Redirect2U Operator API (1.0.0)

This API suite provides a unified and standardized interface for accessing multiple game provider platforms through a single integration.

Instead of integrating with each game provider individually (each with their own authentication, request formats, and error handling), this platform aggregates and normalizes all supported game provider APIs into one consistent API specification.

All endpoints in this API suite:

• Use HTTP POST

• Accept JSON request bodies

• Require HMAC-based authentication

• Return a standardized response format

All requests must be authenticated using API Key + HMAC Signature.

Required Request Headers

Each request must include a valid Signature header.

Signature Algorithm

The signature is generated using HMAC-SHA256 and Base64 encoding.

Message Composition Order

message = raw_request_body + request_path + timestamp

Where:

• raw_request_body = exact raw JSON payload (no formatting changes)

• request_path = full request URL path (including query string if any)

• timestamp = value of the Timestamp request header

PHP (Yii2) Example

$data = \Yii::$app->request->getRawBody();
$path = \Yii::$app->request->url;
$timestamp = \Yii::$app->request->headers->get('Timestamp');
$message = $data . $path . $timestamp;
$expected_signature = base64_encode(
    hash_hmac('sha256', $message, $secret, true)
);

The generated value must be sent in the Signature header.

• Requests are time-sensitive.

• Requests with timestamps outside the allowed time window will be rejected.

• Ensure server clocks are synchronized (NTP recommended).

• HTTP Method: POST only

• Content-Type: application/json

• Body: JSON object (may be empty {} for some endpoints)

• Character Encoding: UTF-8

• Raw Body Integrity: Any modification (whitespace, formatting, ordering) after signature generation will invalidate the request.

All API responses follow the same structure:

{
  "code": 0,
  "message": "Success",
  "data": {}
}

Response Fields

Note:
Even when HTTP status is 200, the request may still fail logically. Always check the code field.

400 – Bad Request

403 – Forbidden

405 – Method Not Allowed

500 – Internal Server Error

• Incorrect raw request body used during signature generation

• Mismatch between request URL path and signed path

• Timestamp drift between client and server

• Invalid or inactive API key

• Incorrect secret key

• Always generate the signature after constructing the final request body

• Do not pretty-print or re-encode JSON after signing

• Use server-side time for timestamp generation

• Log full request data when debugging signature issues (excluding secrets)