Partner API endpoints
All partner integration endpoints are listed here. The same launch and wallet
contract applies to every Moonshot game; choose the game using gameSlug.
Every endpoint below uses POST with JSON and
signed requests and responses.
Game launch
Your backend → Moonshot API base URL. Call this endpoint when a player opens a game. Moonshot hosts it; you supply the player and session details.
| Endpoint | What it does | Full contract |
|---|---|---|
POST /launch | Create a game session and return its iframe URL. Verify the signed response and allowed URL origin before embedding data.url. | Launch request and response |
The launch balance is a snapshot. Your backend remains responsible for the
wallet. Launch requests do not have a durable replay guarantee or a launch-status
endpoint; follow the launch recovery rules before retrying.
Wallet callbacks
Moonshot → your registered callback base URL. Implement all three endpoints in your backend before launching games. Moonshot calls them as the game progresses.
| Endpoint | What it does | Full contract |
|---|---|---|
POST /transactions/bet | Accept a stake and debit the player's wallet once. For a freeplay, consume an eligible play without a regular-wallet debit. | Place bet |
POST /transactions/win | Settle an accepted bet and credit its gross payout once. A zero payout can close a losing round. | Settle bet |
POST /transactions/cancel | Reverse an accepted, unsettled stake once. For a freeplay, restore eligibility according to grant rules without a regular-wallet credit. | Reverse bet |
Use the authenticated operator and transactionId to replay duplicate callback
results. betId connects the original stake to settlement or cancellation. See
Integration Process for the complete session flow and identity fields.
Freeplay promotions (optional)
Your backend → Moonshot API base URL. Use these endpoints when freeplays are
enabled for your operator, game and currency. They manage promotion grants; games
still use the same three wallet callbacks with isFree: true.
| Endpoint | What it does | Full contract |
|---|---|---|
POST /freeplays/capabilities | Discover the freeplays API version, supported game settings, play-count limit and payout-cap options before issuing grants. | Capabilities |
POST /freeplays/create | Issue a player's promotion grant with a game, currency, nominal stake, play count, expiry and optional payout limits. | Create a grant |
POST /freeplays/state | Retrieve a grant's current state and up to 100 recent usages; look up uncertain creation using the original grant key. | Grant state |
POST /freeplays/cancel | Disable future use of a grant by its provider id. Accepted plays still require reconciliation; this does not refund a wallet stake. | Cancel a grant |
Use /freeplays/* for new integrations. The legacy /freebets/create and
/freebets/state routes are not accepted by the current canonical signing guard.
The Freeplays API guide retains its /freebets documentation URL.
Base URLs and signing
Obtain the exact sandbox and production API base URLs from Partner Onboarding. Endpoint paths above are relative to the receiver's configured base URL. The documentation host is not an API host.
| Destination | Example with an illustrative base URL |
|---|---|
| Moonshot API | https://sandbox-api.example/launch |
| Your callback backend | https://wallet.example/moonshot/transactions/bet |
The logical signing path for the callback example is /transactions/bet; the
registered base prefix /moonshot is not included in that signing line. Follow
Authentication for canonical paths, headers and response
verification, and keep environment credentials separate.
The browser receives the verified launch URL and embeds the game using Iframe Integration. Partner API calls and wallet callbacks run between backends.