Developers

Public API v1

Server-to-server REST API. Brauzerdan kalit ishlatilmasin. CORS yo‘q.

Base URL

https://c4304.coresuz.ru/api/v1

Autentifikatsiya

Tavsiya: HMAC — X-API-KEY, X-API-SECRET, X-Timestamp (unix), X-Signature = HMAC-SHA256(secret, timestamp + METHOD + path + body), ±5 daqiqa. Oddiy rejim: faqat Key + Secret headerlari ham qabul qilinadi.

Secret faqat yaratilganda bir marta ko‘rsatiladi; bazada faqat hash/encrypted.

Endpointlar

  • GET /health — auth yo‘q
  • GET /games — katalog (ETag, 45s cache)
  • GET /balance
  • POST /check-player — {package_id|game_id, player_id, server_id?}
  • POST /orders — Idempotency-Key (UUID) majburiy
  • GET /orders — ro‘yxat
  • GET /orders/{id}

cURL misol

curl -sS -X POST "https://DOMAIN/api/v1/orders" \
  -H "Content-Type: application/json" \
  -H "X-API-KEY: psk_live_..." \
  -H "X-API-SECRET: pss_..." \
  -H "Idempotency-Key: $(uuidgen)" \
  -d '{"package_id":123,"player_id":"PLAYER","reference":"my-1"}'

Javob formati

{"status":"success","data":{...},"request_id":"..."}
{"status":"error","error":{"code":"insufficient_balance","message":"..."},"request_id":"..."}

Asosiy xato kodlari: unauthorized, forbidden, rate_limited, insufficient_balance, validation_error, idempotency_conflict, price_changed, not_found, provider_rejected, server_error

Webhook

Holat o‘zgarganda HTTPS POST. Sarlavhalar: webhook-id, webhook-timestamp, webhook-signature (Standard Webhooks: v1,base64(hmac)). Qayta urinish: 1m → 5m → 30m → 2h → 6h → 24h.

OpenAPI JSON