Flawed API access levels

At first I was excited to hear about the new system with various access levels allowing players to keep important stats private and only sharing what needs to be shared for tools to work. Now I'm bitterly disappointed.

I use the Racing UI/UX Enhancements script by Lugburz, mainly because I liked sharing my Racing Skill and viewing others. The script has been updated recently to utilise the API to grab RS for race participants. Great news, I thought, RS is public info now, so I create a shiny new 'Public only' API key and paste it into the script settings. Then I get an error.
Access level of this key is not high enough : A selection is being called of which this key does not have permission to access.

Well that's weird, why would I need more than a Public Only API key to retrieve public info. I decide to try a 'Minimal Access' key.
Access level of this key is not high enough : A selection is being called of which this key does not have permission to access.

Finally it worked with a 'Limited Access' key.

Now I'm annoyed that the script seems to be forcing me to hand all over all kinds of sensitive info just to share and display publicly available Racing Skills. I go to the script's forum thread to see if anyone is discussing this, nobody was. I start typing up a reply to ask why the script needs more than 'Public Only' API access to display racing skill. Before I hit send, I went to check out the API documentation and realised it wasn't Lugburz' fault at all, it was ched's.

Racing Skill is public, but it's under the 'personalstats' category and as such requires at least a 'Limited Access' API key.

So if I want to share my publicly available Racing Skill with the script, I also need to hand over access to my battlestats, money on hand, flight times, attack logs, etc. Everything sensitive that this new system is supposed to help keep safe. The only thing I'm not required to share is the log file that needs 'Full Access'

So what is the point of this shiny new system if it can't even do the one thing it was designed to do.

(I'm sure Lugburz wouldn't abuse the access given, and I can check the script to see he doesn't. My point is the system is flawed. That script is just how I came across this situation and my only example currently)


tl;dr: Can't use API to share public Racing Skill without sharing all the sensitive info these new keys are supposed to keep safe.

Racing Skill was only changed to be public this patch, make a bug report and it will be fixed

Thanks for link. However I worry that even the custom level keys won't help here.

Obviously I can't be sure at this point, but my thinking is that they'll make it so you'll be able to customize which 'selections' are included in the access key, and not not able to customize further than that to individual fields within a selection.
RacingSkill would still be in the personalstats selection, so would also give battlestats as part of that.

But hopefully I'm wrong and they'll give us the choice all the way down to which fields and not just selections.

Did aurel mention selecting just a few fields somewhere specifically, I didn't see it in the thread you linked.

Oh, my doubt was to "make a bug report and it will be fixed." Not to racing skill recently going public.

I'm sure my bug report would be replied to with 'working as intended'

I agree, I was also surprised that a Public Only key didn't work for fetching RS which is a public stat. Doesn't really makes sense to me that a Limited Access key is required.

https://www.torn.com/forums.php#/p=threads&f=19&t=16248808&b=0&a=0 i made a bug report about this yesterday and apparently its a known issue, and doesnt sound like itll be fixed any time soon.

All public personal stats require a limited or higher key. its quite silly and honestly defeats a major purpose of this update.

I'm more curious on its limits. With one API it is 100 calls per minute. Does that mean each separate API divides that? Haven't tested it myself yet but if so that's gonna make things a bit difficult at first. Let alone now its more api keys to keep track of.

Best example i can think of rn is getting info on all members in a faction with 100 members (no sleep timer). Would that mean I can use 2 seperate api keys from a single person and get 2 factions worth of members?

"Public" and "Private" personal stats in the context of the patch notes refer only to whether they are displayed on the personal stats page of someone that you're viewing and has nothing to do with the API.

In order to access the personalstats array from the API requires limited access because if you're using the API key of the user to pull the array, it shows more information if you're using the user ID of the key owner vs. anyone else's user ID, such as battlestats and networth allocation, whereas if you use a user ID of someone other than the API key owner, you receive the information that is normally available when viewing others' personal stats page.

My guess is that they need to decouple this logic before being able to allow limited/public access levels to access the appropriate personalstats keys regardless of the API key owner/userid relationship. The chart below shows the required access levels for each API field. Even with custom API access keys, personalstats(where racing skill is located) will always show the API key owner's normally hidden stats.

[image: i.imgur.com]

Tested it earlier with 5 keys, each key has a limit of 100 calls per minute and I was able to hit 500 calls in a minute. So theoretically you could do 1000 calls per minute using the max of 10 keys per account.

Edit: This has since changed, seems to be a limit of 100 calls per minute total across all keys for the account, the API documentation page also now says "Each user key can make up to 60 individual requests per minute" as well, but testing it shows you can still do up to 100/minute.