Conventions

This page describes the formats, units, and limits that apply to all Operator API requests and wallet callbacks.

Base URL and version

{API_BASE}/operator/v1/...

• {API_BASE} differs per environment (Integration Process and Environments).
• The version is indicated by v1 in the path.
• Fields may be added to responses. Implement your client so that it ignores unknown fields.
• Every request must be signed.

Request and response format

• Bodies are JSON with UTF-8 character encoding. Include Content-Type: application/json; charset=utf-8 on requests.
• Send query values percent-encoded. Sign with the encoded string as is (Authentication and Signing).
• A successful response is one of 200 (read, update), 201 (create), or 204 (no content). Each endpoint defines which one it uses.
• Write requests that change management settings (except the game launch POST /launch) return an audit record number (integer) in the X-Audit-Id response header. You can use this number to query or revert the change in the audit log.

Optional header X-Operator-Admin

When sending an action performed by an administrator in the operator's management screen through the API, you can include that administrator's ID in the X-Operator-Admin header (letters, digits, _ . @ -; 1–40 characters). The actor in the audit log is then recorded as operator:<operator code>/<ID>. It does not affect permissions and is not part of the signature.

Amounts

• All amounts are integers in the currency's minor unit. Decimals (floating point) are not used.
• Check the decimal places (exponent) for each currency with GET /currencies. Minor-unit amount = display amount × 10^exponent.

Currency	exponent	Display amount	API amount
PHP	2	₱50.00	5000
USD	2	$12.34	1234
KRW	0	₩10,000	10000

• The operator wallet must also return balances (balance) in the same minor unit.
• Limit values set by the operator, such as bet limits and table limits, are accepted only as multiples of 1 unit (10^exponent). Example: for PHP, in units of 100 (₱1).
• Amounts are 64-bit integers. Use a 64-bit integer type such as BIGINT for storage columns, and when handling them as a JavaScript Number, make sure they do not exceed the safe integer range (2⁵³−1).

Time

Location	Format	Example
expires_at in the POST /launch response, created_at in the wallet callback body	UTC, fixed 3-digit milliseconds	2026-10-19T03:21:07.512Z
Other response timestamps	RFC 3339. The number of fractional-second digits varies, and the time zone offset may be something other than Z	2026-10-19T02:10:00.123456Z, 2026-10-19T11:57:40.1+08:00
X-Timestamp header	Unix epoch milliseconds	1760000000000

• Do not compare response timestamps as strings; parse them with an RFC 3339 parser, including the offset.

Date-range query from / to

Date-range parameters for history and report queries follow common rules.

Rule	Details
Format	RFC 3339 (2026-10-01T00:00:00+08:00) or a date (2026-10-01, interpreted as 00:00 UTC)
Range	[from, to) — from inclusive, to exclusive
Defaults	If to is omitted, now (UTC); if from is omitted, 24 hours before to

Invalid formats fall back to the defaults

If from or to cannot be parsed, the default is used without an error. If you do not encode the + in the offset (+08:00 → a space), parsing fails, so encode it like %2B08%3A00. If the resulting range is not what you expected, check the encoding first.

IDs

ID	Format	Example
Player	pl_ + 32 lowercase hex characters	pl_0192f3a1c4e87b2c9d0e1f2a3b4c5d6e
Table	tbl_ + 32 hex characters	tbl_0192f3a1c4e87b2c9d0e1f2a3b4c5d70
Round	rnd_ + 32 hex characters	rnd_0192f3a1c4e87b2c9d0e1f2a3b4c5d71
Table session	tss_ + 32 hex characters	tss_0192f3a1c4e87b2c9d0e1f2a3b4c5d72
Wallet transaction	tx_ + 32 hex characters	tx_0192f3a1c4e87b2c9d0e1f2a3b4c5d6e
Private reservation	prv_ + 32 hex characters	prv_0192f3a1c4e87b2c9d0e1f2a3b4c5d73
Dealer	UUID string without a prefix	0192f3a1-c4e8-7b2c-9d0e-1f2a3b4c5d74
Audit log entry	Integer	812

• Treat IDs as opaque strings. Do not parse their format or use them as a sort key (some IDs are not time-ordered).
• When storing them, allow up to 64 characters.
• The player external_id is a value set by the operator (1–64 bytes), and the platform returns it unchanged.

Pagination

List APIs use one of the following methods depending on the endpoint.

Method	Used by	Request	Response
Cursor	GET /rounds, GET /transactions	limit, cursor	next_cursor — pass it unchanged as cursor in the next page request. null when there are no more pages
Offset	GET /credit	limit, offset	(no next-page indicator — if fewer rows than limit are returned, you have reached the end)
Offset	GET /dealer-card-log	limit, offset	has_more
Page number	GET /audit	limit, page (starting at 1)	has_more

• The default limit is 100 and the maximum is 500 (GET /credit defaults to 50). Values above 500 are reduced to 500.
• With cursor pagination, when requesting the next page you must send the same filter and sort parameters as the first request. Do not rely on the format of the cursor value.

Error responses

The Operator API reports errors with an HTTP status code and the body below.

{
  "error": {
    "code": "INVALID_REQUEST",
    "message": "invalid fields",
    "details": { "fields": ["player.nickname"] }
  }
}

Field	Type	Description
error.code	string	Machine-readable error code. Branch your logic on this value.
error.message	string	A short human-readable description (in English). It may change, so do not branch on it.
error.details	object	Present only for some errors. For input field errors, details.fields contains the list of invalid field names.

For the full list of error codes, see Error Codes.

Wallet callbacks are different

Wallet callback responses must return even errors as HTTP 200 + a status in the body. See the Wallet Callbacks overview.

Request size and rate limits

Item	Value	When exceeded
Request body	64KB (768KB for PUT /lobby-banners only)	Only up to the limit is read before the signature is verified, resulting in 401 INVALID_SIGNATURE
Request count	200 requests per second per operator (fixed 1-second window, summed across all endpoints)	429 RATE_LIMITED

• If you receive 429, wait briefly and resend. When resending, generate a new timestamp, nonce, and signature.
• When collecting a list in bulk, use limit=500 to reduce the number of pages.

Idempotency

• Reads (GET) are safe to send any number of times.
• Operator API write requests have no idempotency key. Resending the same request processes it again. For example, POST /launch creates a new launch token on every call, and POST /tables creates a new table on every call. If a write request times out, check the result with a read API first before resending. A PUT that overwrites a setting in its entirety produces the same result when resent with the same values.
• Wallet callbacks must be idempotent by tx_id. The platform retries the same transaction with the same tx_id and the same body, so the operator must return the same response as the first time for a tx_id it has already processed. See the Wallet Callbacks overview.