You build these
GET /player · POST /debit · POST /credit · POST /rollback · GET /players/{accountId}/transactions/{transactionId}/zerodash/v1 is fine, as long as you verify against the same value.
Authentication
Every inbound request carries:Endpoints
Player authorization
GET /player — validate the token, return identity and balance.Debit
POST /debit — subtract the stake when a bet is placed.Credit
POST /credit — add the payout and settle the bet.Rollback
POST /rollback — cancel a bet and return the stake.Get transaction
GET /players/…/transactions/… — report the state of one transaction.Read first
These four pages cover the rules certification actually tests. Skipping them costs more time than reading them.Wallet integration
The round contract, and the four rules that break integrations.
Amounts and currencies
Decimals on the wire and per-asset precision.
Idempotency
The same
transactionId must apply exactly once.Errors and retries
Why
422 and 500 are not interchangeable.The short version
A loss still sends a credit
payout.amount of 0. Return 200 OK.Settlements outlive sessions
Credit and rollback carry no token and are retried for 3 days.
Free rounds debit zero
Deduct nothing, still create the transaction.
Balance is post-movement
Return the balance after the operation, never before.