Porq Game exposes every wired provider behind one REST API. You bring an operator launch URL per session; the aggregator runs that provider's real client bootstrap and translates your calls into its native protocol.
Base URL: https://game.porq.site/api/v1
Every API call needs an API key in the x-api-key header. Keys are issued by the operator from the aggregator admin and are shown once at creation — store yours like a password.
curl https://game.porq.site/api/v1/providers -H "x-api-key: pq_live_…"
| Endpoint | Description |
|---|---|
| GET /api/v1/providers | List all providers in the gateway registry, with wiring tier, transport, live-fire state and known blockers. |
| POST /api/v1/{provider}/session | Open a session from an operator launch URL. Runs the provider client's own bootstrap (auth, session init, startup reads). Returns a session id used by every other call. |
| GET /api/v1/{provider}/balance?session= | Read the session balance (read-only). |
| GET /api/v1/{provider}/history?session= | Read bet history / results where the provider evidences it. Extra query params are forwarded as the provider's history filter (e.g. currentDate, startDate, endDate for creedroomz). |
| POST /api/v1/{provider}/bet | Build (and, only in live-fire mode, send) a bet. Body: { "session": "…", "bet": { …provider-shaped bet… } }. The bet object's fields are the provider client's own — see the provider notes. |
| POST /api/v1/{provider}/cashout | Cash out an open bet where the provider supports it. Body: { "session": "…", … } with the provider's cashout fields. |
| GET /api/v1/upstream/games | The upstream panel's playable catalogue, synced by the backend keeper and grouped by provider (panel group names mapped to aggregator provider ids where they correspond). Each game carries the gameId the session endpoint needs. |
| POST /api/v1/upstream/session | Mint a fresh launch on the operator's upstream panel account and open it as a session in the standalone gateway. Body: { "provider": "creedroomz", "gameId": "375095" } → { gatewaySession, launchUrl, player, balance, balanceSource, game, mode }. The balance is read back through the gateway adapter (balanceSource: "gateway"), falling back to the panel wallet only if the adapter read fails. Providers with no standalone adapter return mode: "panel-direct" with the bare launch URL. The wallet the game opens with is the upstream account's own panel balance. |
Create a session — the launch URL is the operator-issued game URL for your player; it carries the session credentials, so treat it as a secret.
curl -X POST https://game.porq.site/api/v1/creedroomz/session \
-H "x-api-key: pq_live_…" -H "content-type: application/json" \
-d '{"launchUrl":"https://games.example/authorization.php?…"}'
→ 200
{
"session": "creedroomz-1",
"provider": "creedroomz",
"summary": { "ok": true, "partnerId": 18760475, "tableId": 3403,
"gameId": 144, "currency": "INR", "hasSessionToken": true }
}
Balance
curl "https://game.porq.site/api/v1/creedroomz/balance?session=creedroomz-1" \
-H "x-api-key: pq_live_…"
→ 200 { "balance": 1000.00, "currency": "INR" }
Place a bet (dry-run receipt)
curl -X POST https://game.porq.site/api/v1/crashlive/bet \
-H "x-api-key: pq_live_…" -H "content-type: application/json" \
-d '{"session":"crashlive-1","bet":{ "…": "provider-shaped fields" }}'
→ 200 { "fired": false, "dryRun": true, "request": { …exact provider payload… } }
| HTTP | Shape | Meaning |
|---|---|---|
| 401 | {"error":"invalid or missing API key"} | No x-api-key header, or the key is unknown / revoked. |
| 400 | {"error":"invalid JSON body"} | Request body was not valid JSON. |
| 404 | {"error":"provider 'x' not wired"} | Unknown provider id. |
| 404 | {"error":"unknown session"} | Session id not found (expired, restarted service, or wrong provider). |
| 502 | {"error":"gateway unreachable"} | The internal provider gateway is down; the aggregator restarts it automatically. |
| 4xx/5xx | {"error":"…","code":"…"} | Provider/gateway errors pass through with their message and code. A code of EvidenceGap means the requested operation is not honestly wireable yet for that provider — the message names the exact missing evidence. |
| Provider | Status | Notes |
|---|---|---|
| Turbodiscovery turbodiscovery | Fully wired | JWT session flow proven end-to-end (settings → profile → JWT → history). Sessions need a fresh operator token; the sample token is expired. The provider 403s some datacenter egress IPs. |
| CrashLive crashlive | Fully wired | AviatorX + K3. Bet payloads are ECDH P-256 → AES-256-GCM encrypted exactly as the client does; cashout is a WebSocket frame. Sessions expire — bring a fresh launch URL per session. |
| Mac88 mac88 | Fully wired | Same encrypted placebet-enc channel as CrashLive. Bets need caller-supplied windowType / betMarketInfo. There is no cashout — settlement is server-side. |
| BetGames betgames | Fully wired | Auth chain, single / subscription / batch bet builders wired. Cashout is expressed as a bet field, not a separate call. |
| CreedRoomz creedroomz | Fully wired | Live-casino hub over socket.io (EIO3). Session open + balance + history proven live; DoBet envelope built for 47 games. Fun launches create anonymous spectator sessions (no wallet); real mode needs an operator token launch. |
| Aura Gaming auragaming | Fully wired | Legacy /order/ bets plus originals placeBet / cashOut / autocashout builders wired. Heads-up: the provider-side operator auth endpoint was returning 503 on 2026-11-02; originals also need a browser fingerprintId. |
| RoyalAdmin royaladmin | Partially wired | Bootstrap, balance and reads wired. Bet placement is not live: the placebet endpoint exists but the betslip entry schema was never captured, so the gateway refuses to invent it. |
| Spribe spribe | Partially wired | SmartFoxServer request envelopes are built and test-matched, but the binary codec send path is not implemented — session reads work via app-config, bet fire raises a named gap. |
| LiveTables livetables | Partially wired | Auth chain and history wired. The bet frame lives behind a successful authenticate and has never been observed, so it is not fabricated. |
| Evolution (via Luckplay) luckplay | Partially wired | Launch chain and cookie session wired across all 205 Evolution apps. Bets are per-app socket messages (no single pinned frame yet) and balance is operator-side seamless, so balance/bet return gaps rather than guesses. |
| BD33 bd33fgabh | Blocked — needs unlock | Blocked: the bet layer sits inside the VM-obfuscated "Astarte" bundle. Needs one runtime browser capture of a live session before anything can be wired honestly. |
| QueenMaker queenmaker | Blocked — needs unlock | Blocked: the sample launch token was consumed server-side ("Unable to grab player"). Needs a fresh launch URL from the operator. |
| FH8 Labs fh8labs | Blocked — needs unlock | Blocked: server-side launcher only — the encrypted launch payload returns HTTP 500 from both egresses tried. Needs a fresh click-time launch URL. |