API documentation

Porq Game exposes every wired provider behind one REST API. You bring an operator launch URL per session; the aggregator runs that provider's real client bootstrap and translates your calls into its native protocol.

Base URL & authentication

Base URL: https://game.porq.site/api/v1

Every API call needs an API key in the x-api-key header. Keys are issued by the operator from the aggregator admin and are shown once at creation — store yours like a password.

curl https://game.porq.site/api/v1/providers -H "x-api-key: pq_live_…"
Dry-run by default: bet and cashout calls build the exact provider request and return it as a receipt — nothing is sent to the provider — unless the operator has explicitly enabled live fire in the aggregator admin. A receipt always tells you which mode it was produced in ("fired": false for dry-run).

Endpoints

EndpointDescription
GET /api/v1/providersList all providers in the gateway registry, with wiring tier, transport, live-fire state and known blockers.
POST /api/v1/{provider}/sessionOpen a session from an operator launch URL. Runs the provider client's own bootstrap (auth, session init, startup reads). Returns a session id used by every other call.
GET /api/v1/{provider}/balance?session=Read the session balance (read-only).
GET /api/v1/{provider}/history?session=Read bet history / results where the provider evidences it. Extra query params are forwarded as the provider's history filter (e.g. currentDate, startDate, endDate for creedroomz).
POST /api/v1/{provider}/betBuild (and, only in live-fire mode, send) a bet. Body: { "session": "…", "bet": { …provider-shaped bet… } }. The bet object's fields are the provider client's own — see the provider notes.
POST /api/v1/{provider}/cashoutCash out an open bet where the provider supports it. Body: { "session": "…", … } with the provider's cashout fields.
GET /api/v1/upstream/gamesThe upstream panel's playable catalogue, synced by the backend keeper and grouped by provider (panel group names mapped to aggregator provider ids where they correspond). Each game carries the gameId the session endpoint needs.
POST /api/v1/upstream/sessionMint a fresh launch on the operator's upstream panel account and open it as a session in the standalone gateway. Body: { "provider": "creedroomz", "gameId": "375095" } → { gatewaySession, launchUrl, player, balance, balanceSource, game, mode }. The balance is read back through the gateway adapter (balanceSource: "gateway"), falling back to the panel wallet only if the adapter read fails. Providers with no standalone adapter return mode: "panel-direct" with the bare launch URL. The wallet the game opens with is the upstream account's own panel balance.

Examples

Create a session — the launch URL is the operator-issued game URL for your player; it carries the session credentials, so treat it as a secret.

curl -X POST https://game.porq.site/api/v1/creedroomz/session \
  -H "x-api-key: pq_live_…" -H "content-type: application/json" \
  -d '{"launchUrl":"https://games.example/authorization.php?…"}'

→ 200
{
  "session": "creedroomz-1",
  "provider": "creedroomz",
  "summary": { "ok": true, "partnerId": 18760475, "tableId": 3403,
               "gameId": 144, "currency": "INR", "hasSessionToken": true }
}

Balance

curl "https://game.porq.site/api/v1/creedroomz/balance?session=creedroomz-1" \
  -H "x-api-key: pq_live_…"

→ 200   { "balance": 1000.00, "currency": "INR" }

Place a bet (dry-run receipt)

curl -X POST https://game.porq.site/api/v1/crashlive/bet \
  -H "x-api-key: pq_live_…" -H "content-type: application/json" \
  -d '{"session":"crashlive-1","bet":{ "…": "provider-shaped fields" }}'

→ 200   { "fired": false, "dryRun": true, "request": { …exact provider payload… } }

Sessions & launch URLs

Errors

HTTPShapeMeaning
401{"error":"invalid or missing API key"}No x-api-key header, or the key is unknown / revoked.
400{"error":"invalid JSON body"}Request body was not valid JSON.
404{"error":"provider 'x' not wired"}Unknown provider id.
404{"error":"unknown session"}Session id not found (expired, restarted service, or wrong provider).
502{"error":"gateway unreachable"}The internal provider gateway is down; the aggregator restarts it automatically.
4xx/5xx{"error":"…","code":"…"}Provider/gateway errors pass through with their message and code. A code of EvidenceGap means the requested operation is not honestly wireable yet for that provider — the message names the exact missing evidence.

Providers — status & notes

ProviderStatusNotes
Turbodiscovery
turbodiscovery
Fully wiredJWT session flow proven end-to-end (settings → profile → JWT → history). Sessions need a fresh operator token; the sample token is expired. The provider 403s some datacenter egress IPs.
CrashLive
crashlive
Fully wiredAviatorX + K3. Bet payloads are ECDH P-256 → AES-256-GCM encrypted exactly as the client does; cashout is a WebSocket frame. Sessions expire — bring a fresh launch URL per session.
Mac88
mac88
Fully wiredSame encrypted placebet-enc channel as CrashLive. Bets need caller-supplied windowType / betMarketInfo. There is no cashout — settlement is server-side.
BetGames
betgames
Fully wiredAuth chain, single / subscription / batch bet builders wired. Cashout is expressed as a bet field, not a separate call.
CreedRoomz
creedroomz
Fully wiredLive-casino hub over socket.io (EIO3). Session open + balance + history proven live; DoBet envelope built for 47 games. Fun launches create anonymous spectator sessions (no wallet); real mode needs an operator token launch.
Aura Gaming
auragaming
Fully wiredLegacy /order/ bets plus originals placeBet / cashOut / autocashout builders wired. Heads-up: the provider-side operator auth endpoint was returning 503 on 2026-11-02; originals also need a browser fingerprintId.
RoyalAdmin
royaladmin
Partially wiredBootstrap, balance and reads wired. Bet placement is not live: the placebet endpoint exists but the betslip entry schema was never captured, so the gateway refuses to invent it.
Spribe
spribe
Partially wiredSmartFoxServer request envelopes are built and test-matched, but the binary codec send path is not implemented — session reads work via app-config, bet fire raises a named gap.
LiveTables
livetables
Partially wiredAuth chain and history wired. The bet frame lives behind a successful authenticate and has never been observed, so it is not fabricated.
Evolution (via Luckplay)
luckplay
Partially wiredLaunch chain and cookie session wired across all 205 Evolution apps. Bets are per-app socket messages (no single pinned frame yet) and balance is operator-side seamless, so balance/bet return gaps rather than guesses.
BD33
bd33fgabh
Blocked — needs unlockBlocked: the bet layer sits inside the VM-obfuscated "Astarte" bundle. Needs one runtime browser capture of a live session before anything can be wired honestly.
QueenMaker
queenmaker
Blocked — needs unlockBlocked: the sample launch token was consumed server-side ("Unable to grab player"). Needs a fresh launch URL from the operator.
FH8 Labs
fh8labs
Blocked — needs unlockBlocked: server-side launcher only — the encrypted launch payload returns HTTP 500 from both egresses tried. Needs a fresh click-time launch URL.