Common Request Format

Every call to a PHL endpoint uses the same JSON envelope. The business payload of the specific API is JSON-serialized, Base64-encoded, and carried in the data field.

Parameter Description

Property	Field Type	Mandatory	Description	Sample value
version	String	Y	version	1.0.0.0
uuid	String	Y	uuid	7f664792-b30f-48d4-a36e-c508b7cf6fd7
merchantCode	String	Y	Merchant Code	PNLM000001
signature	String	Y	MD5 signature is 32 characters, to prevent tampering during transmission	EE562C31AD9DBB7CFAFCA6E6CB6C11E3
data	String	Y	Request content, by default the content is encoded by Base64	eyJ1c2VybmFtZSI6IktpbSIsImN1cnJlbmN5IjoiVEhCIn0g

Data Description

Example API_001 Player Login request.

Before Base64 encode (sample data):

{"username":"ABC","currency":"PHP"}

After Base64 encode:

eyJ1c2VybmFtZSI6IktpbSIsImN1cnJlbmN5IjoiVEhCIn0g

Signature Description

Request body:

{
  "version": "1.0.0.0",
  "uuid": "7f664792-b30f-48d4-a36e-c508b7cf6fd7",
  "merchantCode": "PNLM000001",
  "signature": "94E196CF8D209F22C661BEB7ED55DF28",
  "data": "eyJ1c2VybmFtZSI6IktpbSIsImN1cnJlbmN5IjoiVEhCIn0g"
}

The signature is created by sorting each common parameter alphabetically and concatenating them with the + character. The parameter name and value are concatenated with the : character. Finally, the apiSecretKey is concatenated and encrypted with MD5, excluding the signature itself. The format should adhere to the specified pattern without any spaces:

data:{value}+merchantCode:{value}+uuid:{value}+version:{value}+apiSecretKey:{value}

note

The apiSecretKey is provided during merchant registration.

Concatenation example:

data:eyJ1c2VybmFtZSI6IktpbSIsImN1cnJlbmN5IjoiVEhCIn0g+merchantCode:MABT1234+uuid:7f664792-b30f-48d4-a36e-c508b7cf6fd7+version:1.0.0.0+apiSecretKey:DMJ3L5ZEUAFHOLMH5PRWIHFEXVTGGE4Y

After MD5 encryption and convert all to uppercase:

94E196CF8D209F22C661BEB7ED55DF28