NationStates API (nationdata/regiondata)

[[violet]]

Makes a lot of sense. I'm not sure why they're not there already. Adding now.

[Shadow Afforess]

Makes a lot of sense. I'm not sure why they're not there already. Adding now.

Happening Ids, Post Ids, or both?

*hopes for both*

[[violet]]

Post IDs are now included in Region API output. E.g.:

http://www.nationstates.net/cgi-bin/api ... q=messages

Event IDs are a bit more complicated, because that requires fully decommissioning the old event logging system. Currently the old system (which just tacks on the last 10 log lines to a region or nation) is still used in a few places. It's redundant now, but taking it down completely requires a bit of code rewriting and testing. So right now if you request events from the Region or Nation APIs, they have no event IDs attached, because they are not actually from that system. But if you request them via the World API, like this, they do have IDs:

http://www.nationstates.net/cgi-bin/api ... he_pacific

[Shadow Afforess]

Post IDs are now included in Region API output. E.g.:

http://www.nationstates.net/cgi-bin/api ... q=messages

Event IDs are a bit more complicated, because that requires fully decommissioning the old event logging system. Currently the old system (which just tacks on the last 10 log lines to a region or nation) is still used in a few places. It's redundant now, but taking it down completely requires a bit of code rewriting and testing. So right now if you request events from the Region or Nation APIs, they have no event IDs attached, because they are not actually from that system. But if you request them via the World API, like this, they do have IDs:

http://www.nationstates.net/cgi-bin/api ... he_pacific

Fair enough. Post ids were the most important part anyway.

[[violet]]

API is now bumped to version 6, as demonym and variants are now included in Daily Dumps.

[Shadow Afforess]

API is now bumped to version 6, as demonym and variants are now included in Daily Dumps.

Very cool.

Another possible improvement to the API: Add submitted proposals to the WA API. It would be nice to be able to track those without some HTML scraping. I'm thinking charting how fast they get approvers to extrapolate which proposals will reach quorum.

[Jarden]

Question: How would I go about obtaining a Secret Key

[Eluvatar]

Question: How would I go about obtaining a Secret Key

Answer: file a Getting Help Request as described in the API documentation:

Telegrams API Client Key

Unlike the rest of the API, to use the Telegrams API you need an API Client Key. Currently, you can do this by lodging a Help Request with the moderators, describing:

1. The purpose of your script (e.g. to send recruitment TGs, welcome-to-my-region TGs...)
2. The region your script will be serving
3. The nation primarily responsible for the script

API Client Keys are tied to a particular region, and each region may only have one (although they can be revoked and re-issued). Multiple people and scripts within a region can use the same API Client Key. If they do, they will be bound by the same rate limit: that is, when anyone uses the API Client Key to send a recruitment telegram, no-one else using the same API Client Key will be able to send more messages until the rate limit expires.

Once approved, a moderator will telegram you an API Client Key, which you can use for future API calls.

You are responsible for all use of your Telegrams API Client Key. If you suspect that it is not being used appropriately, please immediately contact the moderators.

(This process is still being developed and may change in the future. It is currently mostly geared around the idea of using the Telegrams API to send recruitment telegrams for a particular region, and may be confusing to people wishing to do other things as well. If you are unsure, please file a Help Request or post in the Technical Forum.)

[Cerberion]

I don't think this has been asked for and may be denied, but on reworking my TG API script it struck me that having an API call to determine if a certain TG type was being blocked could really cut down on the queue.

Example of the suggested nation shard:
q=acceptedTGs

XML being returned something like:

Code: Select all

<ACCEPTEDTGS>
  RECRUITMENT>0</RECRUITMENT>
  <WACAMPAIGN>1</WACAMPAIGN>
  <OFFICIAL>2</OFFICIAL>
  <EXTERNAL>3</EXTERNAL>
</<ACCEPTEDTGS>


Where 0 through 3 are the levels set based on the All, Most, Some, None scale in the TG settings.

This would assist with helping telegram campaigns to rduce the number of messages in the queue. Certainly the state might change after the TG was in the queue but I'd certainly not like to waste 30 seconds or 3 minutes on a nation that already has everything blocked.

Thoughts?

[Eluvatar]

I don't think this has been asked for and may be denied, but on reworking my TG API script it struck me that having an API call to determine if a certain TG type was being blocked could really cut down on the queue.

Example of the suggested nation shard:
q=acceptedTGs

XML being returned something like:

Code: Select all

<ACCEPTEDTGS>
  RECRUITMENT>0</RECRUITMENT>
  <WACAMPAIGN>1</WACAMPAIGN>
  <OFFICIAL>2</OFFICIAL>
  <EXTERNAL>3</EXTERNAL>
</<ACCEPTEDTGS>


Where 0 through 3 are the levels set based on the All, Most, Some, None scale in the TG settings.

This would assist with helping telegram campaigns to rduce the number of messages in the queue. Certainly the state might change after the TG was in the queue but I'd certainly not like to waste 30 seconds or 3 minutes on a nation that already has everything blocked.

Thoughts?

I would also appreciate such a shard.

[Rich and Corporations]

I have implemented a version of the authentification API using PHP. It uses forward secrecy (the suggestion to use a hash is nonsensically insecure, particularly as SHA-3 has yet to be deployed).

For some reason the if authenticated check doesn't work. But all the other parts work so here it is:
EDIT: fixed the authenticated check problem, by commenting out the part where a new session ID is set.
http://usiga.info/phpapi.php

Code: Select all

<?
session_start();

if(!isset($_SESSION["token"]))
{

$_SESSION["token"] = bin2hex(openssl_random_pseudo_bytes(7)); //forward secrecy. besides, on a shared host, you aren't paying for electricity
}

if ( $_SESSION["auth"] == 1 ) //if authenticated
{
echo "<br> Hello ". $_SESSION["nationname"] ."<hr>";
}
elseif ( isset($_POST["secret"] ) ) //authentication
{

if ( file_get_contents('http://www.nationstates.net/cgi-bin/api.cgi?a=verify&nation='. urlencode( $_POST["nationname"] ) . '&checksum=' . urlencode( $_POST["secret"] ) . '&token='. urlencode( $_SESSION["token"] ) . '') == 1 )
{
//sets new session ID, important once you authenticate a user.
//session_id( 'b4'.bin2hex(openssl_random_pseudo_bytes(7)) );
$nationname = $_POST["nationname"];
$_SESSION["nationname"] = $nationname;
echo "You have logged in, $nationname ";
$_SESSION["auth"] = 1;
}
else
{
echo "Authentication Fail";
}



}
else //not authenticated
{


echo ' <a href = "http://www.nationstates.net/page=verify_login?token=' . $_SESSION["token"] . '">Click here to retrieve your login verification code.</a>  ';
echo <<<END
<form action="phpapi.php" method="post"> Nation Name:
<input type="text" name="nationname"><br> Secret:
<input type="text" name="secret"><br>
 <input type="submit" value="Submit">
</form>
END;

}


//script calculation time
$time = round(microtime(true) - $_SERVER["REQUEST_TIME_FLOAT"],6);
echo "<br> Script execution time: <b> $time</b> seconds.";
?>

[Rich and Corporations]

Searched the thread... when was the authentication API added? I knew I would notice it being mentioned in this thread, and a search of this thread offered no answers.

Suggestion: instead of giving a timestamp of zero, give a timestamp of the day (rough estimate) that NS went into operation.

Suggestion 2: Authentication would be so much easier if there was a way to get the user to press a button on the verify_login page that would post to a webpage of the App creator's choice.

[Nerzhul]

Can someone help me? I am trying to make a widget on forumotion that will display new about my region. is there anyway to do this? I dont no php very well, and any help will be greatly appreciated

[Eluvatar]

Searched the thread... when was the authentication API added? I knew I would notice it being mentioned in this thread, and a search of this thread offered no answers.

Suggestion: instead of giving a timestamp of zero, give a timestamp of the day (rough estimate) that NS went into operation.

Suggestion 2: Authentication would be so much easier if there was a way to get the user to press a button on the verify_login page that would post to a webpage of the App creator's choice.

The Auth API is known to be fundamentally insecure. It is discussed here, here, and here. I would advise application developers against using the NS Auth API, and I would advise NS users to use the NS Auth API only in connection with one offsite application. I.E. if you use NS++, do not use the NS Auth with anything else or you risk granting access to your NS++ stuff (NS++ newspaper editing privileges, and whatever else NS++ uses NS Auth to authenticate for) to the operator of the other application.

What I do recommend using, though it is a bit bothersome, is the telegram token system. To use the token system, one must send the nation which one wishes to authenticate a telegram template containing %TOKEN%. The following code, or equivalent, can be used to authenticate, subsequently:

Code: Select all

from hashlib import md5
import string,codecs

ID_STR_TRANS=string.maketrans(" "+string.ascii_uppercase,"_"+string.ascii_lowercase)

def id_str(name):
    i,i2=codecs.getencoder('ascii')(name)
    return i.translate(ID_STR_TRANS)

def verify_token(tg_secret_key, nation, token):
    hash_ = md5(id_str(nation) + ':' + tg_secret_key)
    return hash_.hexdigest()[0:8] == token


Or, as you use PHP:

Code: Select all


function id_str($nation) {
    return strtr($nation, " ABCDEFGHIJKLMNOPQRSTUVWXYZ","_abcdefghijkhlmnopqrstuvwxyz");
}

function verify_token($tg_secret_key, $nation, $token) {
    $hash = md5(id_str($nation) . ':' . $tg_secret_key);
    return substr($hash, 0, 8) === $token;
}


---

I'm poking at the TG API and I seem to have run into a bug. I have been attempting to test a recruitment template by sending with my API key ("@Taijitu@ Eluvatar") a recruitment TG template I created for this test (details obviously accessible to game administration) to Eluvataran Isles. The API tells me "queued", and Eluvataran Isles does not have recruitment telegrams blocked. I see the following under delivery reports (after several attempts):

1 Delivered [+]

eluvataran isles

0 Recruits (conversion rate: 0.00%)
[?]

1 Previous Recruitment Too Recent [+]

eluvataran isles

The problem I am reporting is that while the report claims it was delivered, I do not see it in Eluvataran Isles' inbox. Oddly enough, I can merrily send non-recruitment api telegrams from Eluvataran to Eluvatar Isles and vice versa with no such problem.

What might be the problem?

---

Can someone help me? I am trying to make a widget on forumotion that will display new about my region. is there anyway to do this? I dont no php very well, and any help will be greatly appreciated

I have no idea what you want to do.

I imagine you want a widget to display news, but what kind of news is not readily apparent.

Edit1: Added reply to Nerzhul, Edit2: Added recommendation to use telegram tokens

[Ballotonia]

I'm poking at the TG API and I seem to have run into a bug. I have been attempting to test a recruitment template by sending with my API key ("@Taijitu@ Eluvatar") a recruitment TG template I created for this test (details obviously accessible to game administration) to Eluvataran Isles. The API tells me "queued", and Eluvataran Isles does not have recruitment telegrams blocked. I see the following under delivery reports (after several attempts):

1 Delivered [+]

eluvataran isles

0 Recruits (conversion rate: 0.00%)
[?]

1 Previous Recruitment Too Recent [+]

eluvataran isles

The problem I am reporting is that while the report claims it was delivered, I do not see it in Eluvataran Isles' inbox. Oddly enough, I can merrily send non-recruitment api telegrams from Eluvataran to Eluvatar Isles and vice versa with no such problem.

What might be the problem?

The report said you sent two recruitment telegrams using that template. The first one was delivered (and depending on the nation's filtering settings it may or may not end up in that nation's inbox). The second was not delivered because it was sent too recent after the first one. There's a limit of recruiting a nation for a region at most once per 28 days.

Ballotonia

[Eluvatar]

I'm poking at the TG API and I seem to have run into a bug. I have been attempting to test a recruitment template by sending with my API key ("@Taijitu@ Eluvatar") a recruitment TG template I created for this test (details obviously accessible to game administration) to Eluvataran Isles. The API tells me "queued", and Eluvataran Isles does not have recruitment telegrams blocked. I see the following under delivery reports (after several attempts):


The problem I am reporting is that while the report claims it was delivered, I do not see it in Eluvataran Isles' inbox. Oddly enough, I can merrily send non-recruitment api telegrams from Eluvataran to Eluvatar Isles and vice versa with no such problem.

What might be the problem?

The report said you sent two recruitment telegrams using that template. The first one was delivered (and depending on the nation's filtering settings it may or may not end up in that nation's inbox). The second was not delivered because it was sent too recent after the first one. There's a limit of recruiting a nation for a region at most once per 28 days.

Ballotonia

I was not surprised to see the "recruitment telegram too recent" result. I was surprised to see "Delivered" with no such telegram in the nation's inbox. (Note: prior to my second TG attempt, the report consisted only of the "delivered" part.) In retrospect though I think the inbox may have been full, causing the telegram to perhaps be immediately deleted. (I note that in the old system, it would be the oldest (unsaved) telegram that would be deleted to make room, not the newest, and if all of the slots were occupied by a saved telegram, delivery would be blocked with an error).

Does the inbox only let itself temporarily overflow if the telegram is received while the nation is logged in?

If inbox overflow is the explanation, why are telegrams that do not actually make it into the inbox get marked as delivered?

[Ballotonia]

If inbox overflow is the explanation, why are telegrams that do not actually make it into the inbox get marked as delivered?

It's like regular mail. Delivered means the letter went through the mail system to its destination. If the recipient then chooses to discard it unread (filter), or it falls by the wayside because the inbox is overflowing, that doesn't matter for the delivery. The delivery itself actually took place.

Ballotonia

[Cerberion]

If inbox overflow is the explanation, why are telegrams that do not actually make it into the inbox get marked as delivered?

It's like regular mail. Delivered means the letter went through the mail system to its destination. If the recipient then chooses to discard it unread (filter), or it falls by the wayside because the inbox is overflowing, that doesn't matter for the delivery. The delivery itself actually took place.

Ballotonia

What is the current behavior when the inbox is full? I can't find any documentation on what to expect in the nationstates API but I'm sure it is in a thread somewhere. Can these quirks and behaviors be detailed in some kind of an official thread so we know what to expect?

My belief is that newer TGs shunt older ones out but after this post I am now entirely unclear on the subject.

[Rich and Corporations]

here,

The site-specific token problem is really easy to fix. I just inadvertently fixed it. You use openssl pseudorandom bytes with at minimum a 32-bit entropy, and no one can actually impersonate you. Forward secrecy.

My php script is still vulnerable to session fixation attacks, and other cookie based attacks, but it's secure from phishing. It seems like the API converts a SHA-2-256 hash to base64, which seems insecure as it doesn't use perfect secrecy. Once again, crypto-secure random bytes ought to be used.

Internet security isn't as complex as mysql queries, in my opinion.

If inbox overflow is the explanation, why are telegrams that do not actually make it into the inbox get marked as delivered?

It's like regular mail. Delivered means the letter went through the mail system to its destination. If the recipient then chooses to discard it unread (filter), or it falls by the wayside because the inbox is overflowing, that doesn't matter for the delivery. The delivery itself actually took place.

Ballotonia

I just created a new nation, and it got 30 telegrams over a period of forty hours.

[Rich and Corporations]

Non-recruitment TGs: 1 telegram per 30 seconds

I request that the rate limit be changed to 5 telegrams every 180 seconds. It's because media temple has some restrictions regarding cron jobs.

Currently working on a scorination utility, with random numbers being persistently generated by a disinterested third party.

[Rich and Corporations]

It would be nice to have shards for the telegrams API. You know, to insert text and so forth.

[Rich and Corporations]

trying to make a banking application

openaccount.php

Code: Select all

<?
session_start();

include 'config.php';

if(!isset($_SESSION["token"]))
{

$_SESSION["token"] = bin2hex(openssl_random_pseudo_bytes(8));
}
//<!-- target="_blank" is an iframe target, except it opens a new window -->
?>

<html lang="en">
<head>
<title>Open a Money Market Account</title>
<meta name="author" content="Ryan Carboni">
<meta name="generator" content="My own two hands and notepad++">
<meta http-equiv="Content-Type" content="text/html; charset=windows-1252">
</head>
<body bgcolor="#eeeeee"  link="blue">
<br>This page is only for government customers only. Corporate Bank and Trust does not serve smaller entities.
<br>Money market accounts are uninsured by the government of Rich and Corporations. Interest rates are based on the current value of investment return in securities and loans, thus you don't have to worry about ponzi-high interest rates that are not backed by anything other than dodgy accounting practices.
 You may not deposit more than $1 per day, this cap rolls over every day, so there is no need to worry about missing a day.
<?
echo '<br><a href = "http://www.nationstates.net/page=verify_login?token=' . $_SESSION["token"] . '" target="_blank">Click here to retrieve your login verification code.</a>';
echo <<<END
<form action="apply.php" method="post"> Nation Name:
<input type="text" name="nationname"><br>
Secret: <input type="text" name="secret">
<br> <input type="submit" value="Submit">
</form>
END;

//script calculation time
$time = round(microtime(true) - $_SERVER["REQUEST_TIME_FLOAT"],6);
echo "<br> Script execution time: <b> $time</b> seconds.";
?>


apply.php

Code: Select all

<?
session_start();

ini_set('user_agent', 'usiga.info email');
ob_start();

?>
<html lang="en">
<head>
<title>Application Response</title>
<meta name="author" content="Ryan Carboni">
<meta name="description" value="Multipurpose website">
<meta name="generator" content="My own two hands and notepad++">
<meta http-equiv="Content-Type" content="text/html; charset=windows-1252">
<!-- HTML 4 Compliant -->
</head><body bgcolor="#eeeeee"  link="blue">
<?

include 'config.php';
$nationname = $_POST["nationname"];
$_SESSION["nationname"] = $nationname;

$db = mysqli_connect('DB_HOST', 'DB_USER', 'DB_PASS', 'DB_NAME');
if($db->connect_errno > 0){
    die('Unable to connect to database [' . $db->connect_error . ']');
}

if ( file_get_contents('http://www.nationstates.net/cgi-bin/api.cgi?a=verify&nation='. urlencode( $_POST["nationname"] ) . '&checksum=' . urlencode( $_POST["secret"] ) . '&token='. urlencode( $_SESSION["token"] ) . '') == 1 )
{

$q = mysqli_query($db, "SELECT * FROM 'accounts' WHERE 'nationname'='$nationname'");
if  (mysqli_num_rows($q) == 0)
{

$file = 'http://www.nationstates.net/cgi-bin/api.cgi?nation=' . urlencode($nation) . '&q=' . 'fullname+population';
      $xml = simplexml_load_file($file);
      return $xml;

$data = get_data($nation, 'fullname+population');   
$fullname = (string) $data->FULLNAME;
$population = (int) $data->POPULATION;

$_SESSION["fullname"] = $fullname;
$_SESSION["population"] = $population;
$_SESSION["freshness"] = time();
$time = time();

$qq = mysqli_query($db, "INSERT INTO 'accounts' VALUES('$nationname', '$time', '$population', '', '0', '0')");

echo "You have opened a new account, $fullname and your nation has a population of $population million people.";
$_SESSION["authen"] = 1;
$_SESSION["IP"] = $_SERVER['REMOTE_ADDR'];
}
else {
//You already have an account
echo "You already have an account with us, $fullname .";
}
}
else
{
echo "Authentication Fail";
}


ob_end_flush();
$time = round(microtime(true) - $_SERVER['REQUEST_TIME_FLOAT'] - $time,6);
echo "<br> Script execution time: <b> $time</b> seconds. <br><hr>";
echo " Last modified: " . date ("F d Y H:i:s.", getlastmod());
?>

I get this error:

Warning: mysqli_connect(): (HY000/2005): Unknown MySQL server host 'DB_HOST' (1) in /nfs/c06/h05/mnt/187886/domains/usiga.info/html/bank/apply.php on line 23

Warning: mysqli_query() expects parameter 1 to be mysqli, boolean given in /nfs/c06/h05/mnt/187886/domains/usiga.info/html/bank/apply.php on line 31

Warning: mysqli_num_rows() expects parameter 1 to be mysqli_result, null given in /nfs/c06/h05/mnt/187886/domains/usiga.info/html/bank/apply.php on line 32

and the config.php file includes the constants

[Cerb]

Class member for the nation API shard please?

It would be useful to filter class members out of my queries.

[HMS Unicorn]

Would it be possible to add a shard for the nation API producing the list of all factbooks/dispatches that nation has published?

Also, would it be possible to add an API call (not sure where this would go) for fetching a factbook/dispatch by its ID?

Currently, I believe (though I may always be mistaken) that both of these actions can only be done through HTML scraping, which is really inefficient if you need to compile lists of dispatches from multiple nations.

[Glen-Rhodes]

@Rich and Corporations: you're passing strings, not constants. Get rid of the apostrophes. Also, that's more of a general PHP question, and not an NS API question...