KinetX Operator API

The Operator API is for API (headless) operators that run their own website or app, and for Turnkey operators that keep their own front end or payment provider. Every business rule of the platform applies to API calls exactly as in the backoffice: KYC thresholds, responsible-gaming limits and cooling-off periods, self-exclusion, bonus terms, AML monitoring and the audit log.

1. 1In the backoffice open Tools → API & Webhooks and create an API key with the scopes you need. Copy the secret: it is shown only once.
2. 2Optionally restrict the key to the IP addresses of your servers.
3. 3Sign a request to GET /api/v1/operator/me and check that it returns your operator. How to sign requests →
4. 4Add a webhook endpoint to be notified of registrations, payments, bonuses, KYC and compliance events.

Base URL:

https://kinetx.amhtechnologies.com/api/v1

• Requests and responses are JSON (application/json). Successful responses wrap the result in data.
• Money is always an integer in minor units of the currency (cents): 12550 is €125.50. Currencies are ISO 4217 codes.
• Timestamps are ISO 8601 in UTC (2026-10-15T09:30:00Z); dates are YYYY-MM-DD.
• Ids are KinetX integer ids. Keep your own id of a player in external_id and look players up with it.
• Every response carries an X-Request-Id header; quote it when you contact support.
• An API key only ever sees the data of its own operator: records of other operators answer 404.

Network failures happen. Send an Idempotency-Key header (a UUID) with every POST: the first response is stored for 24 hours and replayed for every retry with the same key and the same request, marked with Idempotent-Replayed: true. Reusing a key for a different request is refused with IDEMPOTENCY_KEY_REUSED; a retry while the first request still runs gets 409 IDEMPOTENCY_IN_PROGRESS.

Money movements are additionally idempotent on your own reference: a deposit with an external_reference that was already recorded returns the original deposit instead of crediting twice.

Errors use HTTP status codes and one envelope with a stable machine-readable code:

{
    "error": {
        "code": "VALIDATION_FAILED",
        "message": "The request data is invalid.",
        "details": {
            "birth_date": [
                "The player must be at least 18 years old."
            ]
        }
    }
}

List endpoints take page and per_page (1–100, default 25) and return meta and links next to the data:

{
    "data": [
        "…"
    ],
    "meta": {
        "current_page": 2,
        "per_page": 25,
        "total": 137,
        "last_page": 6,
        "from": 26,
        "to": 50
    },
    "links": {
        "first": "…?page=1",
        "last": "…?page=6",
        "prev": "…?page=1",
        "next": "…?page=3"
    }
}

Each API key may send 600 requests per minute by default (staff can set another limit per key). Player session tokens count against the key that issued them. Every response reports the budget in X-RateLimit-Limit and X-RateLimit-Remaining; above it you get 429 RATE_LIMITED with a Retry-After header.

The version is part of the path (/api/v1). Within v1 we only add: new endpoints, optional parameters, response fields and webhook events. Ignore fields you do not know. Breaking changes come as v2, announced in the changelog well in advance.