Appearance
Get a game launch URL for a player and game
POST
/getGameURL
Creates the sessions needed to play and returns a URL the player should be directed to (typically in an iframe). The returned URL may only be called once and within 60 seconds; if the game has to be reloaded, or the URL was not used in time, request a new one.
If the playerId is unknown it is registered with an implicit registerPlayer call. If playerdetails are passed, the existing record is updated with those values.
Games can be launched in three modes: REAL (real money, the operator wallet API is used for debits and credits), DEMO (fun mode — no calls to the operator API are made and rounds are not recorded) and HISTORY (replay of a previously played real-money round given in gameround).
Fields to sign (in order): secret, X-H-AUTH-ID, X-H-TIMESTAMP, playerId (if present), currency, gameCode, mode.
Authorizations
hiziAuthId
Operator ID. Sent on every request in both directions, and part of every signature.
Type
API Key (header: X-H-AUTH-ID)
hiziAuthSignature
Signature of the request, sent on every request in both directions.
OpenAPI cannot express an HMAC-over-computed-string scheme natively, so this is modelled as an apiKey header. The value is not a static key: it is the base64-encoded SHA-256 HMAC digest of a defined, ordered set of request fields joined with a hash character (#).
The first three fields are always the shared secret, the X-H-AUTH-ID header and the X-H-TIMESTAMP header; the remaining fields differ per operation and are listed in each operation's description under "Fields to sign". For doTransactions the per- transaction hashes (and non-zero amounts) are appended in exactly the order the transactions appear in the payload.
The secret is retrieved by logging in to the hizi.io backoffice, which also provides sample implementations. Including the timestamp in the signature is what makes it safe to share the secret without ever sending it.
Type
API Key (header: X-H-AUTH-SIG)
hiziTimestamp
ISO 8601 timestamp of the request (UTC recommended, e.g. 2020-01-21T14:48:04Z). Sent on every request in both directions and always included in the signature.
Type
API Key (header: X-H-TIMESTAMP)
Request Body
application/json
JSON "playerId": "sampleplayer", "currency": "GBP", "gameCode": "testgame", "language": "en", "mode": "real", "playerdetails": { "country": "GB" }, "profile": "jurisidiction-de,customProfileName", "options": { "homeURL": "https://myhome.com/example" }
{
}
Responses
Launch URL created.
application/json
JSON "url": "string", "isNew": true, "internalPlayerId": "string", "errorCode": { "id": 1, "msg": "player id unknown", "clientmsg": "You reached your daily betting limit!" }
{
}