Server API

This module is the contract reference for all server-side interfaces between the minigame Game SVR and the SUD OP SVR. Open APIs are called by the Game SVR to the SUD OP SVR; webhooks are implemented by the Game SVR, with the callback URL configured in the SUD OP console.

Service Regions and API Addresses

Open API documents list request methods and API paths. Before calling an API, select the base URL for your game's service region. See Service Regions and API Addresses.

Security Mechanism

Interfaces in this module fall into two categories: mandatory encryption and signing and plaintext calls. Interfaces with mandatory encryption and signing must complete service communication secondary encryption and signatures, which effectively prevent data tampering and leakage; plaintext-call interfaces are neither encrypted nor signed and are called directly as standard HTTPS requests. See Server API Signature and Encryption (Chinese) for the full specification.

• Request encryption and signing (Open API → SUD OP SVR): When the Game SVR calls a SUD OP SVR Open API, it must first encrypt the plaintext request, then sign the ciphertext, and send both the encrypted parameters and the signature headers. Requests that are not encrypted, not signed, or fail signature verification are rejected.
• Webhook signature verification and decryption (SUD OP SVR → Game SVR): When the SUD OP SVR calls a Game SVR webhook, the Game SVR must verify the signature and decrypt the request first, and only process the business logic after confirming the request source is legitimate. If verification fails, reject the request directly.
• Plaintext-call interfaces: Requests and responses are all plaintext; no encrypted payload, signature headers, or response decryption are needed.
• Sensitive credential protection: Credentials such as game_id, secret, and access_token may only be used on the Game SVR. They must never be delivered to the client or front-end pages.

Open API

Open APIs are called by the Game SVR to the SUD OP SVR, providing server-side capabilities such as obtaining API call credentials, verifying login credentials, and querying payment orders.

Open - API Call Credential

Name	Description
auth.getAccessToken	Obtain the API call credential

Open - Login

Name	Description
auth.code2session	code2session: exchange the login code for user session information

Open - Payment

Name	Description
pay.orderQuery	Query a payment order

Webhook

Webhooks are implemented by the Game SVR, with the callback URL configured in the SUD OP console, and are called by the SUD OP SVR when the corresponding business events are triggered. SUD OP does not restrict the domain or path of the callback URL; it only requires the Game SVR to receive requests using the HTTP method and request body format specified in each interface document below, and to return data in the specified response format.

Must read: All webhook requests carry encryption and signature information. The Game SVR must first complete signature verification and decryption before trusting the webhook content. Processing a webhook without verifying the signature carries the risk of being attacked by forged requests.

Webhook - Payment

Name	Description
pay.notify	Payment webhook, including item delivery notification and refund notification

Webhook - Ad

Name	Description
ad.rewardNotify	Rewarded video completion webhook