API v1

API для реселлеров

Программный доступ к каталогу и заказам Arcadezy: просматривайте товары по своим ценам, создавайте заказы с оплатой с баланса, отслеживайте их статус и получайте доставленные коды.

С чего начать

Базовый URL: https://arcadezy.com/api/v1
Аутентификация: Создайте ключ в разделе Аккаунт → Настройки → API-ключи и передавайте его в заголовке X-API-Key.
Лимит запросов: 120 запросов в минуту на один ключ.
Ответы: Всегда JSON: { ok: true, ... } или { ok: false, code, error }.

Аккаунт

Проверьте, сколько можно потратить, прежде чем оформлять заказ.

GET/api/v1/balance

Your wallet balance.

curl https://arcadezy.com/api/v1/balance -H "X-API-Key: ak_..."

Каталог

Просматривайте категории и товары по ценам, действующим для вашего аккаунта.

GET/api/v1/categories?type=topup&q=&page=1&sort=lo

Catalog. type: topup | giftcard | gamekey | telegram | steam. Paginated, 48 per page.

curl "https://arcadezy.com/api/v1/categories?type=topup" -H "X-API-Key: ak_..."

GET/api/v1/categories/{slug}/offers

Offers with your prices (retail, or your reseller plan) and the fields required to place an order.

curl https://arcadezy.com/api/v1/categories/mobile-legends-global/offers -H "X-API-Key: ak_..."

POST/api/v1/categories/{slug}/validate-id

Check a game ID before ordering: whether the account exists and whose it is. supported=false means the game has no check (not that the ID is wrong); 503 means our supplier is temporarily unreachable — do not treat it as a valid ID. Limit: 20 checks per minute per key; repeated checks of the same ID are served from cache.

curl -X POST https://arcadezy.com/api/v1/categories/mobile-legends-global/validate-id \
  -H "X-API-Key: ak_..." -H "Content-Type: application/json" \
  -d '{"fields":{"player_id":"123456789","server_id":"1234"}}'

Заказы

Создавайте заказы с оплатой с баланса, отслеживайте их статус и получайте коды.

POST/api/v1/orders

Create an order, paid from your balance. The Idempotency-Key header is required — retrying with the same key returns the same order instead of charging you twice.

curl -X POST https://arcadezy.com/api/v1/orders \
  -H "X-API-Key: ak_..." \
  -H "Idempotency-Key: your-unique-id-123" \
  -H "Content-Type: application/json" \
  -d '{"offer_id":"<uuid from /offers>","fields":{"player_id":"123456789","server_id":"1234"}}'

GET/api/v1/orders?limit=20

Recent orders.

curl https://arcadezy.com/api/v1/orders -H "X-API-Key: ak_..."

GET/api/v1/orders/{id}

Order status. For completed gift cards and game keys the response also includes codes[].

curl https://arcadezy.com/api/v1/orders/<order-id> -H "X-API-Key: ak_..."

Вебхуки

Мы сами присылаем события заказов на ваш URL — без постоянного опроса.

PUT/api/v1/webhook

Subscribe to order events — we POST to your URL instead of you polling. Returns the signing secret once. Events: order.completed, order.failed. The URL must be public https on port 443 (private and loopback addresses are rejected, DNS is re-checked before every delivery). Delivery: 5 second timeout, up to 3 attempts with backoff.

curl -X PUT https://arcadezy.com/api/v1/webhook \
  -H "X-API-Key: ak_..." -H "Content-Type: application/json" \
  -d '{"url":"https://your-shop.com/arcadezy-hook"}'

GET/api/v1/webhook

Current subscription: url, enabled, consecutive failures, last error. After 10 consecutive failures delivery turns itself off.

curl https://arcadezy.com/api/v1/webhook -H "X-API-Key: ak_..."

POST/api/v1/webhook

Send a test event to your URL and report whether it was delivered.

curl -X POST https://arcadezy.com/api/v1/webhook -H "X-API-Key: ak_..."

DELETE/api/v1/webhook

Stop delivery.

curl -X DELETE https://arcadezy.com/api/v1/webhook -H "X-API-Key: ak_..."

Подпись вебхуков

Проверяйте подпись каждой доставки, прежде чем доверять данным.

Each webhook carries X-Arcadezy-Signature and X-Arcadezy-Timestamp. The signature is hex(HMAC-SHA256(secret, `{timestamp}.{raw_body}`)). Reject requests whose timestamp is older than about five minutes to prevent replay.

// Node.js
const expected = crypto.createHmac("sha256", SECRET)
  .update(`${req.headers["x-arcadezy-timestamp"]}.${rawBody}`)
  .digest("hex");
const ok = crypto.timingSafeEqual(
  Buffer.from(expected), Buffer.from(req.headers["x-arcadezy-signature"]));

Коды ошибок

Неуспешные запросы возвращают HTTP-статус и стабильный код в теле ответа.

401UNAUTHORIZED

The key is missing, revoked or wrong.

402INSUFFICIENT_BALANCE

Top up the wallet and retry.

403EMAIL_NOT_VERIFIED

Confirm the account email first.

404NOT_FOUND

No such category, offer or order.

409OUT_OF_STOCKIDEMPOTENCY_CONFLICT

The offer ran out, or the same Idempotency-Key was reused with a different body.

422VALIDATIONFIELDS_INVALIDQTY_INVALID

The request body is malformed, or the order fields do not match the offer.

429RATE_LIMITEDDAILY_LIMIT

Too many requests — slow down and retry later.

503SUPPLIER_UNAVAILABLE

Our supplier is temporarily unreachable. Retry; do not assume the order failed.