autoreg-skills-max: initial public release (restored, redacted, hardened)

skills/account-validation/references/v2ex-api.md

@@ -0,0 +1,96 @@
+# V2EX Account Validation Reference
+
+## API Endpoints
+
+### Username Existence (public, no auth)
+```
+GET https://www.v2ex.com/api/members/show.json?username={username}
+```
+
+**Response (exists):**
+```json
+{
+  "id": 1,
+  "username": "Livid",
+  "url": "https://www.v2ex.com/u/Livid",
+  "website": "...",
+  "twitter": "",
+  "github": "",
+  "avatar_mini": "https://cdn.v2ex.com/avatar/...",
+  "avatar_normal": "...",
+  "avatar_large": "...",
+  "created": 1272200000,
+  "last_modified": 1782797864,
+  "pro": false,
+  "status": "found"
+}
+```
+
+**Response (not found):**
+```json
+{"status": "error", "message": "Object Not Found"}
+```
+HTTP 404.
+
+**Response (rate limited):**
+```json
+{"status": "error", "message": "Rate Limit Exceeded", "rate_limit": {"used": 600, "quota": 600, "reset_at": 1782957764}}
+```
+HTTP 403.
+
+### Rate Limit Headers
+- `X-Rate-Limit-Limit`: 600 (quota per hour)
+- `X-Rate-Limit-Remaining`: remaining requests
+- `X-Rate-Limit-Reset`: Unix timestamp of reset
+- Rate limit is per-IP, resets on the hour
+
+### Site Info
+```
+GET https://www.v2ex.com/api/site/info.json
+```
+Returns: `{"title": "V2EX", "slogan": "way to explore", "domain": "www.v2ex.com"}`
+
+## Login Form Mechanics
+
+### Form Structure
+V2EX login at `/signin` uses randomized SHA256 field names. Must be parsed fresh from each page load:
+
+```html
+<form method="post" action="/signin">
+  <input type="text" name="<sha256_hash_1>" placeholder="Username or Email" />
+  <input type="password" name="<sha256_hash_2>" />
+  <input type="text" name="<sha256_hash_3>" placeholder="Enter the code above, click to change" />
+  <input type="hidden" name="once" value="<numeric_token>" />
+  <input type="hidden" name="next" value="/" />
+</form>
+```
+
+### CAPTCHA
+- Image: `GET /_captcha` (returns PNG)
+- Simple text CAPTCHA, not reCAPTCHA
+- Solvable via Tesseract OCR or 2captcha API
+
+### Login POST
+```
+POST /signin
+Content-Type: application/x-www-form-urlencoded
+
+<hash_1>=username&<hash_2>=password&<hash_3>=captcha_text&once=<token>&next=/
+```
+
+### Rate Limiting on Signin
+- IP blocked for ~24 hours after ~10-15 failed signin attempts
+- Message: "Because too many sign in attempts have been made from this IP in a short period of time, further attempts are temporarily not allowed."
+- Blocked IP shown on page
+
+## API v2 (Beta)
+- Requires Personal Access Token: [REDACTED] Bearer <token>`
+- No login/auth endpoint — only data access endpoints
+- Rate limit: 600 req/hr per IP
+- Base URL: `https://www.v2ex.com/api/v2/`
+
+## Proxy Requirements
+- V2EX blocks many datacenter IPs
+- Residential/high-quality SOCKS5 proxies recommended
+- Test proxy by GETting `/signin` — 403 or "Restricted" = blocked IP
+- Working proxy: returns 200 with form HTML