REST API

This document provides comprehensive documentation for all REST API endpoints in the Poker Engine platform.

Base URL: /api/v1 (paths below omit this prefix). Exceptions: /health and /metrics are also served at the root, and the wallet callback is under /api/wallet/v1.

Total Endpoints: 899

The Auth column in route tables uses: Public (no login), Optional (login enriches the response), User (any logged-in user), Agent (agent account with the relevant agent permission), Developer key (partner API key with request signature), Admin and Super admin (permission level a1 and a; per-feature levels can be overridden by the user group). toggle names a feature toggle that must be enabled.

Table of Contents

1. Authentication
2. Response Format
3. Error Codes
4. Auth Routes
5. Health Routes
6. Metrics Routes
7. Analytics Routes
8. Lobby Routes
9. Private Games Routes
10. Tournament Routes
11. Cashier Routes
12. User Routes
13. Account Routes
14. Statistics and Leaderboard Routes
15. Config, Pages and App Routes
16. Tickets and Devices Routes
17. Agent Routes
18. Developer Routes
19. Webhook Routes
20. Wallet Routes
21. Debug Routes
22. Admin Routes
23. Rate Limiting

Authentication

Most endpoints require JWT authentication. Browser clients normally authenticate with HttpOnly access_token and refresh_token cookies set by the auth routes. The cookie is checked first; API clients may instead send the access token in the Authorization header:

Authorization: Bearer <access_token>

Token Lifecycle

1. Login → Receive HttpOnly access_token and refresh_token cookies
2. Access Token → Valid for 15 minutes
3. Refresh Token → Valid for 1 day
4. Refresh → Use the refresh cookie or request body refresh token to rotate cookies before expiry

Native clients that send X-Auth-Client: mobile receive tokens in the response body instead of relying on cookies.

CSRF

State-changing requests authenticated by cookie require a CSRF token, obtained from GET /auth/csrf-token and sent in the X-CSRF-Token header. Requests authenticated with a verified Authorization header are exempt.

Permission Levels

Level	Description
a	Super Admin – Full access
a1	Admin – Administrative access
b	Moderator
c, d, e, f	Non-admin levels, in descending order

Response Format

Success Response

{
  "success": true,
  "data": {
    // Response payload
  }
}

Paginated Response

Paginated list shapes vary by route. Lobby lists return the fields flat:

{
  "success": true,
  "data": {
    "items": [],
    "total": 150,
    "page": 1,
    "limit": 20,
    "totalPages": 8
  }
}

Error Response

{
  "success": false,
  "error": {
    "code": "VALIDATION_ERROR",
    "message": "Human readable error message",
    "details": {
      "field": ["error message"]
    }
  }
}

Error Codes

Code	HTTP Status	Description
VALIDATION_ERROR	400	Invalid request parameters
INSUFFICIENT_FUNDS	400	Not enough funds
AUTHENTICATION_ERROR	401	Missing or invalid authentication
AUTHORIZATION_ERROR	403	Insufficient permissions or disabled feature
FEATURE_TIER_RESTRICTED	403	Feature not included in the current license plan
NOT_FOUND	404	Resource not found
CONFLICT	409	Resource already exists
RATE_LIMIT_EXCEEDED	429	Too many requests
INTERNAL_ERROR	500	Server error
GAME_INTEGRITY_ERROR	500	Game integrity check failed

Routes also return route-specific codes, for example INVALID_TEMP_TOKEN on POST /auth/verify-2fa.

Auth Routes

Base path: /api/v1/auth

POST /auth/register

Register a new user account.

Request Body:

{
  "username": "string (3-30 chars: letters, digits, _ or -)",
  "email": "string (valid email)",
  "password": "string (12-128 chars; lower, upper, digit, symbol)",
  "firstName": "string (optional)",
  "lastName": "string (optional)",
  "referralCode": "string (optional)"
}

Response:

{
  "success": true,
  "data": {
    "message": "If the provided details are valid, a verification email has been sent."
  }
}

POST /auth/login

Authenticate and receive auth cookies. Accounts with 2FA receive requires2FA and tempToken instead; complete with POST /auth/verify-2fa.

Request Body:

{
  "username": "string",
  "password": "string"
}

Response:

{
  "success": true,
  "data": {
    "user": { /* SafeUser object */ },
    "expiresIn": 900
  }
}

POST /auth/refresh

Refresh auth cookies using a refresh token from the request body or the HttpOnly refresh cookie.

Request Body:

{
  "refreshToken": "string"
}

Response:

{
  "success": true,
  "data": {
    "expiresIn": 900
  }
}

POST /auth/forgot-password

Request password reset email.

Request Body:

{
  "email": "string"
}

Response:

{
  "success": true,
  "data": {
    "message": "If an account with that email exists, a password reset link has been sent"
  }
}

POST /auth/reset-password

Reset password using token from email.

Request Body:

{
  "token": "string",
  "password": "string (12-128 chars; lower, upper, digit, symbol)"
}

POST /auth/verify-email

Verify email address using token.

Request Body:

{
  "token": "string"
}

POST /auth/resend-verification

Resend email verification link.

Request Body:

{
  "email": "string"
}

Other Auth Routes

Method	Path	Auth	Description
GET	/auth/csrf-token	User	Get a CSRF token
POST	/auth/exchange	Public; toggle developerApi	Exchange a developer SSO login code for a full session
GET	/auth/ip-binding	User	Get current IP binding settings for the authenticated user
PUT	/auth/ip-binding	User	Update IP binding settings for the authenticated user
POST	/auth/logout	Optional	Log out the current session
GET	/auth/me	User	Get current user profile
GET	/auth/me/features	User	Get the current user’s effective admin features
GET	/auth/providers	Public	Returns the list of enabled authentication providers
POST	/auth/revoke-all	User	Revoke all refresh tokens and sessions for the authenticated user
DELETE	/auth/sessions	User	Revoke all sessions except the current one
GET	/auth/sessions	User	List all active sessions for the authenticated user
DELETE	/auth/sessions/:id	User	Revoke a specific session
POST	/auth/verify-2fa	Public	Complete login for users with 2FA enabled by verifying their TOTP token or backup code

POST /auth/verify-2fa body: tempToken, plus exactly one of token or backupCode.

POST /auth/exchange body: code (64-character hex).

Health Routes

Base path: /api/v1/health

GET /health

Service status. Non-admin callers get a compact payload; admin callers also get component checks in data, migration, and license failure details.

Response:

{
  "status": "ok",
  "version": "string",
  "maintenance": false,
  "liveMigrationEnabled": false,
  "draining": false,
  "activeHands": 0,
  "drainDeadlineAt": null,
  "license": {
    "status": "string",
    "lastChecked": "2024-01-15T10:30:00.000Z"
  }
}

status is ok, degraded or unhealthy.

Status Codes:

• 200 – Healthy or degraded
• 503 – Unhealthy

GET /health/live

Kubernetes liveness probe. Checks if process is running.

Response:

{
  "success": true,
  "data": {
    "status": "alive",
    "timestamp": "2024-01-15T10:30:00Z"
  }
}

GET /health/ready

Kubernetes readiness probe. Returns 503 while the database is unavailable, the license is not_configured, or the instance is draining.

Response:

{
  "success": true,
  "data": {
    "status": "ready",
    "timestamp": "2024-01-15T10:30:00Z",
    "checks": { "database": true },
    "draining": false,
    "drainDeadlineAt": null
  }
}

Status Codes:

• 200 – Ready
• 503 – Not ready

Other Health Routes

Method	Path	Auth	Description
GET	/health/circuits	Optional	Circuit breaker states for all registered circuits

All routes above are also available under /api/v1/health.

Metrics Routes

Base path: /metrics

All routes require Admin (a1) unless listed otherwise under Other Metrics Routes.

GET /metrics

Full performance statistics for the last hour, including memory.current and memory.peak in MB (heapUsedMB, heapTotalMB, rssMB, externalMB).

GET /metrics/summary

Compact performance summary.

GET /metrics/memory

Memory usage history for charts.

Response:

{
  "success": true,
  "data": {
    "snapshots": [
      { "timestamp": 1705314000000, "heapUsedMB": 256, "heapTotalMB": 512, "rssMB": 600 }
    ],
    "count": 1
  }
}

GET /metrics/slow

Recent slow requests.

Query Parameters:

Parameter	Type	Default	Description
threshold	number	1000	Latency threshold in ms
limit	number	20	Max results (max: 100)

GET /metrics/routes

Per-route statistics sorted by request count.

GET /metrics/timers

Custom timer stats (database, game operations).

POST /metrics/reset

Reset all metrics. Admin only.

Other Metrics Routes

Method	Path	Auth	Description
GET	/metrics/load-probe	Public	Server-side load probe (non-production)
GET	/metrics/prometheus	Public	Prometheus exposition; requires Authorization: Bearer <metrics scrape token>, returns 404 when no token is configured
POST	/metrics/web-vitals	Public	Report web-vitals samples
GET	/metrics/web-vitals/config	Public	Get web-vitals client config

Analytics Routes

Base path: /api/v1/analytics

All routes require Admin (a1).

GET /analytics

Full game statistics overview.

Query Parameters:

Parameter	Type	Default	Description
hours	number	24	Time range in hours (max: 2160)

GET /analytics/summary

Compact game statistics summary (24h).

GET /analytics/daily

Daily statistics breakdown.

Query Parameters:

Parameter	Type	Default	Description
days	number	7	Number of days (max: 90)

GET /analytics/hourly

Hourly breakdown for last 24 hours.

GET /analytics/tables

Per-table statistics.

Query Parameters:

Parameter	Type	Default	Description
sortBy	string	handsPlayed	handsPlayed, rake, players
limit	number	20	Max results (max: 100)

GET /analytics/tables/:tableId

Statistics for a specific table.

GET /analytics/leaderboard

Player rankings.

Query Parameters:

Parameter	Type	Default	Description
metric	string	handsPlayed	handsPlayed, totalWon, totalWagered, totalRake
limit	number	20	Max results (max: 100)

GET /analytics/hands

Recent hands history.

Query Parameters:

Parameter	Type	Default	Description
tableId	string	–	Filter by table
limit	number	50	Max results (max: 200)

GET /analytics/tournaments

Tournament statistics.

POST /analytics/reset

Reset all analytics data. Admin only.

Other Analytics Routes

Method	Path	Auth	Description
GET	/analytics/managers	Admin	Per-manager rake breakdown for top-level manager player trees

GET /analytics/managers accepts days (default 7, max 90).

Lobby Routes

Base path: /api/v1/lobby

GET /lobby/tables

List all public tables with filtering, sorting, and pagination.

Query Parameters:

Parameter	Type	Default	Description
mode	string	–	REAL_MONEY, VIRTUAL_CHIPS, TOURNAMENT
type	string	–	PUBLIC, PRIVATE
minSmallBlind	number	–	Minimum small blind
maxSmallBlind	number	–	Maximum small blind
minBigBlind	number	–	Minimum big blind
maxBigBlind	number	–	Maximum big blind
gameState	string	–	GameState enum value
hasAvailableSeats	boolean	–	Filter by seat availability
minPlayers	number	–	Minimum current players
maxPlayers	number	–	Maximum current players
sortBy	string	name	name, smallBlind, bigBlind, playerCount, maxPlayers
sortDir	string	asc	asc, desc
page	number	1	Page number (1-indexed)
limit	number	20	Results per page (max: 100)

Response: a paginated result (items, total, page, limit, totalPages) of table objects:

{
  "id": "uuid",
  "name": "High Rollers",
  "mode": "REAL_MONEY",
  "type": "PUBLIC",
  "maxPlayers": 9,
  "playerCount": 6,
  "smallBlind": 50,
  "bigBlind": 100,
  "minBuyIn": 2000,
  "maxBuyIn": 10000,
  "isPrivate": false,
  "gameState": "PLAYING",
  "gameType": "TEXAS_HOLDEM",
  "availableSeats": 3
}

GET /lobby/tables/search

Search tables by name. Also accepts the filter and pagination parameters of GET /lobby/tables.

Query Parameters:

Parameter	Type	Required	Description
q	string	Yes	Search query

GET /lobby/tables/:tableId

Get a table object as returned by GET /lobby/tables.

GET /lobby/tables/:tableId/players

Get seated players at table.

GET /lobby/tables/:tableId/seats

Get available seats at table.

POST /lobby/tables

Create a new table. Admin only.

Request Body:

{
  "name": "string (required)",
  "mode": "REAL_MONEY | VIRTUAL_CHIPS",
  "type": "PUBLIC | PRIVATE",
  "password": "string (required if type=PRIVATE)",
  "maxPlayers": "number (2-10)",
  "smallBlind": "number (>0)",
  "bigBlind": "number (>=smallBlind)",
  "minBuyIn": "number (>0)",
  "maxBuyIn": "number (>=minBuyIn)",
  "ante": "number (optional)",
  "gameType": "string (optional)",
  "rakePercent": "number (optional, 0-100)",
  "rakeCap": "number (optional)",
  "bettingLimit": "string (optional)",
  "ruleProfileId": "string (optional)",
  "ruleProfileVersion": "number (optional)"
}

GET /lobby/stats

Get lobby statistics.

Response:

{
  "success": true,
  "data": {
    "totalTables": 25,
    "totalPlayers": 87,
    "publicTables": 20,
    "privateTables": 5,
    "activeGames": 12
  }
}

Other Lobby Routes

Method	Path	Auth	Description
GET	/lobby/tables/:tableId/style	Public	Get the visual style for a table (public, no auth required)

Private Games Routes

Base path: /api/v1/private-games

Authentication: All routes require a logged-in user and the privateGames feature toggle.

POST /private-games/tables

Create a new private table.

Request Body:

{
  "name": "string",
  "password": "string (min 4 chars)",
  "mode": "REAL_MONEY | VIRTUAL_CHIPS (optional)",
  "maxPlayers": "number (2-10)",
  "smallBlind": "number (>0)",
  "bigBlind": "number (>=smallBlind)",
  "minBuyIn": "number (>0)",
  "maxBuyIn": "number (>=minBuyIn)",
  "ante": "number (optional)",
  "gameType": "string (optional)",
  "styleId": "string (optional)",
  "mixedGameConfig": "object (optional)",
  "ruleProfileId": "string (optional)",
  "ruleProfileVersion": "number (optional)"
}

Response:

{
  "success": true,
  "data": {
    "tableId": "string",
    "inviteCode": "ABC123XY"
  }
}

POST /private-games/tables/join

Join a private table with password. Seating and buy-in happen over WebSocket (join_table).

Request Body:

{
  "tableIdOrCode": "string (table ID or invite code)",
  "password": "string"
}

Response: { "success": true, "data": { "tableId": "string" } }

GET /private-games/tables

List user’s private tables.

Query Parameters:

Parameter	Type	Default	Description
createdOnly	boolean	false	Only return tables created by user

GET /private-games/tables/:tableId

Get private table details.

GET /private-games/tables/:tableId/invite-code

Get invite code. Creator only.

Response:

{
  "success": true,
  "data": {
    "inviteCode": "ABC123XY"
  }
}

DELETE /private-games/tables/:tableId

Delete private table. Creator only.

Other Private Games Routes

Method	Path	Auth	Description
POST	/private-games/tables/:tableId/invite-token	User; toggle privateGames	Create a short-lived direct-join token (creator only)
POST	/private-games/tables/invite-token/consume	User; toggle privateGames	Consume a short-lived direct-join token
GET	/private-games/tables/lookup/:code	User; toggle privateGames	Look up a private table by invite code for preview before joining

Tournament Routes

Base path: /api/v1/lobby/tournaments

Method	Path	Auth	Description
GET	/lobby/tournaments	Public; toggle tournaments	List tournaments
GET	/lobby/tournaments/:tournamentId	Optional; toggle tournaments	Get details of a specific tournament
POST	/lobby/tournaments/:tournamentId/addon	User; toggle tournaments	Process an add-on for the authenticated user in a tournament
GET	/lobby/tournaments/:tournamentId/entry-options	User; toggle tournaments	Get authenticated player eligibility for late registration, rebuy, add-on, and re-entry actions
POST	/lobby/tournaments/:tournamentId/rebuy	User; toggle tournaments	Process a rebuy for the authenticated user in a tournament
POST	/lobby/tournaments/:tournamentId/reentry	User; toggle tournaments	Process a re-entry for the authenticated user in a tournament
POST	/lobby/tournaments/:tournamentId/register	User; toggle tournaments	Register the authenticated user for a tournament
GET	/lobby/tournaments/:tournamentId/standings	User; toggle tournaments	Get real-time tournament standings (remaining + eliminated players)
POST	/lobby/tournaments/:tournamentId/unregister	User; toggle tournaments	Unregister the authenticated user from a tournament

Cashier Routes

Base path: /api/v1/cashier

Method	Path	Auth	Description
GET	/cashier/balance	User; toggle cashier	Get user balance
POST	/cashier/convert	User; toggle cashier	Convert between currencies
GET	/cashier/convert/preview	User; toggle cashier	Preview a currency conversion
GET	/cashier/crypto-address/:currency	User; toggle cashier	Get or create a crypto deposit address
GET	/cashier/currency-packages	User; toggle cashier	List currency packages
POST	/cashier/deposit	User; toggle cashier	Initiate a deposit
GET	/cashier/payment-methods	User; toggle cashier	Returns available deposit and withdrawal methods based on configured payment systems
POST	/cashier/redeem-coupon	User; toggle cashier	Redeem a coupon code
GET	/cashier/status	User; toggle cashier	Returns cashier status flags (e.g
POST	/cashier/transfer	User; toggle cashier	Transfer funds to another user
GET	/cashier/verification	User; toggle cashier	Get verification status
POST	/cashier/verification	User; toggle cashier	Submit verification documents
GET	/cashier/wallets	User; toggle cashier	List the user’s wallets
POST	/cashier/withdraw	User; toggle cashier	Request a withdrawal
POST	/cashier/withdraw/:transactionId/cancel	User; toggle cashier	Cancel a pending withdrawal owned by the authenticated user

User Routes

Base path: /api/v1/user

Method	Path	Auth	Description
POST	/user/2fa/disable	User	Disable 2FA on the user’s account after verifying their token
POST	/user/2fa/enable	User	Confirm and enable 2FA after verifying the token from authenticator app
POST	/user/2fa/setup	User	Initiate 2FA setup – generates a new TOTP secret and QR code
GET	/user/affiliate	User	Get affiliate dashboard data for the current user
GET	/user/affiliate/leaderboard	User	Get affiliate leaderboard
GET	/user/affiliate/network	User	Get affiliate network overview (downline summary)
GET	/user/affiliate/performance	User	Get affiliate performance history over time
GET	/user/affiliate/referrals	User	Get list of referred users (paginated)
GET	/user/affiliate/rewards	User	Get affiliate rewards/earnings (paginated)
GET	/user/agent/players	User	Get list of players assigned to the current agent (paginated)
GET	/user/agent/stats	User	Get agent statistics for the current user
POST	/user/agent/transfer	Agent	Transfer funds from agent balance to an assigned player
POST	/user/avatar	User	Upload avatar image
GET	/user/bonuses	User	Get available bonuses for the current user
GET	/user/bonuses/history	User	Get bonus credit history for the current user
GET	/user/bonuses/wagering-progress	User	Get wagering progress for the current user’s active bonuses
POST	/user/change-password	User	Change password (requires current password verification)
GET	/user/hands	User	Get current user’s hand history (paginated)
GET	/user/hands/:gameId	User	Get full details of a specific hand
GET	/user/hands/:gameId/replay	User	Get full replay data for a specific hand
GET	/user/hands/replays	User	Get current user’s hand replays (paginated list)
GET	/user/poker-sessions	User	Get paginated list of player poker sessions with filters
GET	/user/poker-sessions/:id	User	Get detailed player session information with calculated stats
GET	/user/poker-sessions/stats	User	Get aggregate statistics across all player sessions
GET	/user/profile	User	Return current user’s profile
PATCH	/user/profile	User	Update display name (firstName/lastName only)
GET	/user/sessions	User	Get current user’s table session history (paginated)
GET	/user/settings	User	Get current user’s settings
PATCH	/user/settings	User	Update current user’s settings (partial update)
POST	/user/settings/reset	User	Reset current user’s settings to defaults
GET	/user/stats	User	Get current user’s gameplay statistics
GET	/user/transactions	User	Get current user’s transaction history
POST	/user/virtual-balance/replenish	User	Replenish virtual balance when it falls below threshold

Account Routes

Base path: /api/v1/account

Method	Path	Auth	Description
DELETE	/account/delete-request	User	Cancel a pending account deletion request
GET	/account/delete-request	User	Get the status of any pending account deletion request
POST	/account/delete-request	User	Initiate account deletion with 30-day waiting period
GET	/account/export	User	Export all user data for GDPR compliance
GET	/account/protection	User	Get responsible-gaming protection settings
POST	/account/protection/cool-off	User	Start a cool-off period
POST	/account/protection/exclusion	User	Start a self-exclusion
PUT	/account/protection/limits	User	Set protection limits

Statistics and Leaderboard Routes

Base paths: /api/v1/statistics, /api/v1/leaderboard

Method	Path	Auth	Description
GET	/leaderboard	Public	Get leaderboard with optional game variant filter
GET	/leaderboard/game-types	Public	Get list of available game types for filtering
GET	/leaderboard/rank/:playerId	Public	Get a specific player’s rank on the leaderboard
GET	/statistics	User	Get current user’s statistics with comparison to average player
GET	/statistics/history	User	Get statistics over time (daily/weekly)
GET	/statistics/players/:id/stats	User	Get a player’s statistics, optionally filtered by variant
GET	/statistics/position	User	Get statistics broken down by position
GET	/statistics/variant	User	Get current user’s statistics for all game variants
GET	/statistics/variant/:gameType	User	Get current user’s statistics for a specific game variant

Config, Pages and App Routes

Base paths: /api/v1/config, /api/v1/pages, /api/v1/app

Method	Path	Auth	Description
GET	/app/deeplinks/resolve	Public	Validates and resolves deep link paths for the mobile app
GET	/app/version	Public	Public endpoint for mobile app version checks
GET	/config/branding	Public	Get public site branding and SEO settings for the frontend
GET	/config/currency	Public	Get public currency configuration for the frontend
GET	/config/features	Public	Get public feature toggles for the frontend
GET	/config/languages	Public	Get active languages for the frontend language selector
GET	/config/languages/:code/phrases	Public	Get all translation phrases for a language by code
GET	/config/plugin-scripts	Public	Returns active plugin frontend bundle URLs for client-side loading
GET	/config/plugin-settings/:providerType	User	Client-visible plugin settings
GET	/pages/:slug	Optional	Get a public page by slug with its active content blocks

Tickets and Devices Routes

Base paths: /api/v1/tickets, /api/v1/devices

Method	Path	Auth	Description
GET	/devices	User	List the authenticated user’s registered devices
DELETE	/devices/:deviceId	User	Unregister a device (soft delete by setting isActive: false)
POST	/devices/register	User	Register or update a device push token (upsert on userId + pushToken)
GET	/tickets	User	Get all tickets for the authenticated user
POST	/tickets/:ticketId/redeem	User	Redeem a satellite ticket to register for the target tournament

Agent Routes

Base path: /api/v1/agent

Method	Path	Auth	Description
GET	/agent/available-templates	Agent; toggle agents	List commission templates available for sub-agent assignment
GET	/agent/available-tiers	Agent; toggle agents	List role tiers available for sub-agent assignment
GET	/agent/clubs	Agent; toggle agents	List agent’s clubs
POST	/agent/clubs	Agent; toggle agents	Create a new club
GET	/agent/clubs/:clubId	Agent; toggle agents	Get club detail
PUT	/agent/clubs/:clubId/buyin	Agent; toggle agents	Update club buy-in defaults
PUT	/agent/clubs/:clubId/chip-price	Agent; toggle agents	Update club chip price
POST	/agent/clubs/:clubId/invite	Agent; toggle agents	Invite a player to a club
GET	/agent/clubs/:clubId/members	Agent; toggle agents	List club members (paginated)
DELETE	/agent/clubs/:clubId/members/:memberId	Agent; toggle agents	Remove a club member
PUT	/agent/clubs/:clubId/rake	Agent; toggle agents	Update club rake settings
GET	/agent/clubs/:clubId/tables	Agent; toggle agents	List tables in a club
POST	/agent/clubs/:clubId/tables	Agent; toggle agents	Create a table within a club
DELETE	/agent/clubs/:clubId/tables/:tableId	Agent; toggle agents	Delete a club table
POST	/agent/clubs/:clubId/tables/:tableId/pause	Agent; toggle agents	Pause a club table
POST	/agent/clubs/:clubId/tables/:tableId/resume	Agent; toggle agents	Resume a club table
GET	/agent/commission-breakdown	Agent; toggle agents	Get the current-period commission breakdown
GET	/agent/commission-settings	Agent; toggle agents	Returns whether commission overrides are enabled
GET	/agent/commissions	Agent; toggle agents	Get commission history for the authenticated agent (self-service)
POST	/agent/deposit	Agent; toggle agents	Deposit chips to a player assigned to this agent (or in subtree)
GET	/agent/export/commissions	Agent; toggle agents	Export commission history as CSV for the authenticated agent
GET	/agent/export/players	Agent; toggle agents	Export players list as CSV for the authenticated agent
GET	/agent/metrics	Agent; toggle agents	Get key metrics for the authenticated agent’s self-service dashboard
GET	/agent/my-permissions	Agent; toggle agents	Get the authenticated agent’s effective permissions
GET	/agent/players	Agent; toggle agents	Get list of players assigned to the authenticated agent
POST	/agent/players	Agent; toggle agents	Create a new player account assigned to this agent
GET	/agent/players/:playerId	Agent; toggle agents	Get detailed player information for a specific player
PUT	/agent/players/:playerId	Agent; toggle agents	Update a player’s profile fields
POST	/agent/players/:playerId/adjustment	Agent; toggle agents	Make a manual balance adjustment for a player
GET	/agent/players/:playerId/hand-history	Agent; toggle agents	View a player’s hand history (paginated)
GET	/agent/players/:playerId/limits	Agent; toggle agents	View a player’s deposit limits
PUT	/agent/players/:playerId/limits	Agent; toggle agents	Set deposit limits for a player
POST	/agent/players/:playerId/suspend	Agent; toggle agents	Suspend a player (set isBlocked = true)
POST	/agent/players/:playerId/unsuspend	Agent; toggle agents	Unsuspend a player (set isBlocked = false)
GET	/agent/referral-links	Agent; toggle agents	List the agent’s referral links with click and signup stats
POST	/agent/referral-links	Agent; toggle agents	Generate a new referral link for the agent
GET	/agent/reports/activity	Agent; toggle agents	Export daily activity summary for the agent (and subtree if permitted)
GET	/agent/reports/commissions	Agent; toggle agents	Export commission data for the agent (and subtree if permitted)
GET	/agent/reports/financial-summary	Agent; toggle agents	View financial summary for the agent within a date range
GET	/agent/reports/player-activity	Agent; toggle agents	View player activity reports for the agent’s assigned players
GET	/agent/reports/players	Agent; toggle agents	Export player data for the agent (and subtree if permitted)
GET	/agent/settlements	Agent; toggle agents	List the agent’s settlements with pagination
GET	/agent/settlements/:id	Agent; toggle agents	Get a single settlement with full breakdown detail
GET	/agent/sub-agents	Agent; toggle agents	List the agent’s direct sub-agents with basic stats
POST	/agent/sub-agents	Agent; toggle agents	Create a sub-agent under the authenticated agent
GET	/agent/sub-agents/:id	Agent; toggle agents	Get detail for a specific sub-agent (must be in the agent’s subtree)
PUT	/agent/sub-agents/:id	Agent; toggle agents	Edit sub-agent properties (role tier, commission template)
GET	/agent/sub-agents/:id/children	Agent; toggle agents	List direct children for a specific sub-agent in the authenticated agent’s subtree
PUT	/agent/sub-agents/:id/commission	Agent; toggle agents	Set commission overrides for a sub-agent in the requesting agent’s subtree
PUT	/agent/sub-agents/:id/credit-line	Agent; toggle agents	Set the credit line for a sub-agent
PUT	/agent/sub-agents/:id/limits	Agent; toggle agents	Set financial limits for a sub-agent in the requesting agent’s subtree
GET	/agent/sub-agents/:id/reports	Agent; toggle agents	View performance reports for a sub-agent in the requesting agent’s subtree
POST	/agent/sub-agents/:id/suspend	Agent; toggle agents	Suspend a sub-agent in the requesting agent’s subtree
POST	/agent/sub-agents/:id/unsuspend	Agent; toggle agents	Unsuspend (reactivate) a sub-agent in the requesting agent’s subtree
POST	/agent/subagent/deposit	Agent; toggle agents	Transfer chips from the current agent’s balance to a direct sub-agent’s balance
POST	/agent/subagent/withdraw	Agent; toggle agents	Withdraw chips from a direct sub-agent’s balance back to the current agent’s balance
GET	/agent/subtree-stats	Agent; toggle agents	Aggregate stats for the agent’s subtree
GET	/agent/transactions	Agent; toggle agents	List the agent’s transactions with pagination and date range filter
POST	/agent/transfer-chips	Agent; toggle agents	Transfer chips from the authenticated agent to a sub-agent in their tree
GET	/agent/user-search	Agent; toggle agents	Search for users who are not yet agents (for sub-agent creation)
GET	/agent/wholesale-history	Agent; toggle agents	Get wholesale purchase history for the agent
GET	/agent/wholesale-info	Agent; toggle agents	Get wholesale purchase info for the agent self-service UI
POST	/agent/wholesale-purchase	Agent; toggle agents	Purchase wholesale chips at the agent’s configured discount
POST	/agent/withdraw	Agent; toggle agents	Withdraw chips from a player back to agent balance

Developer Routes

Base path: /api/v1/developer. See Integration API for signing.

Method	Path	Auth	Description
POST	/developer/auth/code	Developer key; toggle developerApi	Generate a single-use login code for a user
GET	/developer/docs	Public	Serve the documentation index page (?format=json returns { title, content, pages })
GET	/developer/docs/:page	Public	Serve a specific documentation page
GET	/developer/docs/openapi.json	Public	Convert and serve the OpenAPI spec as JSON
GET	/developer/docs/openapi.yaml	Public	Serve the raw OpenAPI YAML specification
POST	/developer/register	Public; toggle developerApi	Self-register as a developer partner
GET	/developer/status	Public; toggle developerApi	Check partner registration status by email
POST	/developer/users	Developer key; toggle developerApi	Provision a user account linked to an external user ID
GET	/developer/users/:externalUserId	Developer key; toggle developerApi	Get a user account by external user ID
PUT	/developer/users/:externalUserId	Developer key; toggle developerApi	Update a user’s profile fields by external user ID
GET	/developer/users/:externalUserId/balance	Developer key; toggle developerApi	Get a user’s balance by external user ID
POST	/developer/users/:externalUserId/balance/credit	Developer key; toggle developerApi	Credit (add) funds to a user’s balance
POST	/developer/users/:externalUserId/balance/debit	Developer key; toggle developerApi	Debit (subtract) funds from a user’s balance
GET	/developer/webhooks	Developer key; toggle developerApi	List all webhook subscriptions for the authenticated partner
POST	/developer/webhooks	Developer key; toggle developerApi	Subscribe to a webhook event type (upserts if subscription already exists)
DELETE	/developer/webhooks/:subscriptionId	Developer key; toggle developerApi	Unsubscribe (delete) a webhook subscription

Webhook Routes

Base path: /api/v1/webhooks

POST /webhooks/payment/:paymentSystemId

Receive payment provider webhooks.

Public endpoint – No authentication required. Signature verification performed using headers.

Supported Signature Headers:

• x-signature
• hmac
• x-coinpayments-hmac
• btcpay-sig
• stripe-signature
• x-webhook-signature
• paypal-transmission-sig (PayPal)

POST /webhooks/payment/:paymentSystemId/test

Test webhook configuration. Admin only.

GET /webhooks/events

Get webhook events. Admin only.

Query Parameters:

Parameter	Type	Required	Description
paymentSystemId	uuid	No	Filter by payment system
status	string	No	received, processed, failed, duplicate
startDate	ISO date	No	Filter by start date
endDate	ISO date	No	Filter by end date
limit	number	No	1-100 (default: 50)
offset	number	No	Pagination offset

GET /webhooks/statistics

Get webhook statistics. Admin only.

POST /webhooks/events/:eventId/retry

Retry failed webhook. Admin only.

Wallet Routes

Base path: /api/wallet/v1

Method	Path	Auth	Description
POST	/api/wallet/v1/providers/:slug/callback	Public	Wallet provider callback; verified by provider signature

Debug Routes

Base path: /api/v1/debug

Method	Path	Auth	Description
GET	/debug/events	Admin	Query event traces with filters
GET	/debug/events/:correlationId	Admin	Query event trace by correlation ID
GET	/debug/events/stats	Admin	Get event tracing statistics
POST	/debug/events/tracing	Admin	Enable or disable event tracing

Admin Routes

Base path: /api/v1/admin

All admin routes require an admin session (permission level a1 or higher) and the feature permission for the action, except /admin/auth login, refresh and 2FA flows. Routes that are not detailed below are listed in Other Admin Routes.

Admin Authentication

POST /admin/auth/login

Admin login with enhanced security. Admins may receive a pending 2FA response instead of a completed session.

Request Body:

{
  "username": "string",
  "password": "string"
}

Completed session response:

{
  "success": true,
  "data": {
    "user": { /* Admin user object */ },
    "session": { /* Admin session object */ },
    "expiresIn": 900
  }
}

2FA required response:

{
  "success": true,
  "data": {
    "requires2FA": true,
    "tempToken": "string",
    "setupRequired": true
  }
}

Auth tokens are set as HttpOnly cookies when login or 2FA completion succeeds.

POST /admin/auth/2fa/setup

Begin mandatory admin 2FA setup for a pending admin login.

Request Body:

{
  "tempToken": "string"
}

Response:

{
  "success": true,
  "data": {
    "secret": "string",
    "qrCodeUrl": "string"
  }
}

POST /admin/auth/2fa/setup/verify

Complete mandatory admin 2FA setup and finish the pending admin login.

Request Body:

{
  "tempToken": "string",
  "secret": "string",
  "code": "string"
}

POST /admin/auth/2fa

Complete admin login after 2FA verification with a TOTP code or backup code.

Request Body:

{
  "tempToken": "string",
  "code": "string"
}

POST /admin/auth/refresh

Refresh admin tokens with session validation. Updated tokens are set as HttpOnly cookies.

Request Body:

{
  "refreshToken": "string",
  "sessionId": "uuid"
}

POST /admin/auth/logout

Logout and invalidate tokens.

Request Body:

{
  "sessionId": "uuid"
}

GET /admin/auth/sessions

Get user’s active sessions.

POST /admin/auth/sessions/invalidate-all

Invalidate all user sessions.

POST /admin/auth/sessions/:sessionId/invalidate

Invalidate specific session.

GET /admin/me

Get current admin profile.

Table Management

POST /admin/tables

Create a new table.

GET /admin/tables

List all tables with pagination.

Query Parameters:

Parameter	Description
page	Page number (default 1)
limit	Results per page (default 20, max 100)
status	Filter by status
tableMode	Filter by mode
tableType	Filter by type
search	Search by name
isScheduled	Filter scheduled tables

GET /admin/tables/:tableId

Get table details including debug information.

PATCH /admin/tables/:tableId

Update table settings.

DELETE /admin/tables/:tableId

Delete a table.

POST /admin/tables/:tableId/pause

Pause a table.

POST /admin/tables/:tableId/resume

Resume a paused table.

GET /admin/tables/:tableId/debug

Get full debug state including all cards.

POST /admin/tables/:tableId/set-cards

Set the next deck for testing. Super admin only.

Request Body:

{
  "cards": [
    "AS",
    "KH"
  ],
  "reason": "string (optional, 3-500 chars)"
}

GET /admin/tables/:tableId/history

Get hand history for table.

POST /admin/tables/:tableId/style

Apply table style.

User Management

GET /admin/users

List users with search, sort, and pagination.

Query Parameters:

Parameter	Description
page	Page number (default 1)
limit	Results per page (default 20, max 100)
search	Search users
sortBy	Field to sort by (default createdAt)
sortOrder	asc or desc (default desc)
isBlocked	Filter blocked users
isVerified	Filter verified users
isBot	Filter bots

GET /admin/users/:userId

Get user details.

POST /admin/users

Create a user.

Request Body:

{
  "username": "string (3-30, letters, digits, _)",
  "email": "string",
  "password": "string (min 8)",
  "firstName": "string (optional)",
  "lastName": "string (optional)",
  "country": "string (optional)",
  "groupId": "uuid",
  "isVerified": "boolean (optional)",
  "isEmailConfirmed": "boolean (optional)",
  "isBot": "boolean (optional)",
  "isAgent": "boolean (optional)"
}

PATCH /admin/users/:userId

Update user.

POST /admin/users/:userId/block

Block user account.

Request Body:

{
  "reason": "string (optional)"
}

POST /admin/users/:userId/unblock

Unblock user account.

DELETE /admin/users/:userId

Delete user account.

GET /admin/users/:userId/history

Get user operation history.

GET /admin/users/pending

Get pending registration approvals.

POST /admin/users/:userId/approve

Approve registration.

POST /admin/users/:userId/reject

Reject registration.

Request Body:

{
  "reason": "string"
}

GET /admin/users/unconfirmed-emails

Get users with unconfirmed emails.

POST /admin/users/:userId/confirm-email

Manually confirm user email.

POST /admin/users/:userId/revoke-email

Revoke email confirmation.

User Groups

GET /admin/groups

List all groups.

GET /admin/groups/:groupId

Get group details.

POST /admin/groups

Create group.

Request Body:

{
  "name": "string",
  "permissions": "a | a1 | b | c | d | e | f"
}

PATCH /admin/groups/:groupId

Update group.

DELETE /admin/groups/:groupId

Delete group.

GET /admin/groups/:groupId/users

Get users in group.

POST /admin/groups/:groupId/assign

Assign users to group.

Request Body:

{
  "userIds": ["uuid1", "uuid2"]
}

Bonus System

GET /admin/bonuses

List all bonuses.

GET /admin/bonuses/:bonusId

Get bonus details.

POST /admin/bonuses

Create bonus.

Request Body:

{
  "description": "string",
  "event": "ON_DEPOSIT | ON_FIRST_DEPOSIT | ON_FIRST_LOGIN",
  "type": "VIRTUAL | USD | GOLD | DIAMOND | TICKETS",
  "amount": "string (e.g. \"100\" or \"50%\")",
  "startDate": "date",
  "endDate": "date",
  "isActive": "boolean (optional)"
}

PATCH /admin/bonuses/:bonusId

Update bonus.

DELETE /admin/bonuses/:bonusId

Delete bonus.

POST /admin/bonuses/:bonusId/activate

Activate bonus.

POST /admin/bonuses/:bonusId/deactivate

Deactivate bonus.

GET /admin/bonuses/:bonusId/credits

Get bonus credit history.

GET /admin/bonus-credits

List all bonus credits.

POST /admin/bonuses/:bonusId/apply/:userId

Manually apply bonus to user.

Email Templates

GET /admin/email-templates

List all email templates.

GET /admin/email-templates/names

Get available template names.

GET /admin/email-templates/:templateId

Get template details.

POST /admin/email-templates

Create template.

Request Body:

{
  "name": "string",
  "subject": "string",
  "body": "string"
}

PATCH /admin/email-templates/:templateId

Update template.

DELETE /admin/email-templates/:templateId

Delete template.

GET /admin/email-templates/:templateId/variables

Get template variables.

POST /admin/email-templates/preview

Preview a template.

Request Body:

{
  "subject": "string",
  "body": "string",
  "variables": "object (optional)"
}

SMTP Configuration

GET /admin/smtp/config

Get SMTP configuration.

PATCH /admin/smtp/config

Update SMTP configuration. All fields are optional.

Request Body:

{
  "enabled": "boolean (optional)",
  "server": {
    "host": "string",
    "port": "number",
    "encryption": "none | ssl | tls | starttls",
    "timeout": "number"
  },
  "auth": {
    "enabled": "boolean",
    "username": "string",
    "password": "string"
  },
  "sender": {
    "fromAddress": "string",
    "fromName": "string",
    "replyToAddress": "string",
    "replyToName": "string"
  },
  "rateLimit": {
    "enabled": "boolean",
    "maxPerMinute": "number",
    "maxPerHour": "number",
    "maxPerDay": "number"
  }
}

POST /admin/smtp/test

Test the SMTP connection using the saved configuration. No body.

GET /admin/smtp/presets

Get SMTP presets (Gmail, SendGrid, etc.).

GET /admin/smtp/presets/:preset

Get preset details.

POST /admin/smtp/presets/:preset/apply

Apply preset configuration.

GET /admin/smtp/rate-limit

Get current rate limit status.

POST /admin/smtp/rate-limit/reset

Reset rate limit counter.

GET /admin/smtp/encryption-types

Get supported encryption types.

Email Management

POST /admin/emails/send

Send an email from a template.

Request Body:

{
  "to": "string",
  "templateId": "uuid (or templateName)",
  "templateName": "string (or templateId)",
  "variables": "object (optional)",
  "userId": "uuid (optional)"
}

POST /admin/emails/send-custom

Send a custom email.

Request Body:

{
  "to": "string",
  "subject": "string",
  "body": "string",
  "userId": "uuid (optional)"
}

POST /admin/emails/send-to-user/:userId

Send email to specific user.

GET /admin/emails/logs

Get email logs.

Query Parameters:

Parameter	Description
recipientEmail	Filter by recipient email
recipientUserId	Filter by recipient user
status	Filter by status
templateId	Filter by template
sentBy	Filter by sender
startDate	Filter start
endDate	Filter end
page	Page number
limit	Results per page
sortBy	Sort field
sortOrder	Sort order

GET /admin/emails/logs/:emailLogId

Get specific email log entry.

GET /admin/emails/user/:userId

Get emails sent to user.

GET /admin/emails/stats

Get email statistics.

POST /admin/emails/logs/:emailLogId/retry

Retry failed email.

Bulk Email Campaigns

POST /admin/bulk-emails/campaigns

Create a campaign.

Request Body:

{
  "name": "string",
  "description": "string (optional)",
  "templateId": "uuid (optional)",
  "templateName": "string (optional)",
  "subject": "string (optional)",
  "body": "string (optional)",
  "targetType": "ALL_USERS | GROUP | USER_LIST | FILTER",
  "targetGroupId": "uuid (optional)",
  "targetUserIds": "uuid[] (optional)",
  "targetFilters": "object (optional)",
  "scheduledAt": "datetime (optional)"
}

GET /admin/bulk-emails/campaigns

List campaigns.

GET /admin/bulk-emails/campaigns/stats

Get campaign statistics.

GET /admin/bulk-emails/campaigns/:campaignId

Get campaign details.

PUT /admin/bulk-emails/campaigns/:campaignId

Update campaign.

DELETE /admin/bulk-emails/campaigns/:campaignId

Delete campaign.

POST /admin/bulk-emails/campaigns/:campaignId/start

Start campaign.

POST /admin/bulk-emails/campaigns/:campaignId/cancel

Cancel running campaign.

GET /admin/bulk-emails/campaigns/:campaignId/emails

Get campaign emails.

Coupons

POST /admin/coupons

Create a coupon.

Request Body:

{
  "code": "string (optional)",
  "currency": "USD | GOLD | DIAMOND | VIRTUAL | TICKETS",
  "value": "number (>0)",
  "expiresAt": "datetime (optional)",
  "description": "string (optional)"
}

GET /admin/coupons

List coupons.

GET /admin/coupons/stats

Get coupon statistics.

GET /admin/coupons/:couponId

Get coupon details.

DELETE /admin/coupons/:couponId

Delete coupon.

POST /admin/coupons/:couponId/send-email

Send coupon via email.

POST /admin/coupons/batches

Create a coupon batch.

Request Body:

{
  "name": "string",
  "description": "string (optional)",
  "currency": "USD | GOLD | DIAMOND | VIRTUAL | TICKETS",
  "value": "number (>0)",
  "quantity": "number (1-10000)",
  "expiresAt": "datetime (optional)",
  "codePrefix": "string (optional, max 10)"
}

GET /admin/coupons/batches

List coupon batches.

GET /admin/coupons/batches/:batchId

Get batch details.

GET /admin/coupons/batches/:batchId/coupons

Get coupons in batch.

POST /admin/coupons/batches/:batchId/send-emails

Send batch coupons via email.

Messaging System

GET /admin/messages

List messages (inbox).

Query Parameters:

Parameter	Description
category	Filter by category
isRead	Filter by read state
senderId	Filter by sender
search	Search messages
page	Page number
limit	Results per page
sortBy	Sort field
sortOrder	Sort order

GET /admin/messages/stats

Get message statistics.

GET /admin/messages/unread-count

Get unread message count.

GET /admin/messages/:messageId

Get message details.

POST /admin/messages/compose

Compose a message.

Request Body:

{
  "receiverId": "uuid",
  "category": "GENERAL | VERIFICATION | WITHDRAWAL | SUPPORT",
  "subject": "string",
  "content": "string",
  "attachments": "string[] (optional)"
}

POST /admin/messages/:messageId/reply

Reply to message.

POST /admin/messages/:messageId/read

Mark as read.

POST /admin/messages/:messageId/unread

Mark as unread.

POST /admin/messages/bulk-read

Bulk mark as read.

Request Body:

{
  "messageIds": ["uuid1", "uuid2"]
}

DELETE /admin/messages/:messageId

Delete message.

POST /admin/messages/bulk-delete

Bulk delete messages.

GET /admin/messages/user/:userId

Get messages from/to user.

Verification Requests

GET /admin/verification-requests

List verification requests.

GET /admin/verification-requests/stats

Get request statistics.

GET /admin/verification-requests/pending-count

Get pending request count.

GET /admin/verification-requests/:requestId

Get request details.

POST /admin/verification-requests/:requestId/approve

Approve a verification request.

Request Body:

{
  "tier": "TIER_1 | TIER_2 | TIER_3",
  "message": "string (optional)"
}

POST /admin/verification-requests/:requestId/reject

Reject a verification request.

Request Body:

{
  "message": "string (optional)"
}

Withdrawal Requests

GET /admin/withdrawal-requests

List withdrawal requests.

GET /admin/withdrawal-requests/stats

Get request statistics.

GET /admin/withdrawal-requests/pending-count

Get pending request count.

GET /admin/withdrawal-requests/:requestId

Get request details.

POST /admin/withdrawal-requests/:requestId/approve

Approve withdrawal.

POST /admin/withdrawal-requests/:requestId/reject

Reject a withdrawal request.

Request Body:

{
  "message": "string (optional)",
  "externalId": "string (optional)"
}

Server Settings

GET /admin/server/settings

Get all server settings.

PATCH /admin/server/settings

Update server settings.

POST /admin/server/settings/reset

Reset to defaults.

GET /admin/server/settings/export

Export settings as JSON.

POST /admin/server/settings/import

Import settings from JSON.

GET /admin/server/site-url

Get site URL configuration.

PATCH /admin/server/site-url

Update site URL.

GET /admin/server/script-paths

Get script paths.

PATCH /admin/server/script-paths

Update script paths.

GET /admin/server/site-email

Get site email.

PATCH /admin/server/site-email

Update site email.

GET /admin/server/timezone

Get timezone.

PATCH /admin/server/timezone

Update timezone.

GET /admin/server/timezones

Get available timezones.

GET /admin/server/time

Get current server time.

General Settings

GET /admin/general/settings

Get general settings.

PATCH /admin/general/settings

Update general settings.

POST /admin/general/settings/reset

Reset to defaults.

GET /admin/general/settings/export

Export settings.

POST /admin/general/settings/import

Import settings.

GET /admin/general/avatar

Get avatar configuration.

PATCH /admin/general/avatar

Update avatar configuration.

GET /admin/general/avatar/defaults

Get default avatars.

POST /admin/general/avatar/defaults

Add default avatar.

DELETE /admin/general/avatar/defaults/:avatarName

Delete default avatar.

GET /admin/general/avatar/formats

Get supported avatar formats.

GET /admin/general/lobby-melody

Get lobby music settings.

PATCH /admin/general/lobby-melody

Update lobby music.

GET /admin/general/seo

Get SEO settings.

PATCH /admin/general/seo

Update SEO settings.

GET /admin/general/seo/meta-tags

Get meta tags.

GET /admin/general/seo/analytics

Get SEO analytics.

Features & Maintenance

GET /admin/general/features

Get all feature flags.

PATCH /admin/general/features

Update multiple features.

GET /admin/general/features/keys

Get all feature keys.

GET /admin/general/features/:feature

Get specific feature status.

POST /admin/general/features/:feature/enable

Enable feature.

POST /admin/general/features/:feature/disable

Disable feature.

POST /admin/general/features/:feature/toggle

Toggle feature.

GET /admin/general/maintenance

Get maintenance mode status.

POST /admin/general/maintenance/enable

Enable maintenance mode. No body.

POST /admin/general/maintenance/disable

Disable maintenance mode.

Game Settings

GET /admin/game/settings

Get all game settings.

PATCH /admin/game/settings

Update game settings.

POST /admin/game/settings/reset

Reset to defaults.

GET /admin/game/settings/export

Export settings.

POST /admin/game/settings/import

Import settings.

GET /admin/game/ip-check

Get IP check configuration.

PATCH /admin/game/ip-check

Update IP check settings.

GET /admin/game/ip-check/status

Get IP check status.

POST /admin/game/ip-check/enable

Enable IP checking.

POST /admin/game/ip-check/disable

Disable IP checking.

POST /admin/game/ip-check/whitelist

Add an IP to the whitelist.

Request Body:

{
  "ip": "string"
}

DELETE /admin/game/ip-check/whitelist/:ip

Remove IP from whitelist.

GET /admin/game/move-time

Get move timeout configuration.

PATCH /admin/game/move-time

Update move time. All fields are optional.

Request Body:

{
  "defaultMoveTimeSeconds": "number (5-300)",
  "minMoveTimeSeconds": "number",
  "maxMoveTimeSeconds": "number",
  "extraTimeBank": "boolean",
  "timeBankSeconds": "number (0-600)",
  "timeBankRefillHands": "number (1-100)",
  "warningTimeSeconds": "number"
}

GET /admin/game/timeout

Get timeout settings.

PATCH /admin/game/timeout

Update timeout settings.

GET /admin/game/showdown

Get showdown settings.

PATCH /admin/game/showdown

Update showdown settings. All fields are optional.

Request Body:

{
  "showdownDelaySeconds": "number (1-30)",
  "autoMuckEnabled": "boolean",
  "showWinningHand": "boolean",
  "showAllHandsAtShowdown": "boolean",
  "muckedHandRevealDelay": "number (0-30)"
}

GET /admin/game/virtual-chip

Get virtual chip configuration.

PATCH /admin/game/virtual-chip

Update virtual chip settings. All fields are optional.

Request Body:

{
  "enabled": "boolean",
  "replenishAmount": "number",
  "replenishThreshold": "number",
  "cooldownMinutes": "number (0-1440)",
  "maxReplenishPerDay": "number (0-100)",
  "initialChips": "number"
}

GET /admin/game/rake

Get rake settings.

PATCH /admin/game/rake

Update rake settings. All fields are optional.

Request Body:

{
  "enabled": "boolean",
  "defaultRakePercent": "number (0-100)",
  "maxRakePercent": "number (0-100)",
  "rakeCap": "number (0-1000)",
  "rakeCapByStakes": "boolean",
  "noFlopNoRake": "boolean",
  "headsUpRakePercent": "number (0-100)"
}

GET /admin/game/bot-timing

Get bot timing settings.

PATCH /admin/game/bot-timing

Update bot timing. All fields are optional.

Request Body:

{
  "enabled": "boolean",
  "minDelayMs": "number (0-30000)",
  "maxDelayMs": "number (max 60000)",
  "humanizeDelay": "boolean",
  "thinkingDelayMultiplier": "number (0.1-10)",
  "preActionDelay": "boolean"
}

GET /admin/game/chat

Get chat settings.

PATCH /admin/game/chat

Update chat settings.

GET /admin/game/chat/status

Get chat enabled status.

POST /admin/game/chat/enable

Enable table chat.

POST /admin/game/chat/disable

Disable table chat.

GET /admin/game/currency

Get currency settings.

PATCH /admin/game/currency

Update currency settings.

GET /admin/game/currency/symbol/:currency

Get currency symbol.

PUT /admin/game/currency/symbol/:currency

Set currency symbol.

POST /admin/game/currency/format

Format an amount.

Request Body:

{
  "amount": "number",
  "currency": "string (optional)"
}

Pages Management

GET /admin/pages

List all pages.

GET /admin/pages/stats

Get page statistics.

GET /admin/pages/slugs

Get all page slugs.

GET /admin/pages/visibility-options

Get visibility options.

GET /admin/pages/reserved-slugs

Get reserved slugs.

GET /admin/pages/check-slug

Check slug availability.

Query Parameters:

Parameter	Type
slug	string

POST /admin/pages/generate-slug

Generate slug from title.

Request Body:

{
  "title": "string"
}

GET /admin/pages/:pageId

Get page details.

GET /admin/pages/by-slug/:slug

Get page by slug.

POST /admin/pages

Create a page.

Request Body:

{
  "title": "string",
  "content": "string (optional)",
  "slug": "string (optional)",
  "visibility": "PUBLIC | GUESTS | REGISTERED (optional)",
  "isActive": "boolean (optional)"
}

PATCH /admin/pages/:pageId

Update page.

DELETE /admin/pages/:pageId

Delete page.

POST /admin/pages/:pageId/activate

Activate page.

POST /admin/pages/:pageId/deactivate

Deactivate page.

POST /admin/pages/:pageId/visibility

Set page visibility.

Content Blocks

GET /admin/content-blocks/types

Get available block types.

GET /admin/content-blocks/types/descriptions

Get block type descriptions.

GET /admin/content-blocks/types/:type/defaults

Get default values for block type.

GET /admin/pages/:pageId/blocks

Get blocks for page.

GET /admin/pages/:pageId/blocks/count

Get block count for page.

POST /admin/pages/:pageId/blocks

Add a content block.

Request Body:

{
  "pageId": "uuid",
  "type": "string",
  "name": "string (optional)",
  "content": "string",
  "settings": "object (optional)",
  "order": "number (optional)",
  "isActive": "boolean (optional)"
}

POST /admin/pages/:pageId/blocks/reorder

Reorder blocks.

Request Body:

{
  "blockOrder": [
    {
      "id": "uuid",
      "order": 0
    }
  ]
}

DELETE /admin/pages/:pageId/blocks

Delete all blocks from page.

GET /admin/content-blocks/:blockId

Get block details.

PATCH /admin/content-blocks/:blockId

Update block.

DELETE /admin/content-blocks/:blockId

Delete block.

POST /admin/content-blocks/:blockId/activate

Activate block.

POST /admin/content-blocks/:blockId/deactivate

Deactivate block.

POST /admin/content-blocks/:blockId/move-up

Move block up in order.

POST /admin/content-blocks/:blockId/move-down

Move block down in order.

POST /admin/content-blocks/:blockId/duplicate

Duplicate block.

CSS Styles

GET /admin/css-styles/settings

Get CSS settings.

PUT /admin/css-styles/settings

Update CSS settings.

GET /admin/css-styles/stats

Get CSS statistics.

GET /admin/css-styles/scopes

Get CSS scopes.

GET /admin/css-styles/reserved-names

Get reserved names.

GET /admin/css-styles/check-name

Check name availability.

GET /admin/css-styles/export

Export all CSS.

POST /admin/css-styles/import

Import CSS.

POST /admin/css-styles/minify

Minify CSS.

Request Body:

{
  "css": "string"
}

GET /admin/css-styles/compiled

Get compiled CSS for entire site.

GET /admin/css-styles/compiled/:pageId

Get compiled CSS for specific page.

GET /admin/css-styles

List CSS styles.

POST /admin/css-styles

Create a style.

Request Body:

{
  "name": "string",
  "description": "string (optional)",
  "content": "string",
  "scope": "global | page | component (optional)",
  "pageId": "uuid (optional)",
  "isActive": "boolean (optional)",
  "priority": "number (0-1000, optional)"
}

GET /admin/css-styles/by-name/:name

Get CSS style by name.

GET /admin/css-styles/:styleId

Get CSS style.

PUT /admin/css-styles/:styleId

Update CSS style.

DELETE /admin/css-styles/:styleId

Delete CSS style.

POST /admin/css-styles/:styleId/activate

Activate style.

POST /admin/css-styles/:styleId/deactivate

Deactivate style.

POST /admin/css-styles/:styleId/duplicate

Duplicate style.

Languages

GET /admin/languages

List all languages.

GET /admin/languages/active

Get active languages.

GET /admin/languages/stats

Get language statistics.

GET /admin/languages/default-code

Get default language code.

POST /admin/languages

Create a language.

Request Body:

{
  "name": "string",
  "code": "string (e.g. en or en-US)",
  "flag": "string (optional)",
  "isActive": "boolean (optional)",
  "rtl": "boolean (optional)"
}

GET /admin/languages/:languageId

Get language details.

GET /admin/languages/code/:code

Get language by code.

PUT /admin/languages/:languageId

Update language.

DELETE /admin/languages/:languageId

Delete language.

POST /admin/languages/:languageId/activate

Activate language.

POST /admin/languages/:languageId/deactivate

Deactivate language.

GET /admin/languages/:languageId/export

Export translations.

POST /admin/languages/import

Import translations.

POST /admin/languages/:languageId/copy-phrases

Copy phrases to another language.

Request Body:

{
  "targetLanguageId": "uuid",
  "overwrite": "boolean (optional)"
}

GET /admin/languages/:languageId/missing-translations

Get missing translations.

GET /admin/languages/:languageId/phrases

Get paginated phrases.

GET /admin/languages/:languageId/phrases/all

Get all phrases.

PUT /admin/languages/:languageId/phrases

Create or update a phrase.

Request Body:

{
  "key": "string",
  "value": "string"
}

GET /admin/languages/:languageId/phrases/:key

Get specific phrase.

DELETE /admin/languages/:languageId/phrases/:key

Delete phrase.

POST /admin/languages/:languageId/phrases/bulk-delete

Bulk delete phrases.

Table Styles

GET /admin/table-styles/stats

Get table style statistics.

GET /admin/table-styles/options

Get style options (colors, textures).

GET /admin/table-styles/check-name

Check name availability.

GET /admin/table-styles/active

Get active styles.

GET /admin/table-styles/default

Get default style.

GET /admin/table-styles

List table styles.

POST /admin/table-styles

Create a table style.

Request Body:

{
  "name": "string",
  "description": "string (optional)",
  "logoType": "TEXT | IMAGE | NONE (optional)",
  "logoText": "string (optional)",
  "logoImage": "url (optional)",
  "logoPosition": "center | top | bottom (optional)",
  "feltColor": "string (optional)",
  "railColor": "string (optional)",
  "accentColor": "string (optional)",
  "textColor": "string (optional)",
  "cardBackColor": "string (optional)",
  "cardBackImage": "url (optional)",
  "cardBackDesign": "stripes | diamonds | crosshatch | classic | ornate | geometric (optional)",
  "chipStyle": "classic | modern | minimal (optional)",
  "hudStyle": "string (optional)",
  "controlsStyle": "string (optional)",
  "tableLayout": "oval | round | rectangular (optional)",
  "customCss": "string (optional)",
  "isActive": "boolean (optional)",
  "isDefault": "boolean (optional)",
  "priority": "number (0-999, optional)",
  "playerPovMode": "boolean (optional)"
}

GET /admin/table-styles/by-name/:name

Get style by name.

GET /admin/table-styles/:styleId

Get table style.

PUT /admin/table-styles/:styleId

Update table style.

DELETE /admin/table-styles/:styleId

Delete table style.

POST /admin/table-styles/:styleId/activate

Activate style.

POST /admin/table-styles/:styleId/deactivate

Deactivate style.

POST /admin/table-styles/:styleId/set-default

Set as default style.

POST /admin/table-styles/:styleId/duplicate

Duplicate style.

Other Admin Routes

Admin 2FA

Method	Path	Auth	Description
GET	/admin/2fa/backup-codes	Admin	Get information about backup codes
POST	/admin/2fa/backup-codes	Admin	Regenerate backup codes
POST	/admin/2fa/disable	Admin	Disable 2FA for the current admin account
POST	/admin/2fa/setup	Admin	Generate TOTP secret and QR code for 2FA setup
GET	/admin/2fa/status	Admin	Get the current 2FA status for the admin account
POST	/admin/2fa/verify	Admin	Verify the TOTP code and enable 2FA This completes the 2FA setup process

Affiliates

Method	Path	Auth	Description
GET	/admin/affiliates/codes	Admin; toggle affiliates	List all referral codes with pagination
GET	/admin/affiliates/codes/:code	Admin; toggle affiliates	Look up a referral code by code string
DELETE	/admin/affiliates/codes/:userId	Super admin; toggle affiliates	Delete a user’s referral code
POST	/admin/affiliates/codes/:userId/regenerate	Super admin; toggle affiliates	Regenerate a user’s referral code
GET	/admin/affiliates/leaderboard	Admin; toggle affiliates	Get affiliate leaderboard
GET	/admin/affiliates/levels	Admin; toggle affiliates	List all affiliate commission levels
POST	/admin/affiliates/levels	Super admin; toggle affiliates	Create a new affiliate level
DELETE	/admin/affiliates/levels/:level	Super admin; toggle affiliates	Delete an affiliate level
PATCH	/admin/affiliates/levels/:level	Super admin; toggle affiliates	Update an affiliate level’s reward
GET	/admin/affiliates/overview	Admin; toggle affiliates	Get affiliate system overview and global statistics
GET	/admin/affiliates/referrals	Admin; toggle affiliates	List all referral registrations with filters
GET	/admin/affiliates/referrals/:id	Admin; toggle affiliates	Get a specific referral registration
POST	/admin/affiliates/referrals/:id/confirm	Super admin; toggle affiliates	Confirm a pending referral registration
POST	/admin/affiliates/referrals/:id/reject	Super admin; toggle affiliates	Reject a referral registration
POST	/admin/affiliates/referrals/:id/reward	Super admin; toggle affiliates	Mark a referral as rewarded
POST	/admin/affiliates/referrals/auto-confirm	Super admin; toggle affiliates	Auto-confirm all verified referrals
GET	/admin/affiliates/rewards	Admin; toggle affiliates	List all affiliate rewards with filters
GET	/admin/affiliates/rewards/stats	Admin; toggle affiliates	Get global affiliate reward statistics
POST	/admin/affiliates/users/:userId/link	Super admin; toggle affiliates	Link a user to a referrer
POST	/admin/affiliates/users/:userId/unlink	Super admin; toggle affiliates	Unlink a user from their referrer

Affiliate Fraud

Method	Path	Auth	Description
GET	/admin/affiliate-fraud	Admin	List fraud flags with filters
GET	/admin/affiliate-fraud/:id	Admin	Get fraud flag details with evidence
PATCH	/admin/affiliate-fraud/:id	Admin	Confirm or dismiss a fraud flag

Agents and Hierarchy

Method	Path	Auth	Description
GET	/admin/agents	Admin; toggle agents	List all agents with pagination and filtering
GET	/admin/agents/:agentId	Admin; toggle agents	Get detailed information about a specific agent
GET	/admin/agents/:agentId/ancestors	Admin	Get ancestor chain from root to parent
POST	/admin/agents/:agentId/balance	Admin; toggle agents	Adjust an agent’s balance (credit or debit)
GET	/admin/agents/:agentId/children	Admin	Get direct children of an agent
PUT	/admin/agents/:agentId/commission-template	Admin	Assign a commission template to an agent
PUT	/admin/agents/:agentId/credit-line	Admin; toggle agents	Set credit line amount for an agent
PUT	/admin/agents/:agentId/custom-role	Admin	Assign a custom role to an agent
PUT	/admin/agents/:agentId/detach	Admin	Detach agent from parent (make top-level)
PUT	/admin/agents/:agentId/financial-freeze	Admin; toggle agents	Freeze or unfreeze an agent’s financial operations
GET	/admin/agents/:agentId/financial-limits	Admin; toggle agents	Get current financial limits for an agent
PUT	/admin/agents/:agentId/financial-limits	Admin; toggle agents	Set financial limits for an agent
GET	/admin/agents/:agentId/financial-overview	Admin; toggle agents	Get complete financial state for an agent (limits, credit line, wholesale, freeze)
PUT	/admin/agents/:agentId/permissions	Admin	Set per-agent permission overrides
GET	/admin/agents/:agentId/players	Admin; toggle agents	Get paginated list of players assigned to an agent
POST	/admin/agents/:agentId/players	Admin; toggle agents	Assign a player to an agent
DELETE	/admin/agents/:agentId/players/:playerId	Admin; toggle agents	Remove a player from an agent
PUT	/admin/agents/:agentId/reassign	Admin	Reassign agent to a new parent
PUT	/admin/agents/:agentId/role-tier	Admin; toggle agents	Assign a role tier to an agent
PUT	/admin/agents/:agentId/status	Admin	Update agent status (active, suspended, pending_kyc, closed)
GET	/admin/agents/:agentId/subtree	Admin	Get all agents in subtree
PUT	/admin/agents/:agentId/wholesale-discount	Admin; toggle agents	Set wholesale discount percentage for an agent
DELETE	/admin/agents/:userId/designate	Admin; toggle agents	Remove agent status from a user
POST	/admin/agents/:userId/designate	Admin; toggle agents	Designate a user as an agent
POST	/admin/agents/hierarchy	Admin	Create an agent with hierarchy placement
GET	/admin/agents/hierarchy/tree	Admin	Get all agents with user info and hierarchy data for tree visualization
GET	/admin/agents/legacy-count	Admin; toggle agents	Count legacy agents (isAgent=true with no Agent hierarchy record)
POST	/admin/agents/migrate	Admin; toggle agents	Migrate all legacy agents (isAgent=true without an Agent record) to the new hierarchy model
GET	/admin/agents/pending-approvals	Admin; toggle agents	List all pending transaction approvals across all agents

Agent Role Tiers

Method	Path	Auth	Description
GET	/admin/agent-role-tiers	Admin; toggle agents	List all role tiers, ordered by depthLevel ASC
POST	/admin/agent-role-tiers	Admin; toggle agents	Create a new role tier
DELETE	/admin/agent-role-tiers/:id	Admin; toggle agents	Delete a role tier (fails if agents are assigned)
GET	/admin/agent-role-tiers/:id	Admin; toggle agents	Get a single role tier with count of assigned agents
PUT	/admin/agent-role-tiers/:id	Admin; toggle agents	Update a role tier

Commission Templates

Method	Path	Auth	Description
GET	/admin/commission-templates	Admin	List all commission templates
POST	/admin/commission-templates	Admin	Create a new commission template
DELETE	/admin/commission-templates/:id	Admin	Delete a commission template (fails if agents are assigned)
GET	/admin/commission-templates/:id	Admin	Get a single commission template with count of assigned agents
PUT	/admin/commission-templates/:id	Admin	Update a commission template

Custom Roles

Method	Path	Auth	Description
GET	/admin/custom-roles	Admin	List all custom roles
POST	/admin/custom-roles	Admin	Create a new custom role
DELETE	/admin/custom-roles/:id	Admin	Delete a custom role (fails if agents are assigned)
GET	/admin/custom-roles/:id	Admin	Get a single custom role with count of assigned agents
PUT	/admin/custom-roles/:id	Admin	Update a custom role

Settlements

Method	Path	Auth	Description
GET	/admin/settlements	Admin	List all settlements with pagination, filterable by agentId, status, date range
GET	/admin/settlements/:id	Admin	Get a single settlement with full breakdown
PUT	/admin/settlements/:id/approve	Admin	Mark a settlement as approved
PUT	/admin/settlements/:id/dispute	Admin	Mark a settlement as disputed with a reason
PUT	/admin/settlements/:id/pay	Admin	Mark a settlement as paid and credit the agent’s balance
POST	/admin/settlements/agent/:agentId	Admin	Trigger ad-hoc settlement for a specific agent
POST	/admin/settlements/run	Admin	Trigger a scheduled settlement run for all due agents

Holdback Releases

Method	Path	Auth	Description
GET	/admin/holdback-releases	Admin	List settlement holdback releases

AML Reviews

Method	Path	Auth	Description
GET	/admin/aml-reviews	Admin; toggle amlReviews	List AML reviews with filtering and pagination
GET	/admin/aml-reviews/:id	Admin; toggle amlReviews	Get AML review details
POST	/admin/aml-reviews/:id/approve	Admin; toggle amlReviews	Approve an AML review, allowing the transaction to proceed
PATCH	/admin/aml-reviews/:id/notes	Admin; toggle amlReviews	Update review notes for an AML review
POST	/admin/aml-reviews/:id/reject	Admin; toggle amlReviews	Reject an AML review, blocking the transaction
GET	/admin/aml-reviews/pending	Admin; toggle amlReviews	List pending AML reviews (shortcut for status=PENDING)
GET	/admin/aml-reviews/stats	Admin; toggle amlReviews	Get AML review statistics

App Config

Method	Path	Auth	Description
GET	/admin/app/config	Admin	Get current app configuration
PATCH	/admin/app/config	Super admin	Update app configuration (minSupportedVersion, updateUrl)

Archival

Method	Path	Auth	Description
GET	/admin/archival/eligible	Admin	Get count of transactions eligible for archival
POST	/admin/archival/restore/:transactionId	Super admin	Restore an archived transaction back to the main table
POST	/admin/archival/run	Super admin	Trigger transaction archival
GET	/admin/archival/stats	Admin	Get archival statistics
GET	/admin/archival/transactions/:userId	Admin	Get archived transactions for a user

Audit Log

Method	Path	Auth	Description
GET	/admin/audit-log	Admin	List admin audit trail entries with filtering and pagination

Auth Config

Method	Path	Auth	Description
GET	/admin/auth-config	Super admin	List auth configuration for all permission levels
DELETE	/admin/auth-config/:level	Super admin	Reset auth configuration for a permission level back to defaults
GET	/admin/auth-config/:level	Super admin	Get auth configuration for a specific permission level
PUT	/admin/auth-config/:level	Super admin	Update auth configuration for a specific permission level

Bots

Method	Path	Auth	Description
GET	/admin/bots	Admin	List all bots in the system
POST	/admin/bots	Admin	Create a new bot in the pool
DELETE	/admin/bots/:botId	Admin	Remove a bot from the system
GET	/admin/bots/:botId	Admin	Get a specific bot’s details
PATCH	/admin/bots/:botId	Admin	Update bot configuration (name, avatar, strategy, delays, buy-in)
POST	/admin/bots/:botId/avatar	Admin	Upload a custom avatar image for a bot
POST	/admin/bots/:botId/disable	Admin	Disable a bot from taking actions
POST	/admin/bots/:botId/enable	Admin	Enable a bot to take actions
PATCH	/admin/bots/:botId/strategy	Admin	Change a bot’s strategy
GET	/admin/bots/avatars	Admin	Get list of default bot avatar URLs
GET	/admin/bots/identities	Admin	List all identities with status
POST	/admin/bots/identities	Admin	Add a single identity
DELETE	/admin/bots/identities/:id	Admin	Remove an identity — returns 409 if currently in use
POST	/admin/bots/identities/bulk	Admin	Bulk add identities
POST	/admin/bots/pool/replenish	Admin	Replenish the bot pool to minimum size
GET	/admin/bots/scheduler/auto-fill	Admin	Lists all per-table auto-fill configs
DELETE	/admin/bots/scheduler/auto-fill/:tableId	Admin	Removes auto-fill config for a table
GET	/admin/bots/scheduler/auto-fill/:tableId	Admin	Returns auto-fill config for a specific table
PUT	/admin/bots/scheduler/auto-fill/:tableId	Admin	Creates or updates auto-fill config for a table
GET	/admin/bots/scheduler/config	Admin	Returns the full scheduler configuration
PUT	/admin/bots/scheduler/config	Admin	Updates scheduler config
GET	/admin/bots/scheduler/sessions	Admin	Returns all active sessions with bot info, identity, table, timing, and stacks
GET	/admin/bots/scheduler/sessions/:botId/history	Admin	Returns session history for a specific bot
POST	/admin/bots/scheduler/start	Admin	Starts the scheduler
GET	/admin/bots/scheduler/status	Admin	Returns scheduler running state, active session count, and last check timestamp
POST	/admin/bots/scheduler/stop	Admin	Stops the scheduler
GET	/admin/bots/stats	Admin	Get bot manager statistics
GET	/admin/bots/strategies	Admin	Get available bot strategies (from DB-backed strategy profiles)
GET	/admin/bots/strategy-profiles	Admin	List all strategy profiles (built-in first, then custom)
POST	/admin/bots/strategy-profiles	Admin	Create a custom strategy profile
DELETE	/admin/bots/strategy-profiles/:id	Admin	Delete a custom strategy profile
GET	/admin/bots/strategy-profiles/:id	Admin	Get a single strategy profile by ID
PUT	/admin/bots/strategy-profiles/:id	Admin	Update a strategy profile

Bulk Email

Method	Path	Auth	Description
POST	/admin/bulk-emails/audience-count	Admin	Estimate audience count for given targeting criteria

Chargebacks

Method	Path	Auth	Description
GET	/admin/chargebacks	Admin; toggle chargebacks	List chargebacks with filters
GET	/admin/chargebacks/:id	Admin; toggle chargebacks	Get chargeback details with history
PATCH	/admin/chargebacks/:id	Admin; toggle chargebacks	Update chargeback status
GET	/admin/chargebacks/:id/audit	Admin; toggle chargebacks	Get complete audit trail for a chargeback
POST	/admin/chargebacks/:id/evidence	Admin; toggle chargebacks	Add evidence files to a chargeback
POST	/admin/chargebacks/bulk-import	Admin; toggle chargebacks	Bulk import chargebacks from CSV data

Circuit Breakers

Method	Path	Auth	Description
GET	/admin/circuits	Admin	List all available circuit breakers
POST	/admin/circuits/:name/reset	Super admin	Manually reset a circuit breaker to CLOSED state

Coupons

Method	Path	Auth	Description
PATCH	/admin/coupons/:couponId	Admin; toggle coupons	Update a coupon (description, expiresAt, isActive)
GET	/admin/coupons/redemptions	Admin; toggle coupons	Get coupon redemption history

Dead Letter Queue

Method	Path	Auth	Description
GET	/admin/dead-letter-queue	Admin	List DLQ items with filtering and pagination
DELETE	/admin/dead-letter-queue/:id	Super admin	Delete a specific DLQ item
GET	/admin/dead-letter-queue/:id	Admin	Get a specific DLQ item by ID
POST	/admin/dead-letter-queue/:id/retry	Super admin	Force retry a specific DLQ item
GET	/admin/dead-letter-queue/stats	Admin	Get DLQ statistics

Deposit Requests

Method	Path	Auth	Description
POST	/admin/deposit-requests/:depositId/approve	Admin	Approve a pending deposit request (credits user’s balance)
POST	/admin/deposit-requests/:depositId/reject	Admin	Reject a pending deposit request
GET	/admin/deposit-requests/pending	Admin	Get all pending deposit requests with pagination
GET	/admin/deposit-requests/pending-count	Admin	Get count of pending deposit requests

Developer Partners

Method	Path	Auth	Description
GET	/admin/developer/audit-log	Admin	Paginated audit log with filters
DELETE	/admin/developer/keys/:keyId	Admin	Revoke an API key immediately
PUT	/admin/developer/keys/:keyId	Admin	Update mutable fields on an API key
POST	/admin/developer/keys/:keyId/rotate	Admin	Rotate the secret for an API key
GET	/admin/developer/partners	Admin	List partners with pagination and filters
POST	/admin/developer/partners	Admin	Create a new partner (admin-created, auto-approved)
DELETE	/admin/developer/partners/:id	Admin	Delete a partner (requires confirm=true query param)
GET	/admin/developer/partners/:id	Admin	Get a single partner with stats
PUT	/admin/developer/partners/:id	Admin	Update partner fields
POST	/admin/developer/partners/:id/approve	Admin	Approve a pending partner, optionally generating an API key
POST	/admin/developer/partners/:id/reactivate	Admin	Reactivate a suspended partner
POST	/admin/developer/partners/:id/reject	Admin	Reject a partner (deletes the record)
POST	/admin/developer/partners/:id/suspend	Admin	Suspend an active partner
POST	/admin/developer/partners/:id/webhook-secret	Admin	Generate (or rotate) a webhook signing secret for a partner
GET	/admin/developer/partners/:partnerId/keys	Admin	List API keys for a partner (never includes decrypted secrets)
POST	/admin/developer/partners/:partnerId/keys	Admin	Generate a new API key for a partner
GET	/admin/developer/partners/:partnerId/users	Admin	List external user mappings for a partner (paginated)
GET	/admin/developer/settings	Super admin	Get developer settings (super admin only)
PUT	/admin/developer/settings	Super admin	Update developer settings (super admin only)
GET	/admin/developer/webhooks/deliveries	Admin	Paginated webhook deliveries with filters
POST	/admin/developer/webhooks/deliveries/:id/retry	Admin	Manually retry a failed webhook delivery
GET	/admin/developer/webhooks/stats	Admin	Aggregate delivery stats

Economy

Method	Path	Auth	Description
GET	/admin/economy/packages	Admin	List currency packages
POST	/admin/economy/packages	Super admin	Create a currency package
DELETE	/admin/economy/packages/:packageId	Super admin	Delete a currency package
PATCH	/admin/economy/packages/:packageId	Super admin	Update a currency package
GET	/admin/economy/rates	Admin	List currency rates
POST	/admin/economy/rates	Super admin	Set a currency rate
GET	/admin/economy/reconciliation	Admin	Run economy reconciliation
GET	/admin/economy/settings	Admin	Get economy settings
PUT	/admin/economy/settings	Super admin	Update economy settings
GET	/admin/economy/summary	Admin	Get wallet and economy summary

Email Templates

Method	Path	Auth	Description
GET	/admin/email-templates/:templateId/default	Admin	Get the default content for a system template
POST	/admin/email-templates/:templateId/duplicate	Admin	Duplicate an email template
POST	/admin/email-templates/:templateId/revert	Admin	Revert a system template to its default content

Financial Summary

Method	Path	Auth	Description
GET	/admin/financial/summary	Admin	Get financial summary for dashboard cards with optional date range and period comparison

Fraud Alerts

Method	Path	Auth	Description
GET	/admin/fraud-alerts	Admin; toggle fraudAlerts	List fraud alerts with filters
GET	/admin/fraud-alerts/:id	Admin; toggle fraudAlerts	Get fraud alert details with evidence
PATCH	/admin/fraud-alerts/:id	Admin; toggle fraudAlerts	Update fraud alert status, assignment, or resolution
GET	/admin/fraud-alerts/:id/related	Admin; toggle fraudAlerts	Get related accounts and alerts for investigation

Fraud Cases

Method	Path	Auth	Description
GET	/admin/fraud-cases	Admin; toggle fraudAlerts	List fraud cases
GET	/admin/fraud-cases/:id	Admin; toggle fraudAlerts	Get a fraud case
PATCH	/admin/fraud-cases/:id	Admin; toggle fraudAlerts	Update a fraud case
POST	/admin/fraud-cases/:id/reopen	Admin; toggle fraudAlerts	Reopen a fraud case
GET	/admin/fraud-cases/:id/replay-fixture	Admin; toggle fraudAlerts	Get a fraud case replay fixture
GET	/admin/fraud-cases/detector-configs	Admin; toggle fraudAlerts	List detector configs
POST	/admin/fraud-cases/detector-configs	Admin; toggle fraudAlerts	Create a detector config
POST	/admin/fraud-cases/detector-configs/:detectorName/:version/promote	Admin; toggle fraudAlerts	Promote a detector config version
POST	/admin/fraud-cases/detector-configs/:detectorName/rollback	Admin; toggle fraudAlerts	Roll back a detector config
POST	/admin/fraud-cases/sweep	Admin; toggle fraudAlerts	Run a fraud sweep

Game Scheduler

Method	Path	Auth	Description
GET	/admin/game-scheduler/config	Admin	Returns the game scheduler configuration
PUT	/admin/game-scheduler/config	Admin	Updates game scheduler config
POST	/admin/game-scheduler/force-check	Admin	Triggers an immediate scheduler check
POST	/admin/game-scheduler/quick-setup	Admin	Execute a quick-setup config to generate templates
POST	/admin/game-scheduler/quick-setup/preview	Admin	Preview the templates that would be created by a quick-setup config
POST	/admin/game-scheduler/start	Admin	Starts the game scheduler
GET	/admin/game-scheduler/status	Admin	Returns scheduler status with stats
POST	/admin/game-scheduler/stop	Admin	Stops the game scheduler
GET	/admin/game-scheduler/templates	Admin	List templates with optional filters and pagination
POST	/admin/game-scheduler/templates	Admin	Create a new table template
DELETE	/admin/game-scheduler/templates/:id	Admin	Delete a template
GET	/admin/game-scheduler/templates/:id	Admin	Get a single template by ID
PUT	/admin/game-scheduler/templates/:id	Admin	Update a template
POST	/admin/game-scheduler/templates/:id/disable	Admin	Disable a template
POST	/admin/game-scheduler/templates/:id/enable	Admin	Enable a template

Game History

Method	Path	Auth	Description
GET	/admin/games	Admin	List games
GET	/admin/games/:gameId	Admin	Get a game
GET	/admin/games/:gameId/audit	Admin	Get a game audit trail
POST	/admin/games/:gameId/procedure/repair	Admin	Apply a hand repair procedure
POST	/admin/games/:gameId/procedure/void	Admin	Void a hand

Groups

Method	Path	Auth	Description
DELETE	/admin/groups/:groupId/permissions	Super admin	Remove all feature overrides for a group (revert to hierarchy defaults)
GET	/admin/groups/:groupId/permissions	Super admin	Get the effective permissions for a group (hierarchy + overrides)
PUT	/admin/groups/:groupId/permissions	Super admin	Set feature overrides for a group
DELETE	/admin/groups/:groupId/permissions/:feature	Super admin	Remove a specific feature override (revert to hierarchy default)

Languages

Method	Path	Auth	Description
GET	/admin/languages/:languageId/namespaces	Admin	Get distinct namespace prefixes for a language
POST	/admin/languages/:languageId/seed-defaults	Admin	Seed default English phrases for a language

License

Method	Path	Auth	Description
GET	/admin/license	Admin	Get current license status and details
GET	/admin/license/logs	Admin	View license verification history
POST	/admin/license/verify	Admin	Trigger an immediate license re-verification

Logs

Method	Path	Auth	Description
GET	/admin/logs/errors	Admin	List error logs
GET	/admin/logs/performance	Admin	List performance logs
GET	/admin/logs/security	Admin	List security logs

Pages

Method	Path	Auth	Description
DELETE	/admin/pages/:pageId/groups	Admin	Remove all group access for a page
GET	/admin/pages/:pageId/groups	Admin	Get group access entries for a page
PUT	/admin/pages/:pageId/groups	Admin	Set group access for a page (replaces all existing)

Payment Systems

Method	Path	Auth	Description
GET	/admin/payment-systems	Admin	List all payment systems (without sensitive config)
POST	/admin/payment-systems	Super admin	Create a new payment system
DELETE	/admin/payment-systems/:id	Super admin	Delete a payment system
GET	/admin/payment-systems/:id	Admin	Get a single payment system
PATCH	/admin/payment-systems/:id	Super admin	Update payment system toggles (deposits/withdrawals enabled)
POST	/admin/payment-systems/:id/test	Super admin	Test payment provider connection/configuration
GET	/admin/payment-systems/provider-types	Admin	Get list of available provider types (built-in + plugin-registered)

Plugins

Method	Path	Auth	Description
GET	/admin/plugins	Admin	List all installed plugins
DELETE	/admin/plugins/:id	Super admin	Delete an inactive plugin (super-admin only)
GET	/admin/plugins/:id	Admin	Get single plugin details
POST	/admin/plugins/:id/activate	Super admin	Activate a plugin (super-admin only)
POST	/admin/plugins/:id/deactivate	Super admin	Deactivate a plugin (super-admin only)
POST	/admin/plugins/:id/upgrade	Super admin	Upgrade a plugin with a new .tgz file (super-admin only)
POST	/admin/plugins/:providerType/health-check	Admin	Trigger an on-demand health check for a plugin (admin only)
GET	/admin/plugins/:providerType/settings	Admin	Get all settings for a plugin
PUT	/admin/plugins/:providerType/settings	Super admin	Save settings for a plugin (super-admin only)
POST	/admin/plugins/upload	Super admin	Upload and install a plugin .tgz file (super-admin only)

Private Tables

Method	Path	Auth	Description
GET	/admin/private-tables	Admin	List all private tables with pagination and search
DELETE	/admin/private-tables/:id	Admin	Delete a private table (DB record + in-memory game table)
PATCH	/admin/private-tables/:id/style	Admin	Assign or clear the visual style for a private table

Sanctions Checks

Method	Path	Auth	Description
GET	/admin/sanctions-checks	Admin; toggle kycVerification	List sanctions checks with filtering and pagination
GET	/admin/sanctions-checks/:id	Admin; toggle kycVerification	Get sanctions check details
POST	/admin/sanctions-checks/:id/recheck	Admin; toggle kycVerification	Re-run a sanctions check for a user
GET	/admin/sanctions-checks/stats	Admin; toggle kycVerification	Get sanctions check statistics

Sessions

Method	Path	Auth	Description
GET	/admin/sessions	Admin	List all table sessions with optional filters
GET	/admin/sessions/:sessionId	Admin	Get detailed information about a specific table session

Settings

Method	Path	Auth	Description
GET	/admin/settings/agent-hierarchy	Admin; toggle agents	Get current agent hierarchy settings
PATCH	/admin/settings/agent-hierarchy	Admin; toggle agents	Update agent hierarchy settings (partial update)
POST	/admin/settings/agent-hierarchy/reset	Admin; toggle agents	Reset agent hierarchy settings to defaults
GET	/admin/settings/agent-profit	Admin; toggle agents	Get current agent profit settings
PATCH	/admin/settings/agent-profit	Admin; toggle agents	Update agent profit settings (partial update)
GET	/admin/settings/agent-transfer-policy	Admin; toggle agents	Get current agent-to-agent transfer policy
PUT	/admin/settings/agent-transfer-policy	Admin; toggle agents	Set agent-to-agent transfer policy
POST	/admin/settings/test-smtp	Super admin	Test SMTP configuration with optional test email

System

Method	Path	Auth	Description
DELETE	/admin/system/drain	Super admin	Cancel a live session drain
GET	/admin/system/drain	Super admin	Get live session drain status
POST	/admin/system/drain	Super admin	Begin a live session drain
POST	/admin/system/drain/finalize	Super admin	Finalize a live session drain

System Emails

Method	Path	Auth	Description
GET	/admin/system-emails	Admin	Get all system email configurations
PATCH	/admin/system-emails/:eventType	Super admin	Update configuration for a specific system email event
POST	/admin/system-emails/:eventType/test	Admin	Send a test email for a specific system email event type

Table Styles

Method	Path	Auth	Description
POST	/admin/table-styles/:styleId/set-default-private	Admin	Set a table style as the default for private tables
GET	/admin/table-styles/default-private	Admin	Get the default table style for private tables

Tables

Method	Path	Auth	Description
DELETE	/admin/tables/:tableId/bot-autofill	Admin	Removes auto-fill config for a table
GET	/admin/tables/:tableId/bot-autofill	Admin	Returns auto-fill config for a table (or 404 if none)
PUT	/admin/tables/:tableId/bot-autofill	Admin	Creates or updates auto-fill config for a table
DELETE	/admin/tables/:tableId/bots	Admin	Remove all bots from a table
GET	/admin/tables/:tableId/bots	Admin	Get all bots at a specific table
POST	/admin/tables/:tableId/bots	Admin	Add a bot to a table
DELETE	/admin/tables/:tableId/bots/:botId	Admin	Remove a bot from a table
POST	/admin/tables/:tableId/bots/fill	Admin	Fill empty seats at a table with bots
POST	/admin/tables/:tableId/force-timeout	Admin	Force-timeout the current player at a table (admin recovery tool)
POST	/admin/tables/:tableId/players/:playerId/remove	Admin	Force-remove a player from a table (admin recovery tool)
POST	/admin/tables/:tableId/reload	Admin	Reload an orphaned table from the database into memory
POST	/admin/tables/bulk-delete	Admin	Delete multiple poker tables
GET	/admin/tables/count	Admin	Get total and active table counts for dashboard

Tickets

Method	Path	Auth	Description
POST	/admin/tickets/:ticketId/refund	Admin	Manually refund a single ACTIVE satellite ticket
GET	/admin/tickets/tournament/:tournamentId	Admin	Get all tickets for a satellite tournament

Tournaments

Method	Path	Auth	Description
GET	/admin/tournaments	Admin	List tournaments with filtering and pagination
POST	/admin/tournaments	Admin	Create a new tournament
DELETE	/admin/tournaments/:id	Admin	Delete a tournament
GET	/admin/tournaments/:id	Admin	Get a single tournament by ID (full data for admin editing)
PATCH	/admin/tournaments/:id	Admin	Update a tournament
POST	/admin/tournaments/:id/advance-level	Admin	Advance the tournament blind/ante level by rule-profile timing policy
POST	/admin/tournaments/:id/break	Admin	Schedule a synchronized break
POST	/admin/tournaments/:id/cancel	Admin	Cancel a tournament
GET	/admin/tournaments/:id/clock	Admin	Get tournament clock, level, ante, break, and pause state
GET	/admin/tournaments/:id/floor	Admin	Get tournament floor state
POST	/admin/tournaments/:id/floor/hand-for-hand	Admin	Floor: set hand-for-hand
POST	/admin/tournaments/:id/floor/hand-repair	Admin	Floor: repair a hand
POST	/admin/tournaments/:id/floor/hand-void	Admin	Floor: void a hand
POST	/admin/tournaments/:id/floor/note	Admin	Floor: add a note
POST	/admin/tournaments/:id/floor/pause	Admin	Floor: pause
POST	/admin/tournaments/:id/floor/payout-hold	Admin	Floor: hold payouts
POST	/admin/tournaments/:id/floor/payout-release	Admin	Floor: release payouts
POST	/admin/tournaments/:id/floor/player-penalty	Admin	Floor: penalize a player
POST	/admin/tournaments/:id/floor/player-sit-out	Admin	Floor: sit out a player
POST	/admin/tournaments/:id/floor/player-warning	Admin	Floor: warn a player
POST	/admin/tournaments/:id/floor/resume	Admin	Floor: resume
POST	/admin/tournaments/:id/floor/seating-repair	Admin	Floor: repair seating
POST	/admin/tournaments/:id/force-end	Admin	Force-end a tournament with configurable mode
POST	/admin/tournaments/:id/hand-for-hand	Admin	Activate or deactivate hand-for-hand mode for a running tournament
GET	/admin/tournaments/:id/health	Admin	Run all invariant checks for a tournament and return a health report
GET	/admin/tournaments/:id/history	Admin	Get audited admin tournament level, break, pause, resume, and control changes
POST	/admin/tournaments/:id/pause	Admin	Pause a running tournament
POST	/admin/tournaments/:id/resume	Admin	Resume a paused tournament
POST	/admin/tournaments/:id/start	Admin	Start a tournament
GET	/admin/tournaments/count	Admin	Get tournament counts by status
GET	/admin/tournaments/sng-templates	Admin	List all SnG templates with count of active instances
POST	/admin/tournaments/sng-templates	Admin	Create a new SnG template tournament, then create the first lobby instance
DELETE	/admin/tournaments/sng-templates/:id	Admin	Soft deactivate: set autoCreate to false on the template (stops new instance creation)
PUT	/admin/tournaments/sng-templates/:id	Admin	Update template fields

Transactions

Method	Path	Auth	Description
GET	/admin/transactions	Admin	Get transactions with filtering and pagination
GET	/admin/transactions/:id	Admin	Get a single transaction with user info and payment provider data
PUT	/admin/transactions/:id/approve	Admin; toggle agents	Approve a pending transaction
PUT	/admin/transactions/:id/reject	Admin; toggle agents	Reject a pending transaction
GET	/admin/transactions/method-volume	Admin	Get transaction volume breakdown by payment method for deposits and withdrawals
GET	/admin/transactions/provider-stats	Admin	Get deposit success rates by payment provider/method
GET	/admin/transactions/stats	Admin	Get deposit statistics for summary cards
GET	/admin/transactions/top-users	Admin	Get top depositors and withdrawers for the period
GET	/admin/transactions/type-distribution	Admin	Get transaction volume breakdown by type
GET	/admin/transactions/volume	Admin	Get daily transaction volume for deposits and withdrawals

Updates

Method	Path	Auth	Description
GET	/admin/updates	Admin	Get update status
POST	/admin/updates/apply	Super admin	Apply an update
POST	/admin/updates/check	Super admin	Check for updates
PATCH	/admin/updates/config	Super admin	Update updater configuration
GET	/admin/updates/history	Admin	List update runs
GET	/admin/updates/history/:runId	Admin	Get an update run
GET	/admin/updates/logs	Admin	Get updater logs
POST	/admin/updates/preflight	Super admin	Run update preflight checks

Users

Method	Path	Auth	Description
POST	/admin/users/:userId/balance-adjustment	Admin	Adjust a user’s balance (requires admin password verification)
GET	/admin/users/:userId/balance-adjustment/history	Admin	Get balance adjustment history for a user
POST	/admin/users/:userId/force-disconnect	Admin	Force-disconnect a user: revoke sessions, disconnect sockets, optionally remove from table
POST	/admin/users/:userId/freeze	Admin	Freeze a user account for fraud investigation
POST	/admin/users/:userId/reset-2fa	Admin	Reset a user’s 2FA (disables 2FA without token verification)
POST	/admin/users/:userId/unfreeze	Admin	Unfreeze a user account after fraud investigation
GET	/admin/users/count	Admin	Get total and active user counts for dashboard

Verification Requests

Method	Path	Auth	Description
PATCH	/admin/verification-requests/:requestId/notes	Admin; toggle kycVerification	Update review notes for a verification request

Wallet Aggregator

Method	Path	Auth	Description
GET	/admin/wallet-aggregator/adapter-types	Super admin	List wallet adapter types
GET	/admin/wallet-aggregator/discrepancies	Super admin	List wallet discrepancies
POST	/admin/wallet-aggregator/discrepancies/:id/resolve	Super admin	Resolve a wallet discrepancy
GET	/admin/wallet-aggregator/health	Super admin	Get wallet aggregator health
GET	/admin/wallet-aggregator/providers	Super admin	List wallet providers
POST	/admin/wallet-aggregator/providers	Super admin	Create a wallet provider
DELETE	/admin/wallet-aggregator/providers/:id	Super admin	Delete a wallet provider
PUT	/admin/wallet-aggregator/providers/:id	Super admin	Update a wallet provider
POST	/admin/wallet-aggregator/providers/:id/test	Super admin	Test a wallet provider
GET	/admin/wallet-aggregator/rounds	Super admin	List game rounds
POST	/admin/wallet-aggregator/sessions	Super admin	Create a wallet session
GET	/admin/wallet-aggregator/transactions	Super admin	List wallet transactions

Word Filters

Method	Path	Auth	Description
GET	/admin/word-filters	Admin	List all word filters
POST	/admin/word-filters	Super admin	Add a word to the filter list
DELETE	/admin/word-filters/:id	Super admin	Remove a word from the filter list
PATCH	/admin/word-filters/:id	Super admin	Toggle word filter active state
POST	/admin/word-filters/batch	Super admin	Batch import words to the filter list

Rate Limiting

API endpoints are rate limited to prevent abuse:

Endpoint	Limit
Login	10 requests / 15 minutes
Registration	3 requests / hour
Forgot password	3 requests / hour
Reset password	5 requests / hour
Email verification	10 requests / hour
Token refresh	20 requests / minute
2FA verification	5 requests / 15 minutes
Authenticated user API	100 requests / minute
Admin reads	100 requests / minute
Admin writes	20 requests / minute
Tournament financial mutations	10 requests / minute

Rate limit headers are included in responses:

• RateLimit-Limit: Maximum requests allowed
• RateLimit-Remaining: Requests remaining
• RateLimit-Reset: Seconds until the limit resets

Versioning

The API uses URL versioning. Current version: v1.

The legacy paths /api/account, /api/statistics, /api/agent and /api/leaderboard redirect with 308 to their /api/v1 equivalents.