Changelog

Changes to the API contracts and this documentation — newest first.

2026-08-02

Seamless: removed the `generation` field from /settle. The upstream game provider does not send it to us, so we no longer send it onward. A transaction following a /rollback still reuses the txn_id and still must be applied — you now count the rollbacks you receive yourself (per txn_id for BY_TRANSACTION, per round_id for BY_ROUND) and make that count part of your idempotency key. You receive every /rollback we receive. See "re-settle after rollback" on the Contract page for the steps. No live SEAMLESS agent yet, so removed directly.

Seamless: renamed every wire field from camelCase to snake_case to match the transfer track (txn_id, round_id, request_id, player_username, product_code, game_code, is_feature, bet_amount, payout_amount, single_state, ref_txn_id, skip_balance_update, is_feature_buy, play_info, balance_before, balance_after) — across the request envelope, txns[], and the agent response. No live SEAMLESS agent yet (pre-prod), so changed directly. All specs/guides/contract updated.
Seamless: the /bet page now shows a sportsbook request example (WAITING → OPEN) and /settle shows a single-state example, so the special-case fields are all illustrated in the examples.

Added POST /auth/change-password — a logged-in member can change their own password (current password verified first; the session stays valid, no re-login). A member who forgot the password or is locked out contacts the agent for a backoffice reset (there is no OTP reset).

Seamless: documented the sportsbook flow (a confirmed ticket is relayed to /bet again with the same txn_id — dedupe and reply code 0, never debit twice) · settles re-sent after a rollback now carry a new generation field (the bet's rollback count; recommended idempotency key (txn_id, generation ?? 0) — backward compatible) · clarified that after the 3 inline attempts there is no asynchronous re-delivery — recovery relies solely on the upstream game vendor retransmitting.
Transfer: documented behavior for members under a SEAMLESS-wallet agent (the wallet lives on the agent side) — deposits/withdrawals return 1002 FORBIDDEN, the affiliate summary returns enabled = false, and claim returns 6103.
The Business codes page now shows the previously missing diamond shop (6221-6223) and daily card (6231-6233) groups — search-result links to these codes work again.

Added 4 endpoints: diamond shop (GET /diamond/shop, POST /diamond/redeem) and daily card (GET /card, POST /card/flip), with codes 6221-6223 and 6231-6233 in the catalog.

Restructured the guides for readability — merged 11 guide pages down to 6, ordered by usage flow: the Transfer track now covers auth (S2S + member token) on one page and folds request/response basics into Conventions; the Seamless track merges request envelope + response + rules into a single Contract page. Thai copy was polished down to per-field descriptions.

Added search (header button or ⌘K/Ctrl+K) — find endpoints by name/path, guide headings, and error codes (type a number like 1019 to jump straight to its row). Works across both languages.

The Seamless Wallet contract is now verified against the live implementation (no longer draft) — clarified: `/refund` and `/adjust` carry an informational nullable ref_txn_id, `/void` includes bet_amount/payout_amount for verification, and best-system's retry policy sends at most 3 total attempts (first attempt included).

Rate limiting now enforces exactly what the table says — the 600/min ceiling aggregates every endpoint under one key (previously counted per endpoint, looser than documented), and logins count toward both the total and auth buckets. The IP allowlist now matches v4-mapped forms (::ffff:x.y.z.w) and case-insensitive IPv6.
Rate-limit ceilings are system-wide defaults — contact us if your real traffic exceeds them (removed the "per-customer tuning in a later phase" note).

The S2S credential layer is live — every request carrying X-Api-Key is verified per the S2S signature (codes 1018-1023 active). Agents enable the channel themselves on the bo screen Api Management → API Credential (External Site toggle + IP allowlist + grace-window key rotation).

Initial release — full Transfer API (33 endpoints), Seamless Wallet API (10 endpoints), and both error-code catalogs
Added the S2S credential contract (X-Api-Key + X-Signature) — codes 1018-1023 reserved