Reference

API Reference

Public API endpoints for casino/PAM server integrations.

Base URL: https://syncoralab.com/api/public/v1All partner endpoints live under the /api/public/v1 namespace.

Server-side only

These endpoints are intended for casino/PAM backend systems. Do not call them directly from public frontend code with a raw API key. For browser-side integrations, use the documented widget-token flow instead.

Ingest player events

POST/api/public/v1/ingest

Send player events from a casino/PAM backend to Syncora. Events drive CRM automation, segmentation, analytics, bonus orchestration, and gamification.

Headers
x-api-key: <partner-server-api-key>
content-type: application/json
Single event payload
json
{
  "player_id": "ext_123",
  "type": "deposit",
  "data": {
    "amount": 50,
    "currency": "EUR",
    "status": "completed"
  }
}
Batch payload
json
[
  {
    "player_id": "ext_123",
    "type": "login",
    "data": { "country": "DE" }
  },
  {
    "player_id": "ext_123",
    "type": "bet",
    "data": { "amount": 2, "currency": "EUR" }
  }
]

Use the exact payload shape expected by the current implementation. Fields on data are normalized to canonical keys where partner aliases are known (e.g. amount / value, currency / ccy).

Fetch player snapshot

GET/api/public/v1/player/:id

Fetch Syncora's snapshot for a player by external ID (or supported identifier). Returns CRM-relevant fields for partner backend systems.

Headers
x-api-key: <partner-server-api-key>
Example request
GET /api/public/v1/player/ext_123
Example response
json
{
  "id": "uuid",
  "external_id": "ext_123",
  "email": "player@example.com",
  "username": "player_name",
  "balance": 100,
  "total_deposits": 250,
  "deposits_count": 3,
  "kyc_status": "verified",
  "marketing_opt_in": true,
  "current_level": 2,
  "xp_total": 340
}

Response shape mirrors the current implementation. Fields may be omitted when unknown.

Grant a bonus

POST/api/public/v1/grant-bonus

Grant or record a bonus for a player through Syncora. Use idempotency-key to safely retry.

Headers
x-api-key: <partner-server-api-key>
content-type: application/json
idempotency-key: <optional-uuid>
Example payload
json
{
  "player_id": "ext_123",
  "bonus_name": "Welcome 100%",
  "amount": 50,
  "currency": "EUR",
  "wager_requirement": 30,
  "max_cashout": 200,
  "max_bet_amount": 5
}

Actual bonus fulfilment depends on partner casino/PAM integration. Syncora tracks and orchestrates the grant; your platform applies the wallet or free-spin change.

Error responses

400

Invalid payload

Missing required fields or schema validation failed. Details in response body.

401

Invalid or missing API key

The x-api-key header is missing, revoked, or unknown.

403

Insufficient permission

API key is valid but not scoped for this action.

404

Player not found

No player matches the provided identifier for this partner.

429

Rate limited

Possible response when rate limiting is enabled for a partner.

500

Internal error

Unexpected server error. Retry with backoff.

Example error bodyjson
{
  "error": "Invalid payload",
  "details": [
    { "path": ["type"], "message": "Required" }
  ]
}

Security notes

API keys are server-side credentials. Never embed them in browser bundles, mobile apps, or third-party scripts. Rotate immediately if exposed.
Keep API keys server-side.
Rotate keys if exposed.
Use HTTPS only.
Validate event data before sending.
Never send unnecessary sensitive data.
Prefer widget tokens for browser access.

Ready to connect your casino platform?

See a live walkthrough of Syncora with your team.

Book a Demo