Create a session

The credential id. Sent together with X-Timestamp, X-Nonce and X-Signature.

Base64 HMAC-SHA256 of the method, the path with its query, X-Timestamp, X-Nonce and the lowercase hex SHA-256 of the raw body, joined by newlines. Compared in constant time; 30 seconds of tolerance; each nonce is used once.

Unix seconds; within 30 seconds of the receiver's clock. Matches ^[0-9]{1,12}$.

Single use per credential, kept until the timestamp plus 30 seconds. At least 16 characters. At most 128 characters.

The client's own player id, at most 44 characters so that every provider can carry it namespaced. At least 1 character. At most 44 characters.

One of TRY, EUR, USD, USDT, TON, BTC, AED, AFN, ALL, AMD, AOA, ARS, AUD, AWG, AZN, BAM, BBD, BDT, BGN, BHD, BIF, BMD, BND, BOB, BOV, BRL, BSD, BTN, BWP, BYN, BZD, CAD, CDF, CHE, CHF, CHW, CLF, CLP, CNY, COP, COU, CRC, CUP, CVE, CZK, DJF, DKK, DOP, DZD, EGP, ERN, ETB, FJD, FKP, GBP, GEL, GHS, GIP, GMD, GNF, GTQ, GYD, HKD, HNL, HTG, HUF, IDR, ILS, INR, IQD, IRR, ISK, JMD, JOD, JPY, KES, KGS, KHR, KMF, KPW, KRW, KWD, KYD, KZT, LAK, LBP, LKR, LRD, LSL, LYD, MAD, MDL, MGA, MKD, MMK, MNT, MOP, MRU, MUR, MVR, MWK, MXN, MXV, MYR, MZN, NAD, NGN, NIO, NOK, NPR, NZD, OMR, PAB, PEN, PGK, PHP, PKR, PLN, PYG, QAR, RON, RSD, RUB, RWF, SAR, SBD, SCR, SDG, SEK, SGD, SHP, SLE, SOS, SRD, SSP, STN, SVC, SYP, SZL, THB, TJS, TMT, TND, TOP, TTD, TWD, TZS, UAH, UGX, USN, UYI, UYU, UYW, UZS, VED, VES, VND, VUV, WST, XAF, XCD, XCG, XOF, XPF, YER, ZAR, ZMW, ZWG.

A UUID v7.

ISO 639-1. Matches ^[a-z]{2}$.

ISO 3166-1 alpha-2. Matches ^[A-Z]{2}$.

One of desktop, mobile.

Where the game sends the player back: an https URL only. A javascript:, data: or http: URL is a 400 MALFORMED_REQUEST and is never sent to a provider. A URL that fails the raw-text check is also a 400 MALFORMED_REQUEST and never sent to a provider. The raw-text check fails on a non-ASCII host or a mixed-script xn-- label, user information, or an empty authority. It also fails on a space, a backslash or a control or invisible character, raw or percent-escaped. Cocktail receives it as its returnUrl and lobbyUrl, and as its depositUrl on a real launch without deposit_url. Matches ^https://.

The client's cashier, optional and checked like return_url. Cocktail receives it as depositUrl on a real launch. Cocktail requires a depositUrl there, so a real launch without one sends return_url in its place. The other providers' launch calls have no field for it, so they ignore it. Matches ^https://.

One of real, demo.

In SessionCreated. Null in demo mode.

In SessionCreated. The provider's game frame is handed on as the provider wrote it. This is an https URL that passes the same raw-text check as return_url. The URL has an ASCII host, no user information, and no control, invisible or backslash character, raw or percent-escaped. A provider answer that fails it is a 502 INTERNAL_ERROR, never repaired. Matches ^https://.

In SessionCreated. Null in demo mode.

In SportsbookSessionCreated.

In SportsbookSessionCreated. This is BSW's frame bootstrap data. Load both scripts, then boot the frame in the element container_id with server, token, sport_partner and language (SportFrame.frame on desktop, Bootstrapper.bootIframe on mobile).

In SportsbookSessionCreated. The frame's server, BSW's frame domain. Matches ^https://.

In SportsbookSessionCreated. Exactly two scripts: the integration loader and the bootstrapper, loaded in this order (the server's contract holds the pair as a tuple). Each item: matches ^https://.

In SportsbookSessionCreated. The aggregator's sportPartner at BSW.

In SportsbookSessionCreated. BSW's one-time token from /api/front/token for this launch; a credential, never logged. At least 1 character.

In SportsbookSessionCreated. One of desktop, mobile.

In SportsbookSessionCreated. The element the frame boots in: sport_div_iframe on desktop, application-container on mobile. One of sport_div_iframe, application-container.

In SportsbookSessionCreated. The request's language, as the client sent it.

In SportsbookSessionCreated.

MALFORMED_REQUEST: a body, query or path value fails its schema.

UNAUTHORIZED: a missing or wrong key, signature, timestamp or nonce.

NOT_FOUND: an unknown id, another client's id or an unknown path; one body for every 404.

A launch is refused before any session is written or any provider is called. CURRENCY_NOT_SUPPORTED is sent when the provider or the client cannot serve the currency. DEMO_NOT_SUPPORTED is sent when the game has no demo mode. COUNTRY_RESTRICTED is sent when the request's country is one the sportsbook may not serve.

A launch is refused before any session is written or any provider is called. CURRENCY_NOT_SUPPORTED is sent when the provider or the client cannot serve the currency. DEMO_NOT_SUPPORTED is sent when the game has no demo mode. COUNTRY_RESTRICTED is sent when the request's country is one the sportsbook may not serve.

A launch is refused before any session is written or any provider is called. CURRENCY_NOT_SUPPORTED is sent when the provider or the client cannot serve the currency. DEMO_NOT_SUPPORTED is sent when the game has no demo mode. COUNTRY_RESTRICTED is sent when the request's country is one the sportsbook may not serve.

INTERNAL_ERROR: the provider failed to answer.