GMXAZ Bot Public API collection

Introduction

The API provides catalog browsing, player validation, voucher and top-up ordering, order tracking, redeem checks, and signed customer webhooks. Provider details are internal and are never included in customer-facing API responses or webhook payloads.

Authentication and security

Send your private API key in the X-API-KEY header on every protected request. Keep it on your backend. Never expose it in browser code, Mini Apps, mobile bundles, or public repositories.

X-API-KEY: YOUR_API_KEY
Accept: application/json

Idempotency

Send a unique UUID in X-Idempotency-Key when creating an order. Repeating the same key with the same payload returns the existing order. Reusing it with a different payload returns IDEMPOTENCY_CONFLICT. In the generated Postman collection, keep the generated operation key unchanged for retries and clear it only when starting a new financial operation.

X-Idempotency-Key: 550e8400-e29b-41d4-a716-446655440000

Order flow

1. Load games, categories, and products. Read the current price, stock state, supported fields, and validation requirement.
2. Validate the player when supports_player_validation is true or the product requires validation.
3. Create the order with a UUID idempotency key and, when needed, callback_url plus callback_mode.
4. Track the order through GET /order/{id}, GET /orders, or signed webhook events until a terminal status is reached.

Webhooks

When an API order includes callback_url, the platform sends signed JSON updates to that address. Webhooks contain only order, product, player, price, status, delivery, and customer-action fields. Upstream provider names, URLs, order IDs, and raw responses are never exposed.

Callback modes

Webhook headers

Callback URL requirements

• Only HTTPS URLs are accepted.
• Only port 443 is accepted.
• Private, reserved, and localhost addresses are blocked.
• Credentials in the URL are not accepted.
• Redirects are not followed.
• The receiving server must return a 2xx response.

Retry schedule

1 → 1 minute → 2 → 5 minutes → 3 → 15 minutes → 4-6 → 60 minutes → 7-20 → 6 hours · Maximum 20 delivery attempts.

{
    "event_id": "47c8c6ba-16a5-4089-9f62-7ae1e51d4c0f",
    "order_id": 8821,
    "client_order_id": "order-10001",
    "status": "COMPLETED",
    "product_name": "Steam Wallet 10 USD",
    "qty": 2,
    "player_id": null,
    "player_name": null,
    "server_id": null,
    "region": null,
    "price": "19.9800",
    "currency": "USD",
    "delivery": [
        "CODE-ONE-XXXX",
        "CODE-TWO-XXXX"
    ],
    "manual_action_required": false,
    "delivery_message": null,
    "timestamp": "2026-07-25T13:31:10+04:00"
}

{
    "event_id": "47c8c6ba-16a5-4089-9f62-7ae1e51d4c0f",
    "event": "order.status_changed",
    "callback_mode": "events",
    "order_id": 8821,
    "client_order_id": "order-10001",
    "product_id": 91,
    "product_name": "PUBG Mobile 60 UC",
    "product_type": "TOPUP",
    "game_id": 1,
    "game_name": "PUBG Mobile",
    "player_id": "51515969536",
    "player_name": "PlayerOne",
    "server_id": "1234",
    "region": "TR",
    "qty": 1,
    "price": "0.8800",
    "currency": "USD",
    "delivery": [],
    "manual_action_required": false,
    "delivery_message": null,
    "status": "COMPLETED",
    "message": "Order completed successfully.",
    "timestamp": "2026-07-25T13:30:10+04:00"
}

Signature verification

Calculate HMAC SHA-256 over the exact raw JSON request body using the webhook_secret credential issued with API access. Compare the result with the signature header shown in this documentation using a timing-safe comparison.

<?php
$secret = 'YOUR_WEBHOOK_SECRET';
$rawBody = file_get_contents('php://input');
$received = $_SERVER['HTTP_X_GAMEX_SIGNATURE'] ?? '';
$computed = 'sha256=' . hash_hmac('sha256', $rawBody, $secret);

if (!hash_equals($computed, $received)) {
    http_response_code(401);
    exit('Invalid signature');
}

http_response_code(204);

Status lifecycle

Error codes

{
    "success": false,
    "error": {
        "code": "VALIDATION_ERROR",
        "message": "The product_id field is required.",
        "details": {
            "max": 1
        }
    }
}

Limits and retry behavior

Respect the configured per-minute limit. Retry 429 and temporary 5xx responses with exponential backoff. Do not create a new idempotency key when retrying the same order request.

Downloads and Postman files