session_completed
POST
Sent when a player finishes a play. Test plays from the dashboard send nothing.
Every delivery is a JSON POST with the envelope
{ type, createdAt, data } and these headers:
X-Keliplay-Signature:t=<unix seconds>,v1=<hex>.v1is the HMAC-SHA256 of<t>.<raw body>, keyed with the endpoint’ssecret. Compute it yourself, compare, and reject oldtvalues to stop replays.X-Keliplay-Event: the event type.X-Keliplay-Delivery-Id: unique per delivery. Use it to ignore duplicates.
Answer with any 2xx within 10 seconds. A timeout, a network error, 408, 429 or 5xx is retried with growing delays, up to 5 attempts in all. Any other status is not retried.
Authorizations
Section titled “Authorizations”Parameters
Section titled “Parameters”Header Parameters
Section titled “Header Parameters”X-Keliplay-Signature
required
string
t=<unix seconds>,v1=<hex HMAC-SHA256 of "<t>.<raw body>">, keyed with the endpoint secret.
Example
t=1760277802,v1=5f2b7c0e9a1d4b3c8e6f0a2d4c6b8e0f1a3c5e7092b4d6f8a0c2e4b6d8f0a1c3X-Keliplay-Event
required
string
The event type, the same as type in the body.
X-Keliplay-Delivery-Id
required
string
Unique per delivery, and the same on every retry of it.
Request Bodyrequired
Section titled “Request Bodyrequired”Media typeapplication/json
object
type
required
string
createdAt
required
string format: date-time
data
required
object
type
required
Example
{ "type": "session_completed", "createdAt": "2026-10-12T14:03:22.000Z", "data": { "gameInstanceId": "0192f3a1-0000-7000-8000-0000000ca001", "sessionId": "0192f3a1-0000-7000-8000-000000050001", "participantRef": "user_48213", "outcome": { "id": "segment-3", "label": "Free coffee", "isWin": true }, "score": null }}Responses
Section titled “Responses”Any 2xx tells Keliplay the delivery arrived.