API - 409 Conflict error

[Wolfram and Hart]

Hi,

The API documentation for private shards says that if I try to login a nation with X-Password or X-Autologin "within a few seconds" of previously logging in, I'll get a 409 Conflict error. How long is "a few seconds"?

I'm getting this 409 error, and am trying to work out where I've gone wrong with my script. If my script works as I think it should, I'm leaving at least a 20 second gap between logins for any given nation, sometimes with other nations being logged in between.

Thanks in advance for any help

[Frisbeeteria]

I know we have a throttle on new nation creation, and I know it's variable. The more hits you attempt, the longer the gap. Eventually you get locked out for something like half an hour before it resets. I think the throttle mechanism has a 24 hour memory to keep you from continuing to hit the system over and over again.

I'm not aware of the API shard login policy, but I suspect that the variable timer is the same.

[Flanderlion]

Just noting, creating a nation is a restricted action Fris so OP can't be doing that.

What OP is doing, which if they read the API page many paragraphs are written about it: https://www.nationstates.net/pages/api. ... tecommands

Below is the relevant bit:

The advantage of X-Pin is it skips the heavy authentication checks that are required when a nation logs in, allowing you to quickly make multiple requests. Without this, you may encounter a 409 Conflict error, which is triggered when a nation attempts to log in via the API despite having successfully logged in very recently (within a few seconds). To make multiple requests in a short period of time, then, your script should first authenticate with X-Password or X-Autologin, note the value of the X-Pin header returned, and for future requests supply that in your own X-Pin header.

You can supply one, two, or all three authentication headers with each request, and these will be processed as shown by the flowchart above—notably, X-Pin will always be used first if it's valid.

The Gotcha: Logging in cancels any existing session, invalidating its Pin. This means that if you have a script running in the background while also browsing NationStates manually, the two will fight each other, with a request from one logging out the other. This can go unnoticed in your browser, assuming you have autologin turned on, because you don't realize you are silently reauthenticating with each click. But you will notice it via the API because too-frequent logins generate a 409 Conflict error.

This will also happen if you have multiple scripts that don't share Pins. If each one only keeps track of its own session, then a request from one will invalidate the Pin of the other.

Basically they're relogging in with every request, which gives them the error. Or less likely they're using the same nation they're logging into. Basically they need to use the X-Pin header for their subsequent requests. On the plus side, it will remove the need for their 20s 'workaround'.

Pretty sure OP read all that, and just wanted to avoid getting something from a header field, but it's not as difficult as it sounds. Not sure what language it's in so likely can't help with the specifics.

The actual question asked, no clue how long. You could find out by experimenting with different time frames, 30s, 1min seem good starts.

[Wolfram and Hart]

Thanks Flanderlion. My script should already be using X-Pin for a nation if the last scripted action was for that nation. It should be using either X-Autologin otherwise.
Maybe my script isn't doing what I think it is - I'll need to get it to log the actions its taking at each stage to check.
That's a good idea to set up an experiment to find out the timing. I'll give that a go too.
Thanks for the advice.