hizi docs

Appearance

Echo a test payload to verify communication and payload signature​

POST
/testPing

Optional. Sends a test payload to the API and gets it back in
testDataReceived. Useful to verify basic communication and that your
payload signature is computed correctly.

Authorizations​

V2AuthId

Game provider ID assigned by hizi.io (Hinterzimmer). Identifies which
shared secret the signature must be verified against. Mandatory on
every game engine / RGS call.

Type
API Key (header: X-H-AUTH-ID)
+
V2Signature

HMAC signature of the request. OpenAPI cannot express a computed
signature, so the scheme is modelled as an apiKey header; the value
is derived per request as follows.

You need a shared secret, which you can retrieve by logging in to the
hizi.io backoffice with your credentials. The signature is a
base64-encoded SHA-256 HMAC digest of a defined set of request
parameters, joined with a hash character (#). This allows the secret
to be shared without ever being sent in the request. A timestamp
(X-H-TIMESTAMP) must also be supplied as a request header and is part
of the signed data.

Outbound (you → hizi.io RGS) — the fields signed are the
serialised JSON body and the timestamp:

X-H-AUTH-SIG = base64(
  HMAC_SHA256( secret, [ JSON.stringify(body), X-H-TIMESTAMP ].join('#') )
)

See the Signing appendix for a complete
reference implementation.

Inbound (hizi.io RGS → your backendQueue) — same primitive, but
the RGS signs a fixed, per-endpoint ordered list of scalar fields
and the body is not hashed. The secret is used both as the HMAC key
and as the first element of the signed string:

X-H-AUTH-SIG = base64( HMAC_SHA256( secret, fields.join('#') ) )
endpoint fields (in order)
GET /getGameConfiguration [ secret, X-H-AUTH-ID, X-H-TIMESTAMP, currency ]
POST /getGameResult [ secret, X-H-AUTH-ID, X-H-TIMESTAMP, gameRound ]

A wrong signature is reported as HTTP 401 / error code 1001
(SIGNATUREWRONG) and must not be retried.

The header family is shared with the Operator API, which documents the
same base64/SHA-256-HMAC/#-joined construction; the set of signed
fields differs per API and per direction, so do not assume a signer
written for one is reusable for the other without checking the field
list.

Type
API Key (header: X-H-AUTH-SIG)
+
V2Timestamp

ISO 8601 timestamp of the request (e.g. 2023-01-26T11:28:21.429Z).
Mandatory, and included in the signed data of X-H-AUTH-SIG.

Type
API Key (header: X-H-TIMESTAMP)

Parameters​

Header Parameters

X-Request-Id*

Unique ID identifying the call in the logs. Documented as a mandatory
request header for all game engine / RGS calls.

Note: the reference implementation in the
Signing appendix additionally sets
X-Response-Id (a fresh UUID) and, when relaying a request,
X-Forwarded-Response-Id.

Type
string
Required
Example"8c00b93dd861405cbeb7c14fded1e72a"

Request Body​

application/json
JSON
{
  
"testData": "string"
}

Responses​

The testData sent, proxied back in testDataReceived.

application/json
JSON
{
  
"testDataReceived": "string",
  
"additionalProperties": "string"
}

Samples​

Powered by VitePress OpenAPI