Platform → provider webhooks

Most of your integration is calls you make to the platform. These three routes are the exception: the platform calls you. Implement the ones you need at the webhook baseUrl you registered with your integration contact (see Environments & base URLs) — all three live at the same baseUrl.

Shared model

• Signed the same way as your own outbound calls — X-Tenant-ID, X-Timestamp, X-Nonce, X-Signature headers, HMAC-SHA256 over the same canonical string, using your provider secret. X-Tenant-ID carries your own provider tenant ID (the platform asserting "this call is for you," not naming itself). See Signing & authentication.
• Verify every call with @moose/provider-sdk's verifyPlatformSignature before trusting the body — the usual "the SDK signs it for me" story is reversed here, since the platform is the caller.
• Your route needs the raw request body. Signature verification requires the exact bytes the platform signed — register these routes with a raw-body reader, not JSON-parsing middleware.
• The platform does not retry a failed call to any of these routes. Unlike your own outbound calls via ProviderClient, a lost or failed response here is not automatically retried — key your handling off the request's own identifier (requestRef/externalRef for free spins) so a follow-up call is safe to process idempotently.

The routes

Route	Fires when	Reference
POST /v1/game/session/revoke	An operator force-ends a player's session mid-game (a kick, a self-exclusion, a fraud hold)	Session revoke webhook
POST /v1/game/free-spins/grant	The free-spins promotion tool issues a batch of free spins	Free spins webhook
POST /v1/game/free-spins/status	A pull query for a previously granted batch's remaining spins	Free spins webhook
POST /v1/game/free-spins/cancel	The free-spins promotion tool cancels a batch's remaining, unused spins	Free spins webhook

Free-spin execution and math stay entirely on your side in all cases — these webhooks only ever move bookkeeping (spins granted, spins remaining, session validity), never money. A player's winnings, including from a free spin, are always submitted through the normal POST /v1/wallet/transaction WIN path — see Wallet API reference.