only this project/player can read or acknowledge the spin. 30 reads/minute/player.

Authorizations

SessionBearer

Platform-issued identified or anonymous player session token

Type

HTTP (bearer)

Parameters

Header Parameters

Origin*

Admin site origin for cookie writes; API origin for public writes

Type

string

Required

Path Parameters

spin_id*

Type

string

Required

Format

"uuid"

Responses

JSON response; see /integration/wheel

POST

/v1/wheel/spins/{spin_id}/seen

Playground

Authorization

SessionBearer

Headers

Origin*

Variables

Key

Value

spin_id*

Samples

---

Built-in wheel SVG icon

GET

/v1/game-assets/wheel/icons/{icon}

Parameters

Path Parameters

icon*

Type

string

Required

Responses

image/svg+xml; public max-age=3600

GET

/v1/game-assets/wheel/icons/{icon}

Playground

Variables

Key

Value

icon*

Samples

---

GET wheel settings

GET

/v1/admin/projects/{project_id}/wheels/settings

Authenticated project owner with verified 2FA. Simulation draws 10000 results and creates no award. Published weights are not in public views.

Authorizations

AdminCookie

HttpOnly сессия админки. Изменяющие запросы с cookie требуют допустимый Origin; Bearer — альтернатива.

Type

API Key (cookie: playflow_admin_session)

or

AdminBearer

Admin JWT from signup/login

Type

HTTP (bearer)

Parameters

Path Parameters

project_id*

Type

string

Required

Responses

JSON response; see /integration/wheel

GET

/v1/admin/projects/{project_id}/wheels/settings

Playground

Authorization

AdminCookie

Variables

Key

Value

project_id*

Samples

---

PUT wheel settings

PUT

/v1/admin/projects/{project_id}/wheels/settings

Authenticated project owner with verified 2FA. Simulation draws 10000 results and creates no award. Published weights are not in public views.

Authorizations

AdminCookie

HttpOnly сессия админки. Изменяющие запросы с cookie требуют допустимый Origin; Bearer — альтернатива.

Type

API Key (cookie: playflow_admin_session)

or

AdminBearer

Admin JWT from signup/login

Type

HTTP (bearer)

Parameters

Header Parameters

Origin*

Admin site origin for cookie writes; API origin for public writes

Type

string

Required

Path Parameters

project_id*

Type

string

Required

Request Body

application/json

{

  

"timezone": "string"

}

Responses

JSON response; see /integration/wheel

PUT

/v1/admin/projects/{project_id}/wheels/settings

Playground

Authorization

AdminCookie

Headers

Origin*

Variables

Key

Value

project_id*

Body

Samples

---

GET wheel draft

GET

/v1/admin/projects/{project_id}/wheels/{wheel_id}/draft

Authenticated project owner with verified 2FA. Simulation draws 10000 results and creates no award. Published weights are not in public views.

Authorizations

AdminCookie

HttpOnly сессия админки. Изменяющие запросы с cookie требуют допустимый Origin; Bearer — альтернатива.

Type

API Key (cookie: playflow_admin_session)

or

AdminBearer

Admin JWT from signup/login

Type

HTTP (bearer)

Parameters

Path Parameters

project_id*

Type

string

Required

wheel_id*

Type

string

Required

Valid values

"daily""site"

Responses

JSON response; see /integration/wheel

GET

/v1/admin/projects/{project_id}/wheels/{wheel_id}/draft

Playground

Authorization

AdminCookie

Variables

Key

Value

project_id*

wheel_id*

Samples

---

PUT wheel draft

PUT

/v1/admin/projects/{project_id}/wheels/{wheel_id}/draft

Authenticated project owner with verified 2FA. Simulation draws 10000 results and creates no award. Published weights are not in public views.

Authorizations

AdminCookie

HttpOnly сессия админки. Изменяющие запросы с cookie требуют допустимый Origin; Bearer — альтернатива.

Type

API Key (cookie: playflow_admin_session)

or

AdminBearer

Admin JWT from signup/login

Type

HTTP (bearer)

Parameters

Header Parameters

Origin*

Admin site origin for cookie writes; API origin for public writes

Type

string

Required

Path Parameters

project_id*

Type

string

Required

wheel_id*

Type

string

Required

Valid values

"daily""site"

Request Body

application/json

{

  

"free_spins_per_day": 0,

  

"max_spins_per_day": 0,

  

"ticket_cost": 0,

  

"segments": [

  

  

{

  

  

}

  

],

  

"rules": {

  

  

"text": "string",

  

  

"organizer": {

  

  

}

  

},

  

"budget_daily_minor": 0,

  

"budget_total_minor": 0

}

Responses

JSON response; see /integration/wheel

PUT

/v1/admin/projects/{project_id}/wheels/{wheel_id}/draft

Playground

Authorization

AdminCookie

Headers

Origin*

Variables

Key

Value

project_id*

wheel_id*

Body

Samples

---

POST wheel publish

POST

/v1/admin/projects/{project_id}/wheels/{wheel_id}/publish

Authenticated project owner with verified 2FA. Simulation draws 10000 results and creates no award. Published weights are not in public views.

Authorizations

AdminCookie

HttpOnly сессия админки. Изменяющие запросы с cookie требуют допустимый Origin; Bearer — альтернатива.

Type

API Key (cookie: playflow_admin_session)

or

AdminBearer

Admin JWT from signup/login

Type

HTTP (bearer)

Parameters

Header Parameters

Origin*

Admin site origin for cookie writes; API origin for public writes

Type

string

Required

Path Parameters

project_id*

Type

string

Required

wheel_id*

Type

string

Required

Valid values

"daily""site"

Request Body

application/json

{

  

"expected_draft_hash": "string"

}

Responses

JSON response; see /integration/wheel

POST

/v1/admin/projects/{project_id}/wheels/{wheel_id}/publish

Playground

Authorization

AdminCookie

Headers

Origin*

Variables

Key

Value

project_id*

wheel_id*

Body

Samples

---

POST wheel simulate

POST

/v1/admin/projects/{project_id}/wheels/{wheel_id}/simulate

Authenticated project owner with verified 2FA. Simulation draws 10000 results and creates no award. Published weights are not in public views.

Authorizations

AdminCookie

HttpOnly сессия админки. Изменяющие запросы с cookie требуют допустимый Origin; Bearer — альтернатива.

Type

API Key (cookie: playflow_admin_session)

or

AdminBearer

Admin JWT from signup/login

Type

HTTP (bearer)

Parameters

Header Parameters

Origin*

Admin site origin for cookie writes; API origin for public writes

Type

string

Required

Path Parameters

project_id*

Type

string

Required

wheel_id*

Type

string

Required

Valid values

"daily""site"

Responses

JSON response; see /integration/wheel

POST

/v1/admin/projects/{project_id}/wheels/{wheel_id}/simulate

Playground

Authorization

AdminCookie

Headers

Origin*

Variables

Key

Value

project_id*

wheel_id*

Samples

---

GET wheel stats

GET

/v1/admin/projects/{project_id}/wheels/{wheel_id}/stats

Authenticated project owner with verified 2FA. Simulation draws 10000 results and creates no award. Published weights are not in public views.

Authorizations

AdminCookie

HttpOnly сессия админки. Изменяющие запросы с cookie требуют допустимый Origin; Bearer — альтернатива.

Type

API Key (cookie: playflow_admin_session)

or

AdminBearer

Admin JWT from signup/login

Type

HTTP (bearer)

Parameters

Path Parameters

project_id*

Type

string

Required

wheel_id*

Type

string

Required

Valid values

"daily""site"

Responses

JSON response; see /integration/wheel

GET

/v1/admin/projects/{project_id}/wheels/{wheel_id}/stats

Playground

Authorization

AdminCookie

Variables

Key

Value

project_id*

wheel_id*

Samples

---

Powered by VitePress OpenAPI