Oryx Gaming

Overview

• ORYX HUB (Aggregator): single connection to dozens of studios and suppliers.
• ORYX RGS/Bragg RGS: remote game server for own and exclusive titles (e.g. Atomic Slot Lab, Indigo Magic, Wild Streak, etc.).
• PAM (Player Account Management) - optional: account/bonuses/campaigns (if a full stack is required).
• Promo platform (Campaigns/Promo/Fuze-like tools): tournaments, missions, freespins, jackpots, prize-drops.

The value for the operator is fast time-to-content, certification for key jurisdictions, unified APIs and reporting, as well as mature promotional mechanics without self-written bicycles.

Who fits: operators and aggregators who want a single sign-on to a large catalog of content, built-in promotional tools and predictable wallet integration.

Portfolio and user experience

Content

Bragg's own and exclusive studios: video slots (lines/ways, multipliers, hold-and-win/respins, bonus buy), sometimes tabular RNG games.
Partner directory via HUB: dozens of external studios in one contract/integration.
Jackpots: Fixed/Local/Network; prize-drops and mystery jackpots by configuration.

UX/UI

HTML5 clients, desktop/mobile, fast FCP; clean pay tables and clear descriptions of features.
L10n: interfaces/locales/currencies, regional number/date formats and Responsible Gaming messages.

Platform and delivery architecture

HUB: single API/directory, geo/certification/provider filtering, unified metadata and events.
RGS: stable game sessions, build control version, round/transaction reports.
Assets/CDN: manifests, sprites, localizations, audio - edge cache with managed TTL and manual disability.
JS Bridge/SDK: Game Events (SPIN/BONUS/WIN/JACKPOT) for Analytics/CRM/Promo.

Math, RTP and Limits

RTP pools: usually 96/94/92% (and other options) - selected at the build/directory level for jurisdiction and contract.
Volatility: low to extreme; the Volatility/Hit Rate display badge is recommended.
Limits: min/max rate, auto-backs, time limits; minor units as a unit of account for purse and reports.
Buy Feature/Bonus Buy: Inclusion by Market; clear exposure in UI and API flags.

Promotional tools (tournaments/missions/freespins/jackpots)

Free Rounds/Free Spins: mass distribution by 'game _ id', fix. rate/money, validity period; accounting for winnings in real/bonus balance, vager according to the rules of the operator.
Tournaments/leaderboards: by winnings/largest multiplier/number of spins; 'TOURNAMENT _ SCORE'events to dimension.

Missions/events: "play N spins," "win ≥ X ×," "activate feature M times."

Jackpots/Prize-drops: levels (mini/major/mega), mystery drops, seed/cap, multi-currency restrictions.
Segmentation: geo/VIP/device/channel target; campaign schedule.

Integration model (high-level)

1. The player → the front of the operator → SSO/JWT (short TTL).
2. Operator/Aggregator API ↔ Oryx/Bragg HUB/RGS API: creating a session, issuing 'launch _ url'.
3. Client (iFrame/new window) ↔ Game Server: game client + JS bridge (postMessage/SDK).
4. Wallet operator API: BET (auth-debit), WIN/PAYOUT (credit), JACKPOT_PAYOUT, rare adjustments.
5. Promo API (optional): freespins/tournaments/missions/drops.
6. BI/Reports: analytics events, round/transaction uploads, reconciliation.

Environmental requirements

Safety: TLS 1. 2 +, IP-allowlist S2S, request signing, key/secret rotation, strict CSP for iFrame domain.
Reliability: retrai with exponential pause, per player/session queues, key deadlock, sticky routing.
Compatibility: current Chrome/Edge/Safari/Firefox, iOS/Android WebView.

Create and start a session (pseudo-REST)

POST /api/v1/sessions
Authorization: Bearer <operator-key>
{
"player_id": "u_58831",
"currency": "EUR",
"locale": "ru-RU",
"game_id": "bragg_orx_<slug>" ,//or external provider via HUB
"return_url": "https://operator. example. com/casino/return",
"limits": { "bet_min_minor": 100, "bet_max_minor": 500000 },
"flags": { "bonus_buy": false },
"tags": { "vip_level": 2, "aff_id": "A-3201" }
}

{
"session_id": "sess_9c42...",
"launch_url": "https://hub. bragg. example/launch? sess=sess_9c42...",
"expires_in": 3600
}

Client launch: via 'launch _ url' in iFrame/window; heartbeat/reauth - seamless extension; events across the JS bridge.

Client Events and JS Bridge

Client → operator: 'GAME _ INIT', 'SPIN/BET', 'WIN', 'FEATURE _ TRIGGER', 'BONUS _ START/END', 'JACKPOT _ HIT', 'ERROR'.
Transport: 'postMessage '/JS-SDK with ACK/NACK; strict verification of'origin', idempotency on the receiver side.
Purpose: analytics, CRM triggers, campaigns (tournaments/missions/freespins).

Wallet API and idempotency

• BET (auth-debit): rate freeze/write-off → response'APPROVED/DECLINED '(+ balance/reason).
• WIN/PAYOUT (credit): Winning/jackpot credit (including prize-drop) → final balance return.
• ADJUST/REVOKE: rare adjustments with a full audit trail.

• 'X-Idempotency-Key '(TTL ≥ 24 hours) and operator-side deduplication.
• Processing queues per player/session → guaranteed order.
• Correlation by 'round _ id '/' bet _ id '/' session _ id'; DLQ for collisions and "anchor" replays.

POST /wallet/payouts
Idempotency-Key: 41f7-...
{
"player_id": "u_58831",
"round_id": "r_2025_11_02_17_47_12",
"amount_minor": 186000,
"currency": "EUR",
"reason": "round_win"
}

Reporting, uploading and reconciliation

Uploads: hourly/daily CSV/JSON/S3 for rounds/transactions/bonuses/jackpots/campaigns.
Reconciliation: reconciliation of amounts in minor units by'round _ id/bet _ id/session _ id'and statuses (success/declined/retry).
Anomalies: auto-alerts for duplicates, omissions, "dumb" collbacks and discrepancies in amounts.

Geo-configuration and compliance

Certification/geo-calendar: inclusion/exclusion of titles by jurisdiction, RTP profile selection, disabling bonus-buy/risk-play, local RG notification requirements.
Display rules: age/regional restrictions, cookies, local texts of the responsible game, self-exclusion/timeouts/limits.
Data/PII: minimization and pseudonymization of identifiers, shelf life of logs depending on the market.

Monitoring, SLO/SLA and operation

Key Metrics

Technical: uptime API/Launch/CDN, p95 wallet collbecks, JS bridge code errors, asset download speed.
Products: 'Launch → First Spin', 'Spin → Bonus', ARP (B) U, retention, ROI promotional campaigns (freespins/tournaments/missions/drops).
Financial: share of retrays/deduplications, anomalies in amounts, discrepancies in nightly reconciliations.

SLO/SLA Benchmarks

API uptime ≥ 99. 95%, delivery of assets/CDN ≥ 99. 9%.
Collbecks p95 <500 ms (within the region).
MTTR - according to the incident plan; separate SLOs for peak windows/campaigns.

Dashboards/alerts

Correlation'round _ id/bet _ id/callback _ id ', incident traces, status panel with communication regulations.

Security

Transport: TLS 1. 2+, HSTS; Strict CSP for iFrame domain.
Access: JWT/OAuth2 (client), IP-allowlist/signature/possible mutual-TLS (S2S), rotation of secrets.
Data: prohibition of open PII in the logs; hash/tokenization of 'player _ id'; encryption at rest/backup on the operator side.
Anti-fraud: spin/bet rate anomalies, multiple sessions, suspicious ASN/VPN; throttling/quotas/block lists.

Scalability and fault tolerance

Edge cache: manifests/assets/localizations - managed TTL, manual disability.
Rate-limits: per player/session/API; protection against "storms" of events.
Graceful degradation: simplification of assets/effects, limitation of the frequency of events, "technical pause" with a banner.
Failover: backup domains for Launch/CDN, re-issuing 'launch _ url' when token expires.

Checklists

For development

• Generation/validation of SSO tokens (short TTL, clock-skew).
• Wallet API: idempotent debit/credit, signature, queues, DLQ.
• JS bridge/SDK: events, ACK/NACK, secure 'origin'.
• Promo API: issuing freespins, setting up tournaments/missions/drops.
• Reports/Export: CSV/JSON/S3 formats, security, and field completeness.

To start

• Geo-directory, RTP profiles, disabling prohibited features.
• SLO monitoring (API/CDN/Wallet/JS bridge) + alerts.
• Nightly reconciliation and duplicate/skip alerts.
• RG/cookie banners, local requirements.
• Incident plan and status pages.

FAQ (brief)

Can iFrame run? Yes, through 'launch _ url' with negotiated CSP/' X-Frame-Options'.
How to connect external studios? Through ORYX HUB: single contract/integration, geo/certification filter.
Freespins and tournaments available? Yes, through the promo platform/Promo API and analytics events.
Got a bonus-buy? By game/market; is configured.
How do I select an RTP variant? At the build/catalog level for a specific jurisdiction and contract.

Total

Oryx Gaming (Bragg) gives the operator a single sign-on to a large catalogue of games, its own RGS and strong promotional tools. By following the described patterns (SSO/launch-URL, idempotent Wallet API, Promo API for freespins/tournaments/missions/jackpots, strict geo-configuration, monitoring and reconciliation), you will get a predictable content economy, regulatory compliance and peak stability.