Oyun Qurdu Corporate API

https://corporative.oyunqurdu.az/api/v1

# 1. find the product code
curl "https://corporative.oyunqurdu.az/api/v1/products?category=pubg-mobile" \
  -H "Authorization: Bearer $OQ_API_KEY"

# 2. live price right now
curl "https://corporative.oyunqurdu.az/api/v1/products/PUBGM-660-UC/quote" \
  -H "Authorization: Bearer $OQ_API_KEY"

# 3. order it (max_unit_price locks the quoted price)
curl -X POST https://corporative.oyunqurdu.az/api/v1/orders \
  -H "Authorization: Bearer $OQ_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"product": "PUBGM-660-UC", "fields": {"player_id": "5123456789"}, "reference": "INV-10045"}'

# 4. read the result (or wait for the webhook)
curl https://corporative.oyunqurdu.az/api/v1/orders/reference/INV-10045 \
  -H "Authorization: Bearer $OQ_API_KEY"

import os, time, requests

API = "https://corporative.oyunqurdu.az/api/v1"
s = requests.Session()
s.headers["Authorization"] = f"Bearer {os.environ['OQ_API_KEY']}"

order = s.post(f"{API}/orders", json={
    "product": "PUBGM-660-UC",
    "fields": {"player_id": "5123456789"},
    "reference": "INV-10045",            # your own unique ID
}, timeout=30).json()

while order["status"] == "processing":
    time.sleep(3)
    order = s.get(f"{API}/orders/{order['id']}", timeout=30).json()

print(order["status"], order["delivery"])

<?php
$api = "https://corporative.oyunqurdu.az/api/v1";
$ch = curl_init("$api/orders");
curl_setopt_array($ch, [
    CURLOPT_POST => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        "Authorization: Bearer " . getenv("OQ_API_KEY"),
        "Content-Type: application/json",
    ],
    CURLOPT_POSTFIELDS => json_encode([
        "product"   => "PUBGM-660-UC",
        "fields"    => ["player_id" => "5123456789"],
        "reference" => "INV-10045",
    ]),
]);
$order = json_decode(curl_exec($ch), true);
echo $order["id"], " ", $order["status"];

const API = "https://corporative.oyunqurdu.az/api/v1";
const headers = {
  "Authorization": `Bearer ${process.env.OQ_API_KEY}`,
  "Content-Type": "application/json",
};

const res = await fetch(`${API}/orders`, {
  method: "POST",
  headers,
  body: JSON.stringify({
    product: "PUBGM-660-UC",
    fields: { player_id: "5123456789" },
    reference: "INV-10045",
  }),
});
const order = await res.json();
console.log(order.id, order.status);

Authorization: Bearer oqc_Ab3dE5fG7h_••••••••••••••••••••••••••••••••••••••••

// Extensions → Apps Script. Project Settings → Script properties → OQ_API_KEY = oqc_…
// Deploy → New deployment → Web app. Embed its URL in Google Sites.
const API = "https://corporative.oyunqurdu.az/api/v1";
const KEY = PropertiesService.getScriptProperties().getProperty("OQ_API_KEY");

function call_(method, path, body) {
  const res = UrlFetchApp.fetch(API + path, {
    method: method,
    contentType: "application/json",
    headers: { Authorization: "Bearer " + KEY },
    payload: body ? JSON.stringify(body) : undefined,
    muteHttpExceptions: true,
  });
  return JSON.parse(res.getContentText());
}

function getPrice(code) {                       // google.script.run.getPrice("PUBGM-660-UC")
  return call_("get", "/products/" + encodeURIComponent(code) + "/quote");
}

function placeOrder(code, playerId, reference) { // add your own checks here
  return call_("post", "/orders", {
    product: code, fields: { player_id: playerId }, reference: reference,
  });
}

function doGet() { return HtmlService.createHtmlOutputFromFile("Index"); }

{
  "error": {
    "code": "insufficient_balance",
    "message": "Your balance is too low for this order.",
    "retryable": false,
    "details": {
      "balance": "4.20",
      "required": "9.17",
      "shortfall": "4.97"
    },
    "doc_url": "https://corporative.oyunqurdu.az/docs/#error-insufficient_balance"
  },
  "request_id": "req_3f9a1c0b7d2e4a6b8c1d"
}

{
  "error": {
    "code": "invalid_fields",
    "message": "Some product fields are missing or invalid.",
    "retryable": false,
    "details": {"fields": {
      "server_id": {"code": "required", "message": "Server ID is required."},
      "zone":      {"code": "unknown_field", "message": "This product does not take `zone`. Expected: player_id, server_id."}
    }},
    "doc_url": "https://corporative.oyunqurdu.az/docs/#error-invalid_fields"
  },
  "request_id": "req_3f9a1c0b7d2e4a6b8c1d"
}

{"status": "ok", "version": "1.0.0",
 "service": {"status": "maintenance", "message": "Ordering is paused for a short maintenance…", "retry_after": 300}}

X-RateLimit-Limit: 120
X-RateLimit-Remaining: 117
X-RateLimit-Reset: 41        # seconds until the window resets

{"balance": "1250.40", "currency": "USD"}

{"data": [
  {"code": "free-fire", "name": "Free Fire", "regions": ["CIS", "EU", "ID"], "product_count": 37},
  {"code": "steam", "name": "Steam Wallet", "regions": ["CIS", "GLOBAL"], "product_count": 29}
]}

{
  "code": "PUBGM-660-UC",
  "name": "PUBG Mobile — 660 UC",
  "category": "pubg-mobile",
  "category_name": "PUBG Mobile",
  "region": "GLOBAL",
  "type": "topup",
  "price": "9.17",
  "currency": "USD",
  "in_stock": true,
  "stock": null,
  "min_quantity": 1,
  "max_quantity": 10,
  "fields": [
    {
      "key": "player_id",
      "label": "Player ID",
      "type": "text",
      "required": true
    }
  ],
  "description": "Enter your Player ID before placing the order."
}

{
  "product": "PUBGM-660-UC",
  "name": "PUBG Mobile — 660 UC",
  "quantity": 2,
  "unit_price": "9.17",
  "total": "18.34",
  "currency": "USD",
  "available": true,
  "in_stock": true,
  "stock": null,
  "live": true,
  "quoted_at": "2026-10-24T09:12:40Z",
  "valid_until": "2026-10-24T09:13:40Z",
  "hint": "Send max_unit_price with the order to lock this price."
}

POST /products/MLBB-GLOBAL-86-DIAMONDS/validate
{"fields": {"player_id": "123456789", "server_id": "2001"}}

→ {"valid": true, "player_name": "ShadowFox"}

{
  "id": "ord_7kq2m9xw4hz8n3pd5t",
  "reference": "INV-10045",
  "status": "processing",
  "status_message": "The order is being fulfilled.",
  "product": {
    "code": "STEAM-GLOBAL-20-USD",
    "name": "Steam Wallet (Global) — 20 USD"
  },
  "quantity": 2,
  "unit_price": "21.62",
  "total": "43.24",
  "currency": "USD",
  "fields": {},
  "delivery": null,
  "failure": null,
  "created_at": "2026-10-24T09:12:44Z",
  "updated_at": "2026-10-24T09:12:47Z",
  "completed_at": null
}

{
  "id": "ord_7kq2m9xw4hz8n3pd5t",
  "reference": "INV-10045",
  "status": "completed",
  "status_message": "The order is complete.",
  "product": {
    "code": "STEAM-GLOBAL-20-USD",
    "name": "Steam Wallet (Global) — 20 USD"
  },
  "quantity": 2,
  "unit_price": "21.62",
  "total": "43.24",
  "currency": "USD",
  "fields": {},
  "delivery": {
    "type": "code",
    "codes": [
      "XXXXX-XXXXX-XXXXX",
      "YYYYY-YYYYY-YYYYY"
    ],
    "message": null
  },
  "failure": null,
  "created_at": "2026-10-24T09:12:44Z",
  "updated_at": "2026-10-24T09:12:47Z",
  "completed_at": "2026-10-24T09:12:47Z"
}

{"data": [
  {"id": "txn_k2m8q4w7x3z9n5p6r1", "type": "purchase", "amount": "-9.17",
   "balance_after": "1241.23", "currency": "USD", "order_id": "ord_7kq2m9xw4hz8n3pd5t",
   "description": "PUBGM-660-UC × 1", "created_at": "2026-10-24T09:12:44Z"}
], "pagination": {"page": 1, "per_page": 50, "total": 1, "total_pages": 1}}

POST https://your-server.example/oq/webhook
Content-Type: application/json
X-OQ-Event: order.updated
X-OQ-Delivery: evt_9w3k7m2q8x4z6n5p1r
X-OQ-Signature: t=1792833167,v1=5f1c…e9a2

{
  "id": "evt_9w3k7m2q8x4z6n5p1r",
  "type": "order.updated",
  "created_at": "2026-10-24T09:12:47Z",
  "data": {
    "order": {
      "id": "ord_7kq2m9xw4hz8n3pd5t",
      "reference": "INV-10045",
      "status": "completed",
      "status_message": "The order is complete.",
      "product": {
        "code": "STEAM-GLOBAL-20-USD",
        "name": "Steam Wallet (Global) — 20 USD"
      },
      "quantity": 2,
      "unit_price": "21.62",
      "total": "43.24",
      "currency": "USD",
      "fields": {},
      "delivery": {
        "type": "code",
        "codes": [
          "XXXXX-XXXXX-XXXXX",
          "YYYYY-YYYYY-YYYYY"
        ],
        "message": null
      },
      "failure": null,
      "created_at": "2026-10-24T09:12:44Z",
      "updated_at": "2026-10-24T09:12:47Z",
      "completed_at": "2026-10-24T09:12:47Z"
    }
  }
}

import hashlib, hmac, time

def verify(raw_body: bytes, header: str, secret: str) -> bool:
    parts = dict(p.split("=", 1) for p in header.split(","))
    t, sig = parts.get("t", ""), parts.get("v1", "")
    if not t.isdigit() or abs(time.time() - int(t)) > 300:
        return False
    expected = hmac.new(secret.encode(), f"{t}.".encode() + raw_body,
                        hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, sig)

function oq_verify(string $rawBody, string $header, string $secret): bool {
    parse_str(str_replace(",", "&", $header), $p);
    if (!isset($p["t"], $p["v1"]) || abs(time() - (int)$p["t"]) > 300) return false;
    $expected = hash_hmac("sha256", $p["t"] . "." . $rawBody, $secret);
    return hash_equals($expected, $p["v1"]);
}
// $ok = oq_verify(file_get_contents("php://input"), $_SERVER["HTTP_X_OQ_SIGNATURE"], $secret);

import crypto from "node:crypto";

export function verify(rawBody, header, secret) {
  const p = Object.fromEntries(header.split(",").map(x => x.split("=")));
  if (!p.t || Math.abs(Date.now() / 1000 - Number(p.t)) > 300) return false;
  const expected = crypto.createHmac("sha256", secret)
    .update(`${p.t}.`).update(rawBody).digest("hex");
  return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(p.v1 || ""));
}
// Express: app.post("/oq/webhook", express.raw({type: "application/json"}), …)

https://corporative.oyunqurdu.az/api/v1/openapi.json