REST API reference (v1)

Base URL: https://play.acbizglobal.net/api/v1. All requests need Authorization: Bearer sk_… and are scoped to the application that owns the key; the key's environment (test/live) selects which data you see. The API is server-to-server — it sends no CORS headers, so browsers can't call it directly.

Responses

// success
{ "success": true, "data": { … }, "meta": { … }, "request_id": "req_4f…" }

// error
{ "success": false,
  "error": { "type": "insufficient_scope", "message": "…", "status": 403 },
  "request_id": "req_4f…" }

Quote the request_id (also in the X-Request-Id header) when contacting support.

Endpoints

Method & path	Scope	Description
`GET /api/v1`	—	Key check: application & environment
`GET /api/v1/games`	games:read	Catalog with credit cost and `integrated` flag
`GET /api/v1/games/{slug}`	games:read	One game
`POST /api/v1/games/{slug}/launch`	games:launch	Signed, short-lived embed URL (verified player)
`GET /api/v1/application`	application:read	Name, status, domains, games
`GET /api/v1/usage?from=&to=`	usage:read	Totals, daily series, per-game usage
`GET /api/v1/credits?limit=&offset=`	credits:read	Balance, low-balance status, ledger
`GET /api/v1/leaderboards/{slug}?limit=&verified_only=1`	scores:read	Best score per player for your app
`GET /api/v1/scores?game=&player_id=&limit=`	scores:read	Recent scores
`GET /api/v1/webhooks`	webhooks:manage	List webhooks
`POST /api/v1/webhooks`	webhooks:manage	Create (returns the secret once)
`DELETE /api/v1/webhooks/{id}`	webhooks:manage	Delete (`POST …/{id}/delete` also works)

Launch a game for a known player

curl -X POST https://play.acbizglobal.net/api/v1/games/mental-math-sprint/launch \
  -H "Authorization: Bearer sk_live_YOUR_SECRET_KEY" \
  -H "Content-Type: application/json" \
  -d '{"player_id": "student-1042", "ttl": 600}'

{
  "success": true,
  "data": {
    "launch_url": "https://play.acbizglobal.net/embed/game/mental-math-sprint?lt=eyJ2Ijox…",
    "expires_at": "2026-09-23T10:15:00+00:00",
    "player_id": "student-1042",
    "environment": "live",
    "embed_html": "<iframe src=\"…\" …></iframe>"
  }
}

Render launch_url in an iframe (or pass it to the SDK as launchUrl). It works once, expires after ttl seconds (60–3600, default 600), and still only loads on your allowed domains. The game must already be integrated in the application.

Usage

curl "https://play.acbizglobal.net/api/v1/usage?from=2026-09-01&to=2026-09-30" -H "Authorization: Bearer sk_live_…"

{ "success": true, "data": {
  "from": "2026-09-01", "to": "2026-09-30", "environment": "live",
  "totals": { "sessions": 18420, "rounds_completed": 40211, "credits_consumed": 18420,
              "unique_visitors": 5120, "identified_players": 3900, "requests": 31204, "error_rate_percent": 0.4 },
  "daily":   [ { "date": "2026-09-01", "sessions": 610, "rounds": 1302, "credits": 610 }, … ],
  "by_game": [ { "game": "mental-math-sprint", "sessions": 8420, "rounds": 19002, "credits": 8420 }, … ]
} }

Leaderboard

curl "https://play.acbizglobal.net/api/v1/leaderboards/code-breaker?limit=10&verified_only=1" -H "Authorization: Bearer sk_live_…"

Versioning

This is v1. We add fields and endpoints without notice (ignore unknown fields), but never remove or change the meaning of existing ones within v1.