Fairness rotate

POST /api/s2s/fairness/rotate reveals the player’s current server seed — so every round it covered becomes verifiable — and opens a fresh commitment in the same call. Pass a clientSeed to set the new pair’s client seed; this is the only way a client seed changes.

See provably fair for the verification flow.

Request

POST https://{operator}.app.lootboxsolutions.com/api/s2s/fairness/rotate

{
  "playerExternalId": "u_8431",
  "clientSeed": "my-lucky-seed"
}

Field	Required	Notes
playerExternalId	✅	Whose seed pair to rotate.
clientSeed	—	The new client seed: letters, numbers, - and _, up to 64 chars. Omit to keep the current one.

Response — 200

{
  "revealed": {
    "serverSeed": "9f1c…",
    "serverSeedHash": "3a7bd3…",
    "clientSeed": "bF3kQ9",
    "roundsCovered": 12
  },
  "active": {
    "serverSeedHash": "c0ffee…",
    "clientSeed": "my-lucky-seed",
    "nextNonce": 0,
    "algorithmKey": "hmac_sha256_v1"
  }
}

Field	Notes
revealed.serverSeed	The now-disclosed plaintext seed. Hash it (SHA-256) and confirm it matches the serverSeedHash you were shown before playing.
revealed.serverSeedHash / revealed.clientSeed	The commitment + client seed the revealed pair used.
revealed.roundsCovered	How many rounds the revealed pair drew.
active	The fresh commitment that now governs play — same shape as fairness state.

Errors

code	HTTP	when
INVALID_CLIENT_SEED	422	clientSeed contains characters outside A–Z a–z 0–9 - _ or is longer than 64

A bad signature returns 401 (see authentication).

Same action, two callers. The game app rotates via the equivalent in-iframe control with a session token. This S2S endpoint is the backend-driven equivalent.