Rankacy Sportsbook B2B API

Read-only HTTP feed of CS2 bot-league matches, markets, live odds and stream metadata for sportsbook and bookmaker partners.

Core Concepts

Authentication

Every request must include an API key via the X-API-Key HTTP header:

X-API-Key: rksb_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Keys are issued by a Rankacy administrator via the admin panel. The raw key is shown once at creation — if lost, request a key rotation.

• Missing or invalid keys return 401 Unauthorized.
• Deactivated partners receive 401 even with a valid key.
• All requests are audit-logged server-side (method, path, status, duration).

curl -H "X-API-Key: $RANKACY_API_KEY" \
  https://YOUR-HOST/api/b2b/ping

{
  "status": "ok",
  "partner_id": 3,
  "partner_name": "Fortuna CZ",
  "server_time": "2026-04-15T10:22:03Z"
}

Base URL

All endpoints are served under:

/api/b2b/*

Replace YOUR-HOST in examples with the hostname provided during onboarding.

Error Handling

All errors use a standard JSON envelope:

{ "detail": "Match not found" }

Endpoints — Core

curl -H "X-API-Key: $KEY" \
  "https://HOST/api/b2b/matches?status=LIVE&limit=5"

{
  "match_id": 42,
  "updated_at": "2026-04-15T10:22:03Z",
  "markets": [
    {
      "market": "MATCH",
      "round_number": null,
      "is_available": true,
      "margin": "0.05",
      "updated_at": "2026-04-15T10:22:03Z",
      "sides": [
        { "side": "CT", "team_id": 9,    "decimal_odd": "1.87" },
        { "side": "T",  "team_id": 10,   "decimal_odd": "1.92" },
        { "side": "DRAW", "team_id": null, "decimal_odd": "18.00" }
      ]
    },
    {
      "market": "ROUND",
      "round_number": 7,
      "is_available": true,
      "margin": "0.04",
      "updated_at": "2026-04-15T10:22:01Z",
      "sides": [
        { "side": "CT", "team_id": 9,  "decimal_odd": "2.10" },
        { "side": "T",  "team_id": 10, "decimal_odd": "1.75" }
      ]
    }
  ]
}

{
  "since": "2026-04-15T10:22:00Z",
  "server_time": "2026-04-15T10:22:03.421Z",
  "webhook_events": ["ODDS_UPDATED"],
  "changes": [
    {
      "match_id": 42,
      "match_status": "LIVE",
      "market": "MATCH",
      "round_number": null,
      "updated_at": "2026-04-15T10:22:03Z",
      "is_available": true,
      "sides": [
        { "side": "CT",   "team_id": 9,    "decimal_odd": "1.87" },
        { "side": "T",    "team_id": 10,   "decimal_odd": "1.92" },
        { "side": "DRAW", "team_id": null,  "decimal_odd": "18.00" }
      ]
    }
  ]
}

Seasons

Webhooks

Register HTTPS endpoints to receive real-time push notifications. Each delivery is signed with HMAC-SHA256 so you can verify authenticity server-side.

Webhooks are lightweight invalidation messages, not full REST payloads. Use the incoming match_id plus each endpoint's webhook_events field to decide which B2B endpoint to refetch.

Supported Event Types

Delivery Headers

curl -X POST -H "X-API-Key: $KEY" \
  -H "Content-Type: application/json" \
  -d '{"event_type":"ODDS_UPDATED","target_url":"https://example.com/hooks/rankacy"}' \
  https://HOST/api/b2b/webhooks

{ "message": "Webhook removed" }

Verifying Webhook Signatures

Every webhook delivery is signed. Verify the X-Rankacy-Signature header before processing.

import hmac, hashlib

def verify_signature(body: bytes, header: str, secret: str) -> bool:
    expected = "sha256=" + hmac.new(
        secret.encode(), body, hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(expected, header)

const crypto = require("crypto");

function verifySignature(body, header, secret) {
  const expected =
    "sha256=" +
    crypto.createHmac("sha256", secret).update(body).digest("hex");
  return crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(header)
  );
}

Integration Flow

1. Bootstrap — Call GET /markets and GET /seasons to populate your static UI data. Cache these.
2. Render lobby — GET /matches?status=LIVE for active matches, plus GET /matches/{id} for detail.
3. Push updates — If you register webhooks, use the endpoint-level webhook_events array as your invalidation map and refetch only the affected endpoint when an event arrives.
4. Pull fallback — If you do not register webhooks, fetch once on page load and refresh only on user navigation. For live odds polling, use GET /odds/changes.
5. Match page — Use GET /stream for the Twitch iframe. Show all three markets side-by-side. Treat GET /matches/{id} as the source of truth for score, status and settlement.
6. Settlement — A match is settled when status == "FINISHED". Final scores are on the match detail response.

Polling Recipe

1. First call: GET /api/b2b/odds/changes (no since param).
2. Store server_time from the response.
3. Every 1–2 seconds: GET /api/b2b/odds/changes?since=<server_time>
4. Apply changes to your local cache, keyed by (match_id, market, round_number).
5. Update server_time from each new response.

import time, requests

API = "https://HOST/api/b2b"
HEADERS = {"X-API-Key": "rksb_live_..."}
since = None

while True:
    params = {"limit": 500}
    if since:
        params["since"] = since

    r = requests.get(f"{API}/odds/changes", headers=HEADERS, params=params)
    data = r.json()
    since = data["server_time"]

    for change in data["changes"]:
        key = (change["match_id"], change["market"], change["round_number"])
        # update your local cache with change["sides"], change["is_available"]

    time.sleep(1.5)

Versioning & Change Policy

• The API surface under /api/b2b/* is considered stable.
• Additive changes (new optional fields, new endpoints) ship without notice.
• Breaking changes will be released under a new prefix (/api/b2b/v2/...) with a transition period announced per partner.