Web requests overview

This article provides an overview of Hypertext Transfer Protocol (HTTP) and WebSocket web requests for Microsoft Game Development Kit (GDK) titles.

Starting with the right API set makes it easier for you to implement secure and robust web requests.

Common APIs for GDK titles

The following APIs are commonly used for secure and robust web requests in Microsoft Game Development Kit (GDK) titles. They also help simplify implementation.

Use case	Common API choice
REST requests with Gaming Runtime Services (GRTS) style APIs	Microsoft Xbox Live Service API (XSAPI)
General purpose HTTP requests	xCurl
WebSocket requests	libHttpClient

Windows HTTP Services (WinHTTP)

WinHTTP can also be used to create HTTP and WebSocket service endpoints on both PCs and Xbox consoles with no code changes. Because this API doesn't automatically handle all security best practices, make sure to read Communication Security Overview (NDA article)Auktorisering krävs and WinHTTP overview to learn how to ensure that your implementation is secure and robust.

xCurl handles security best practices, including certificate chain validation and networking connectivity checks. It also manages network initialization and suspend/resume automatically.

If your title uses WinHTTP or another HTTP stack instead of xCurl, assume that the title owns platform integration work such as network initialization, suspend/resume handling, and explicit security configuration. For sequencing and lifecycle guidance, see Network initialization and connectivity and WinHTTP overview.

For proxy-based debugging workflows on Xbox, start with Fiddler on Xbox One consoles. If your title uses a custom stack, see Debugging custom HTTP stacksAuktorisering krävs for Xbox-specific proxy and certificate guidance.

xCurl

xCurl is an HTTP API available to Microsoft Game Development Kit (GDK) titles. It simplifies title development by adhering to all security best practices automatically. Since the API surface broadly matches libCurl, it also has libCurl's full flexibility and HTTP feature set.

To learn more about the xCurl API and differences between xCurl and libCurl, see xCurl overview.

XSAPI

Xbox Services API (XSAPI) provides a generic REST wrapper for Microsoft Game Development Kit (GDK) titles. This wrapper is straightforward to use and follows the Microsoft Game Development Kit (GDK) asynchronous API model. If your title only needs to make REST HTTP requests, this is likely the simplest interface to use.

1. Use XblHttpCallCreate to create an HTTP handle to track your REST request.
2. Fill in the body and any extra configuration with one of the XblHttpCallRequestSet* functions.
3. Call XblHttpCallPerformAsync to make the request.
4. To retrieve the response, use one of the XblHttpCallGet* functions.
5. Close the handle by using XblHttpCallCloseHandle.

Note

XblHttpCallRequestSet* and XblHttpCallGet* represent groups of functions to build HTTP requests and retrieve HTTP responses.

• XblHttpCallRequestSetHeader

• XblHttpCallRequestSetLongHttpCall

• XblHttpCallRequestSetRequestBodyBytes

• XblHttpCallRequestSetRequestBodyString

• XblHttpCallRequestSetRetryAllowed

• XblHttpCallRequestSetRetryCacheId

• XblHttpCallGetHeader

• XblHttpCallGetHeaderAtIndex

• XblHttpCallGetNetworkErrorCode

• XblHttpCallGetNumHeaders

• XblHttpCallGetPlatformNetworkErrorMessage

• XblHttpCallGetRequestUrl

• XblHttpCallGetResponseBodyBytes

• XblHttpCallGetResponseBodyBytesSize

• XblHttpCallGetResponseString

• XblHttpCallGetStatusCode

libHttpClient

The libHttpClient is designed to enable two-way communication. It's an abstraction layer designed for use by Xbox Live Service API (XSAPI) to enable HTTP and WebSocket service endpoints. The API is in the Game Development Kit (GDK) as part of XSAPI.

See also

Windows HTTP Services (WinHTTP)

libCurl

Setting up web services at Partner Center (NDA article)

Fiddler on Xbox One consoles

Communication Security Overview (NDA article)Auktorisering krävs