Network inventory (OBSERVED)

Order	Method	URL	Notes
1	GET	`games.pixentech.com/crash.live/goldencatch/assets/env/commonConfig.json`	Static config, saved
2	POST	`clgaming-be.pixentech.com/gamebe/games/init`	XHR, body not captured
3	GET	`.../assets/locale/en/gameContent.json`, `commonContent.json`	Static text
4	GET	`…/assets/images/@1x/*.json	webp`,` …/assets/spines/@1x/bg.*`, fonts
5	POST	`clgaming-be.pixentech.com/gamebe/games/spin`	One call per spin click, JSON, HTTP 200

Request headers on spin (from recorder): Accept: application/json, text/plain, */*, Content-Type: application/json. No custom auth header was set by the script; auth is the token field in the JSON body (and possibly cookies, not visible to the recorder, not inspected).

Total gameplay API calls made by me: 1 spin, plus init calls triggered by page loads (2 loads: one failed bare-URL load, one normal load).

Capture method

A passive in-page wrapper over fetch and XMLHttpRequest stored method, URL, request body, status, and response text in window.__cap, masking the raw token. I then redacted base64 token and playerId by hand when writing files. It adds no network traffic.

Added after the cheat round (OBSERVED)

Method	URL	Notes
POST	`.../gamebe/games/spin` (cheat armed)	Extra body field `combination`
POST x10	`.../gamebe/games/feature`	Body: `gameId`, `playerId`, `token`, `featureName` (base64 `freespins`), `combination`. One per free spin, about 3 s apart