Appearance
Get the operator-specific game settings
GET
/getOperatorSettings
Optional. Returns the operator-specific settings for a game / operator
/ currency combination — the same GameSettings structure the frontend
receives from /connect.
Unlike the other engine calls this is a GET with query parameters
and no body; it is still signed with the X-H-AUTH-* headers.
Authorizations
V2AuthId
Game provider ID assigned by hizi.io (Hinterzimmer). Identifies which
shared secret the signature must be verified against. Mandatory on
every game engine / RGS call.
Type
API Key (header: X-H-AUTH-ID)
V2Signature
HMAC signature of the request. OpenAPI cannot express a computed
signature, so the scheme is modelled as an apiKey header; the value
is derived per request as follows.
You need a shared secret, which you can retrieve by logging in to the
hizi.io backoffice with your credentials. The signature is a
base64-encoded SHA-256 HMAC digest of a defined set of request
parameters, joined with a hash character (#). This allows the secret
to be shared without ever being sent in the request. A timestamp
(X-H-TIMESTAMP) must also be supplied as a request header and is part
of the signed data.
Outbound (you → hizi.io RGS) — the fields signed are the
serialised JSON body and the timestamp:
X-H-AUTH-SIG = base64(
HMAC_SHA256( secret, [ JSON.stringify(body), X-H-TIMESTAMP ].join('#') )
)
See the Signing appendix for a complete
reference implementation.
Inbound (hizi.io RGS → your backendQueue) — same primitive, but
the RGS signs a fixed, per-endpoint ordered list of scalar fields
and the body is not hashed. The secret is used both as the HMAC key
and as the first element of the signed string:
X-H-AUTH-SIG = base64( HMAC_SHA256( secret, fields.join('#') ) )
| endpoint | fields (in order) |
|---|---|
GET /getGameConfiguration |
[ secret, X-H-AUTH-ID, X-H-TIMESTAMP, currency ] |
POST /getGameResult |
[ secret, X-H-AUTH-ID, X-H-TIMESTAMP, gameRound ] |
A wrong signature is reported as HTTP 401 / error code 1001
(SIGNATUREWRONG) and must not be retried.
The header family is shared with the Operator API, which documents the
same base64/SHA-256-HMAC/#-joined construction; the set of signed
fields differs per API and per direction, so do not assume a signer
written for one is reusable for the other without checking the field
list.
Type
API Key (header: X-H-AUTH-SIG)
V2Timestamp
ISO 8601 timestamp of the request (e.g. 2023-01-26T11:28:21.429Z).
Mandatory, and included in the signed data of X-H-AUTH-SIG.
Type
API Key (header: X-H-TIMESTAMP)
Parameters
Header Parameters
X-Request-Id*
Unique ID identifying the call in the logs. Documented as a mandatory
request header for all game engine / RGS calls.
Note: the reference implementation in the
Signing appendix additionally sets
X-Response-Id (a fresh UUID) and, when relaying a request,
X-Forwarded-Response-Id.
Type
Requiredstring
Example
"8c00b93dd861405cbeb7c14fded1e72a"Query Parameters
game*
Game identifier (as configured in the hizi.io backoffice).
Type
Requiredstring
Example
"f1252f6014084e1cbf5bb1982f911e0c-unk"operator*
Operator identifier.
Type
Requiredstring
Example
"000063d0ef400000000000000029-unk"currency*
ISO currency code the settings are requested for.
Type
Requiredstring
Example
"EUR"Responses
The operator-specific game settings.
application/json
JSON "autoplayEnabled": true, "autoplayLossLimitRequired": true, "displayCoins": true, "displayJackpotOdds": true, "displayRTP": true, "displayXRTP": true, "forceOrientation": 0, "gambleEnabled": true, "historyURL": "string", "homeURL": "string", "loadMsg": "string", "maxExposure": 0, "maxStake": 0, "maxPackageStake": 0, "minStake": 0, "minLoadTime": 0, "minSpinTime": 0, "multipleInstancesAllowed": true, "rcDisplayWinLoss": true, "rcEnabled": true, "rcInterval": 0, "stopEnabled": true, "topupURL": "string", "turboEnabled": true, "homeEnabled": true, "dynamicMinSpinTime": true, "redirectTarget": "string", "packageBuyEnabled": true, "defaultStakeIndex": 0, "operatorHandlesErrors": true, "displayClock": true, "isSocial": true, "displayCurrency": true, "customStakes": [ 0 ], "lossLimitURL": "string", "partialCollectEnabled": true, "hideCompanyLogo": true, "abbreviateAmounts": true, "showExactRTP": true, "jurisdiction": "string", "forceDefaultStake": true, "disableFullScreenMobile": true, "displayPaytableOnEnterGame": true, "doNotStoreSettings": [ "string" ], "sessionTimeoutInSeconds": 0, "displayNetPosition": true, "hideDemoBalance": true, "preventRedirect": true, "refreshDisabled": true, "displayWinOdds": [ "string" ], "displaySessionTimer": true, "skipWinsEqualToOrLessThanStake": true, "reportAnimationEnd": true, "launcherType": "string", "autoplayShowTotalStake": true, "translateErrors": true, "currencyToDisplay": "string"
{
}