Skip to main content
These rules apply to both API surfaces. They are short, and every one of them is checked during certification.

​
Transport

HTTPS with a valid certificate

Both directions. A self-signed or expired certificate on your callback host fails the integration outright.

JSON only

Content-Type: application/json is the only accepted content type for request bodies. Nothing else is processed.

RESTful paths

Resource paths, HTTP verbs and status codes carry meaning. See Errors and retries.

Signed, every call

No exceptions, in either direction. See Request signature.

​
Timestamps

All timestamps in request and response bodies use ISO-8601 in UTC:
X-Zd-Timestamp is the exception: it is Unix time in milliseconds, not ISO-8601. Two different formats, two different jobs — one for data, one for replay protection.
Always send UTC. A local-time offset in a body field is treated as a bad request.

​
Currencies

Currency codes follow ISO-4217 — EUR, USD, BTC, ETH — and crypto codes use the same convention. The virtual FUN currency is reserved for free-to-play sessions and never reaches your wallet. How amounts are represented, and the exact precision per crypto asset, is covered in Amounts and currencies.

​
Caching and performance

Every Customer API response carries:
Send them back and skip the payload when nothing has changed:
The game catalogue is the payload that matters here — it is large, it carries every artwork URL, and it changes rarely. Poll it on a schedule with If-None-Match rather than fetching it on every page render, and store the ETag next to your cached copy.
Conditional requests are still signed like any other request. A GET with no query string signs path\|timestamp\| — the conditional headers are not part of the signed data.

​
Error shape

Wherever an error can carry an explanation, use this body:
Concrete messages are worth real time during certification and incident response. "error" tells nobody anything; "currency mismatch: campaign is USD, player is EUR" closes the ticket.