Common APIs for GDK titles
The following APIs are commonly used for secure and robust web requests in Microsoft Game Development Kit (GDK) titles. They also help simplify implementation.
Windows HTTP Services (WinHTTP)
WinHTTP can also be used to create HTTP and WebSocket service endpoints on both PCs and XBOX consoles with no code changes. Because this API doesn’t automatically handle all security best practices, make sure to read Communication Security Overview (NDA article) and WinHTTP overview to learn how to ensure that your implementation is secure and robust.
xCurl handles security best practices, including certificate chain validation and networking connectivity checks. It also manages network initialization and suspend/resume automatically.
If your title uses WinHTTP or another HTTP stack instead of xCurl, assume that the title owns platform integration work such as network initialization, suspend/resume handling, and explicit security configuration. For sequencing and lifecycle guidance, see Network initialization and connectivity and WinHTTP overview.
For proxy-based debugging workflows on XBOX, start with Fiddler on XBOX consoles. If your title uses a custom stack, see Debugging custom HTTP stacks for XBOX-specific proxy and certificate guidance.
xCurl
xCurl is an HTTP API available to Microsoft Game Development Kit (GDK) titles. It simplifies title development by adhering to all security best practices automatically. Since the API surface broadly matches libCurl, it also has libCurl’s full flexibility and HTTP feature set. To learn more about the xCurl API and differences between xCurl and libCurl, see xCurl overview.XSAPI
XBOX Services API (XSAPI) provides a generic REST wrapper for Microsoft Game Development Kit (GDK) titles. This wrapper is straightforward to use and follows the Microsoft Game Development Kit (GDK) asynchronous API model. If your title only needs to make REST HTTP requests, this is likely the simplest interface to use.- Use XblHttpCallCreate to create an HTTP handle to track your
RESTrequest. - Fill in the body and any extra configuration with one of the
XblHttpCallRequestSet*functions. - Call XblHttpCallPerformAsync to make the request.
- To retrieve the response, use one of the
XblHttpCallGet*functions. - Close the handle by using XblHttpCallCloseHandle.
XblHttpCallRequestSet* and XblHttpCallGet* represent groups of functions to build HTTP requests and retrieve HTTP responses.- XblHttpCallRequestSetHeader
- XblHttpCallRequestSetLongHttpCall
- XblHttpCallRequestSetRequestBodyBytes
- XblHttpCallRequestSetRequestBodyString
- XblHttpCallRequestSetRetryAllowed
- XblHttpCallRequestSetRetryCacheId
- XblHttpCallGetHeader
- XblHttpCallGetHeaderAtIndex
- XblHttpCallGetNetworkErrorCode
- XblHttpCallGetNumHeaders
- XblHttpCallGetPlatformNetworkErrorMessage
- XblHttpCallGetRequestUrl
- XblHttpCallGetResponseBodyBytes
- XblHttpCallGetResponseBodyBytesSize
- XblHttpCallGetResponseString
- XblHttpCallGetStatusCode
libHttpClient
The libHttpClient is designed to enable two-way communication. It’s an abstraction layer designed for use by XBOX Live Service API (XSAPI) to enable HTTP and WebSocket service endpoints. The API is in the Game Development Kit (GDK) as part of XSAPI.Suspend and resume with libHttpClient
Unlike xCurl,libHttpClient doesn’t automatically drain or tear down in-flight work when the title suspends. Titles that use libHttpClient (including its WebSocket support) must handle the suspend/resume lifecycle explicitly. Retail consoles enter suspend on standby, so a WebSocket connection or async operation left open across suspend can hang or crash on resume even when the same title suspends and resumes cleanly on a dev kit.
On suspend or shutdown:
- Stop queueing new HTTP and WebSocket work.
- Cancel or drain in-flight requests and WebSocket sends and receives.
- Close WebSocket connections and destroy HTTP call handles, sessions, and sockets that shouldn’t survive suspend.
XNetworkingConnectivityHint::networkInitialized to be true before recreating libHttpClient state or reopening WebSocket connections.
For the full sequencing rules and the reasoning behind them, see Detecting network initialization status and the game life-cycle guidance in Responding to suspend and resume.