Two ledger writes per game cycle. Nothing else is written.

Opens a tenant and returns its key once. The key is not stored and cannot be retrieved again. quotaWindowSeconds and maxWrites are recorded, but the quota actually enforced is the service-wide one in Enforced limits.

{ "tenantId": "yourgame",        // [a-z0-9-], 3-32 chars, no leading/trailing or double dash
  "tenantParty": "yourgame::1220ab...",  // must already exist on the participant
  "note": "optional" }

201 -> { "tenantId", "tenantParty", "quotaWindowSeconds", "maxWrites",
        "suspended", "note", "createdAt", "secret" }
400 -> invalid tenantId, or tenantParty unknown to this participant
409 -> tenant already exists

Lists tenants as { "tenants": [...] }. Key hashes are never included in any response.

Returns { "tenantId", "secret" }. The previous key stops working on the same call - there is no grace period.

Blocks the tenant from acting; its key then answers 403. Players keep every asset they already own. Send "suspended": false to lift it.

{ "suspended": true, "reason": "under review" }

200 -> { "tenantId", "suspended" }

Grants minting inside the tenant's namespace, limited by a quota enforced in the contract.

{ "registryCid": "00d37a98...",
  "mintQuota": 100, "quotaWindowSeconds": 3600 }   // defaults shown

201 -> { "tenantId", "mintRightCid", "updateId" }

Creates the ecosystem asset registry. Once per deployment: a second call creates a second registry. Body { "registryId" } is optional. Returns { "registryId", "contractId", "updateId" }.

Creates a venue and its slot roster. A tenant's live venue id starts with yourgame/; a dry-run venue id with dryrun-yourgame-. Dry-run venues cannot charge fees or pay out, and live venues always require custody proof - both enforced in the contract. Costs no quota.

{ "venueId": "yourgame/arena", "mode": "ModeLive",      // default ModeDryRun
  "gameCodes": ["yourgame-runner-v1"],
  "policy": { "minStakeAmount": "10.0",   "maxStakeAmount": "100.0",
              "minPlatformFee": "1.0",    "maxPayoutAmount": "100.0",
              "minLockSeconds": "14400",  "maxLockSeconds": "691200",
              "minCycleSeconds": "60",    "maxCycleSeconds": "7200",
              "cooldownSeconds": "30",    "abortCooldownSeconds": "300",
              "concurrencyLimit": "1" },
  "shardCapacity": 64 }                              // instrumentId defaults to Canton Coin

201 -> { "venueId", "mode", "shardCapacity", "venueCid", "updateId" }
400 -> dry-run venueId without "dryrun-", policy outside bounds ({ "violations": [...] }),
       or minLockSeconds below maxCycleSeconds
403 -> venueId outside your namespace

Omitted policy fields take defaults inside the bounds, among them minLockSeconds 7200 and minCycleSeconds 60. With a tenant key, minLockSeconds must also be at least maxCycleSeconds, so a lock never expires while a cycle can still be settled. Bounds are listed in Enforced limits.

Changes a venue's policy. Only arCCade can call it: a tenant setting its own fee floor would set it to zero. The path takes the venue id, not the contract id. Send only the fields that change, plus gameCodes to replace that list. Bounds apply to this route even with the internal key, and minLockSeconds must be at least maxCycleSeconds, so a lock never expires before the claim window closes.

{ "minPlatformFee": "1.0" }

200 -> { "venueId", "previousCid", "venueCid", "policy", "updateId", "note" }
404 -> venue not found

The change does not reach open cycles, which carry the policy they committed under, nor entitlements already issued, which carry theirs. A new fee applies to entitlements issued after the update.

Your venues and their current contract ids. No quota cost. Read venueCid here before any call that takes it.

200 -> { "venues": [ { "venueCid", "venueId", "mode", "gameCodes",
                       "sdkVersion", "concurrencyLimit", "rosterReady" } ] }

Rebuilds the audit rows for your venues from the ledger's transaction stream. A cycle belongs to the period in which it closed: fromMicros <= settledAtMicros < toMicros. Settlements, aborts and expiries all close a cycle. No quota cost; a long period takes a while.

200 -> { "fromMicros", "toMicros", "cycleCount", "merkleRoot",
        "leaves": [ "<64-char sha256>", ... ],
        "rows": [ { "cycleId", "player", "gameCode", "concurrencyIndex",
                    "entryDigest", "outcomeDigest",
                    "committedUnits", "feeUnits", "returnedUnits",
                    "forfeitedUnits", "payoutUnits", "disposition",
                    "committedAtMicros", "settledAtMicros", "custodyTag" } ] }
400 -> fromMicros and toMicros required, toMicros > fromMicros

Units are integer strings in 1e-10 of the instrument. disposition is a label: returned-in-full, returned-with-forfeit, forfeited-in-full, aborted, expired-unsettled.

Anchors a period on the ledger. Send the rows from GET /report/period unchanged. The contract recomputes the Merkle root, the anchor digest, the cycle count and the unit totals from the rows; it does not verify reportUri, reportDigest, prevAnchorDigest or the transaction counts, which you declare.

{ "periodId": "2026-09-11",
  "periodStartMicros": "1789084800000000", "periodEndMicros": "1789171200000000",
  "rows": [ ... ],
  "qualifyingTxCount": "42", "nonQualifyingTxCount": "0",
  "reportUri": "https://yourgame.example/audit/2026-09-11.json",
  "reportDigest": "<64-char sha256>", "prevAnchorDigest": "<previous anchorDigest>" }

201 -> { "anchored": true, "anchorCid", "merkleRootHex", "anchorDigest",
        "reportDigest", "reportUri", "cycleCount", "updateId" }
200 -> { "anchored": false, "reason", "anchorCid", ... }   // this period is already anchored
400 -> periodId missing, or an unknown disposition label

One anchor per venue and period: an existing one is returned instead of a second write. A large anchor can outlast the request and still land, so after a timeout read GET /venue/anchors before retrying.

Your venues' anchors, newest period first. No quota cost.

200 -> { "anchors": [ { "anchorCid", "venueId", "periodId",
                        "periodStartMicros", "periodEndMicros", "cycleCount",
                        "merkleRootHex", "anchorDigest", "prevAnchorDigest",
                        "reportUri", "reportDigest" } ] }

Confirms the key. Returns your tenant record without the key hash, plus namespace and the write quota as { "windowSeconds", "maxWrites" }. No quota cost; use it as a health check.

Validates instrument ids against isolation rules. No quota, no ledger write.

{ "instrumentIds": [ { "admin": "reg::1220ee...", "id": "yourgame/gold" } ] }

200 -> { "ok": true, "tenantId", "quotaRemaining", "quotaResetAt" }
403 -> isolation violation, with the offending id named

Parses one instrument id and reports its shape. Body { "instrumentId": { "admin", "id" } }.

200 -> { "ok": true, "tenantId": "yourgame",
        "localId": "sword-of-dawn", "instanceId": "4a91c8f2",
        "assetClass": "unique" }

Opens a player's asset account, after which the registry can mint to them without a signature per reward. The service submits this on the player's behalf, so the player party must be hosted on this participant.

{ "playerParty": "alice::1220ab...", "accountId": "alice-1" }   // accountId optional

201 -> { "playerParty", "accountCid", "updateId" }

Mints into a player account. localId is namespaced automatically - send gold, receive yourgame/gold. Append #instance for a unique asset, whose amount must be "1.0".

{ "accountCid": "00c8a438...",
  "localId": "sword-of-dawn#4a91c8f2",
  "amount": "1.0",
  "assetMeta": { "attack": "9", "tier": "legendary" } }

201 -> { "instrumentId": { "admin", "id" }, "assetCid", "updateId" }
409 -> no mint right granted yet
500 -> mint quota for this window exhausted (contract); minting above it needs arCCade's approval

A player's holdings, filtered to your namespace. Safe to poll; costs no quota.

200 -> { "party", "count",
        "assets": [ { "contractId", "instrumentId", "amount" } ] }

Sets an asset aside for a settlement. Both sides of a trade must allocate with the same settlementId, using legId "offer" and "ask". An allocated asset cannot be allocated again.

{ "registryCid": "00d37a98...", "assetCid": "00b480a9...",
  "sender": "alice::1220ab...", "receiver": "bob::1220cd...",
  "localId": "sword-of-dawn#4a91c8f2", "amount": "1.0",
  "settlementId": "trade-8814", "legId": "offer",
  "allocateBeforeSeconds": 600, "settleBeforeSeconds": 1800 }   // defaults shown

201 -> { "allocationCid", "legId", "instrumentId", "updateId" }

Two legs minimum - a one-sided gift cannot be written with this primitive. Set taker to null for an open offer. Every leg's instrument must be in your namespace.

{ "tradeId": "trade-8814", "maker": "alice::...", "taker": "bob::...",
  "tradeDigest": "<64-char sha256>",
  "expiresInSeconds": 600, "settleInSeconds": 1800,   // defaults shown
  "legs": {
    "offer": { "sender": "alice::...", "receiver": "bob::...",
                "instrumentId": {...}, "amount": "1.0" },
    "ask":   { "sender": "bob::...", "receiver": "alice::...",
                "instrumentId": {...}, "amount": "300.0" } } }

201 -> { "tradeId", "proposalCid", "updateId" }
400 -> a leg without instrumentId
403 -> a leg's instrument outside your namespace; "leg" names it

Body { "acceptor": "bob::..." }. Returns { "tradeCid", "updateId" }. Fails after the proposal expires.

Executes every leg in one transaction. Allocation keys must match leg keys exactly - a missing leg is rejected, never silently skipped.

{ "allocations": { "offer": "00fb0ae4...", "ask": "00881beb..." },
  "parties": ["alice::...", "bob::..."] }

200 -> { "settled": true, "updateId",
        "created": [ { "contractId", "instrumentId", "amount", "owner" } ] }

Issues player slots. The venue's concurrencyLimit decides how many slots each player gets; a second commit on a consumed slot is rejected by the ledger, not by this service. Issuing again to a player who already has slots at this venue is rejected.

{ "grants": [ { "player": "alice::...", "tier": "silver" } ] }   // tier defaults to "default"

201 -> { "venueCid", "updateId",
        "entitlements": [ { "contractId", "player", "concurrencyIndex" } ] }
400 -> grants missing, or a grant still sends a non-zero concurrencyIndex

The venue's contract id changes: use the returned venueCid from here on.

A player's slots at your venues, lowest index first. No quota cost.

200 -> { "player", "entitlements": [ { "contractId", "venueId", "mode",
        "concurrencyIndex", "tier", "nextEligibleAt", "cyclesCompleted" } ] }

Write 1, submitted by the service for a player hosted on this participant. Fix entryDigest before play so entry conditions cannot be retrofitted afterwards. On a live venue the player's Canton Coin is locked and the stake committed in one transaction.

{ "entitlementCid": "002769ea...", "player": "alice::...",
  "gameCode": "yourgame-runner-v1", "cycleId": "run-3f2a...",
  "entryDigest": "<64-char sha256>",
  "stakeAmount": "100.0", "feeAmount": "1.0", "lockSeconds": 14400 }

201 -> { "cycleId", "stakeCid", "custodyTag", "lockExpiresAt", "mode",
        "lockedAmulet", "inputAmount", "updateId" }   // lockedAmulet, inputAmount: live venues

Write 2. On a live venue send lockedHoldingCid: the contract checks the lock against the stake and the unlock runs in the same transaction. Without it only a dry-run venue settles. If you send revealedOutcome or revealedEntry, the ledger recomputes the hash and rejects a mismatch.

{ "player": "alice::...", "disposition": "ReturnedInFull",
  "returnedAmount": "100.0", "forfeitedAmount": "0.0", "payoutAmount": "0.0",
  "outcomeDigest": "<64-char sha256>",
  "revealedOutcome": "{\"score\":4200,\"result\":\"win\"}",
  "lockedHoldingCid": "00a1f3..." }

200 -> { "settled": true, "entitlementCid", "unlockedAmulet", "updateId" }

The contract requires returnedAmount + forfeitedAmount to equal the stake, allows no forfeit on a time-locked stake, caps payoutAmount at the policy's maxPayoutAmount, and rejects settlement outside minCycleSeconds..maxCycleSeconds of the commit.

Closes a cycle without counting it. There is no minimum duration - this is the way out of a cycle that should not have started. The slot comes back after the policy's abortCooldownSeconds. Send lockedHoldingCid to unlock in the same transaction; otherwise the lock stays until it expires.

{ "player": "alice::...", "reason": "client crashed", "lockedHoldingCid": "00a1f3..." }

200 -> { "aborted": true, "reason", "entitlementCid", "unlockedAmulet", "updateId" }

Closes an unsettled cycle once lockExpiresAt has passed, authorised by the player alone: neither arCCade nor the venue is needed on the ledger. With lockedHoldingCid the funds return to the player in the same transaction.

{ "player": "alice::...", "lockedHoldingCid": "00a1f3..." }

200 -> { "expired": true, "entitlementCid", "unlockedAmulet", "updateId" }

A player's open cycles at your venues, each with the lock that belongs to it. No quota cost. This is where recovery starts: a stake listed here was committed and has not been closed.

200 -> { "player", "openCycles",
        "cycles": [ { "stakeCid", "cycleId", "venueId", "gameCode", "custodyTag",
                      "lockedAmulet", "concurrencyIndex", "committedAt",
                      "stakeAmount", "lockExpiresAt" } ] }

Reads the settlement out of the transaction's exercise node. This data does not appear in the default ledger event stream - this endpoint is how you get it. Only settlements at your venues are returned; anything else, including aborts and expiries, returns 404.

200 -> { "choice": "GameStake_Settle", "consuming", "disposition",
        "returnedAmount", "forfeitedAmount", "payoutAmount",
        "outcomeDigest", "revealedOutcome" }

Prepares write 1. The fee and the lock come from the slot's policy, not from the request: the fee is minPlatformFee and the lock runs minLockSeconds plus 600 seconds. The player is an observer of the offer, so a wallet can read these terms from the ledger instead of trusting this response.

{ "entitlementCid": "002769ea...", "player": "alice::...",
  "gameCode": "yourgame-runner-v1", "cycleId": "run-3f2a...",
  "entryDigest": "<64-char sha256>", "stakeAmount": "100.0" }

200 -> { "requestId", "preparedTransactionHash", "offerCid", "cycleId",
        "stakeAmount", "feeAmount", "lockExpiresAt", "expiresInSeconds": 300 }
403 -> the entitlement belongs to another player, or to another tenant's venue
404 -> entitlement not found

Submits write 1 with the player's signature: the Canton Coin lock, the platform fee and the stake commit land in one transaction.

{ "requestId": "p9Wk...", "signature": "<base64 Ed25519>" }

201 -> { "cycleId", "stakeCid", "custodyTag", "lockExpiresAt", "mode",
        "lockedAmulet", "updateId", "contractsResolved" }
400 -> requestId or signature missing, or signedBy present
404 -> prepared request unknown, expired, or prepared with another tenant's key: prepare again

201 with "contractsResolved": false means the ledger accepted the write but the new contracts were not visible within 10 seconds. Do not resubmit; find the stake with GET /cycle/open/:party. updateId can be null when the ledger's completion was not seen in time; the write itself is unaffected.

Prepares write 2. The body is the same as POST /cycle/:stakeCid/settle, and lockedHoldingCid is required: without a lock there is nothing for the player to sign, and the settlement belongs on the participant-submitted route.

{ "player": "alice::...", "disposition": "ReturnedInFull",
  "returnedAmount": "100.0", "outcomeDigest": "<64-char sha256>",
  "lockedHoldingCid": "00a1f3..." }

200 -> { "requestId", "preparedTransactionHash", "stakeCid",
        "lockedHoldingCid", "cycleId", "offerCid", "expiresInSeconds": 300 }

Compare the echoed stakeCid and lockedHoldingCid with the ones you hold before asking the player to sign.

Submits write 2 with the player's signature: the settlement and the unlock land in one transaction, and the slot comes back.

{ "requestId": "Qz3r...", "signature": "<base64 Ed25519>" }

200 -> { "settled": true, "stakeCid", "cycleId", "entitlementCid",
        "unlockedAmulet": null, "updateId", "contractsResolved" }

unlockedAmulet is always null: nothing on the returned coin ties it to this cycle, so read the player's balance from their wallet. With "contractsResolved": false the stake's archival was not confirmed in time. Check GET /cycle/open/:party; if the settlement did not land nothing is lost, because the player can expire the cycle once the lock runs out.