Reference

Changelog

Sandbox domains

The sandbox environment moved to KOI domains: Player API https://api.koigames.app and game client https://play.koigames.app. Game URLs returned by POST /games/request-access and cover URLs in GET /games/activated now use play.koigames.app. The previous *.fly.dev hosts keep working during the transition. No contract change.

RTP profiles

3×3 slots accept an RTP profile per game (98, 96, 94, 92 or 90%), chosen in the KOI Backoffice. See RTP profiles.
GET /games/activated returns the chosen profile in rtp.value. Without a profile, the value is unchanged.
The profile is fixed at launch (POST /games/request-access); open sessions are not affected by a change.

Slot mathematics

3×3 slots (Amazonia Adventure, Iara Folclore, Fortune Dragon, Fortune Olympus and their skins) moved to math 2026.10.1. The reels no longer contain an empty symbol: every cell always shows a symbol. Paytable, 5 lines, wild, the respin feature with its 10× full-screen multiplier and the 2500× maximum win are unchanged. Published RTP changes from 96.07 to 96.82.

Documentation fix

Losing bets have always been closed by a win with amount: 0. Earlier versions of this site said losses sent no callback. Behavior did not change; treat a zero win as the settlement of the bet.

Catalog

GET /games/activated now fills image_url with an absolute URL of the game cover hosted by KOI. It was always null before.

Free bets

Free rounds no longer send bet or win callbacks. When a bonus ends, KOI sends one bonus_win to your rewards endpoint with the total win, stake included. It replaces the per-round callbacks and the account option that disabled them.
Every game pays the full win of a free round, stake included. Crash, double and wall-street free rounds previously paid the profit only.
POST /games/free-bets requires bonus_code, quantity (positive integer) and expires_at (at most 30 days ahead). The same bonus_code for the same player is idempotent; reusing it with different parameters returns 409.
A new grant no longer expires the player's earlier bonuses on the same game. Bonuses are queued and the one that expires first is offered first.
New GET /games/free-bets?user_id= lists a player's bonuses with rounds played and remaining.
POST /games/alea/free-bets/cancel/{bonus_code} keeps played rounds and pays their win with a bonus_win. An optional body user_id cancels for one player. The response is now { "bonus_code", "cancelled_players" }.
Bet and win callbacks no longer carry bonus_code, and mode is never free in them.

Launch

POST /games/request-access rejects "demo": true with 400. The field previously opened the session under a KOI-owned account instead of yours. Use demo_session.
An access token that is not linked to an account returns 401 instead of 500.

Catalog

GET /games/activated returns rtp (value, source, math_version) and volatility. Both are null until published.

Free bets

POST /games/alea/free-bets/cancel/{bonus_code} requires the access token and cancels only grants of your account.

Callbacks

Retried win and rollback callbacks now carry exactly the signed body. Previously a retry could include an extra internal field and fail signature verification.

Documentation