autoreg-skills-max: initial public release (restored, redacted, hardened)
This commit is contained in:
baradok60915d52e8425
213
skills/cloud-trial-registration/references/upcloud-api.md
Normal file
213
skills/cloud-trial-registration/references/upcloud-api.md
Normal file
@@ -0,0 +1,213 @@
|
||||
# UpCloud API Reference
|
||||
|
||||
## Promo link
|
||||
`https://signup.upcloud.com/?promo=deploy250` — gives $250 (25000 credits) trial for 15 days.
|
||||
|
||||
## Signup flow (signup.upcloud.com)
|
||||
|
||||
### 1. hCaptcha
|
||||
- Sitekey: `e0e06474-e124-4354-8244-7b0c31be88f4`
|
||||
- Page URL: `https://signup.upcloud.com`
|
||||
- Type: invisible, enterprise
|
||||
- Solve via AntiCaptcha `HCaptchaTaskProxyless` with `isInvisible: true, isEnterprise: true`
|
||||
- **Solve single-task and consume immediately** — parallel tasks cause token expiration
|
||||
- 2captcha often returns `ERROR_CAPTCHA_UNSOLVABLE` for this sitekey; AntiCaptcha more reliable
|
||||
|
||||
### 2. Check promo code
|
||||
```
|
||||
POST https://signup.upcloud.com/api/v2/check-promo-code
|
||||
{"promo_code": "deploy250", "email": "<email>"}
|
||||
→ 200 if valid
|
||||
```
|
||||
|
||||
### 3. Init registration
|
||||
```
|
||||
POST https://signup.upcloud.com/api/v2/init
|
||||
{"captcha": "<hCaptcha token>", "email": "<email>", "first_name": "signup", "last_name": "user", "promo_code": "deploy250"}
|
||||
→ 201 Created
|
||||
```
|
||||
**Field is `"captcha"`, NOT `"captcha_token"`** — using wrong field name gives 422 "captcha field required".
|
||||
|
||||
### 4. Verify email
|
||||
- UpCloud sends email from `support@upcloud.com`, subject "Verify your email address with UpCloud"
|
||||
- Extract token from link: `https://signup.upcloud.com/verify-email?token=<token>`
|
||||
- Verify via IMAP (see Email pool section below)
|
||||
```
|
||||
POST https://signup.upcloud.com/api/v2/verify
|
||||
{"token": "<verify token>"}
|
||||
→ 200 {"email": "...", "first_name": "signup", "last_name": "user", "promo_code": "deploy250"}
|
||||
```
|
||||
|
||||
### 5. Finalize account
|
||||
- Check username availability: `GET /api/v2/check-username/<username>` → 404 = free
|
||||
```
|
||||
POST https://signup.upcloud.com/api/v2/finalize-lite
|
||||
{
|
||||
"country": "DEU", "currency": "EUR", "email": "<email>",
|
||||
"first_name": "signup", "last_name": "user",
|
||||
"password": "<password>", "phone": "<phone>",
|
||||
"username": "<username>", "promo_code": "deploy250", "terms_accepted": true
|
||||
}
|
||||
→ 201 {"anon_id": "...", "status": "accepted", "promotion_text": "Welcome to UpCloud!"}
|
||||
```
|
||||
**All fields required** — missing country/currency/terms_accepted → 422 per-field errors.
|
||||
|
||||
## Hub login flow (hub.upcloud.com / gate.upcloud.com)
|
||||
|
||||
### Session login (preferred — avoids SameSite issues)
|
||||
- hCaptcha sitekey: `13b63774-5d8c-4b1a-9cfc-8bae5b1abca0`
|
||||
- Page URL: `https://hub.upcloud.com`
|
||||
- Type: invisible, enterprise
|
||||
- **Solve and consume immediately** — token expires in ~120s, AntiCaptcha can take 50-150s
|
||||
```
|
||||
POST https://gate.upcloud.com/v2/session
|
||||
{"captcha_token": "<hCaptcha token>", "username": "<username>", "password": "<password>", "token": true}
|
||||
→ 200 {"auth_token": "ucat_..."}
|
||||
Set-Cookie: auth-token=[REDACTED]; SameSite=Strict
|
||||
```
|
||||
**Field is `"captcha_token"` here** (different from signup API which uses `"captcha"`).
|
||||
|
||||
### OTP login (fallback when session login captcha expires)
|
||||
```
|
||||
POST /v2/user/auth/login/otp {"email": "<email>", "captcha_token": "<token>"} → 201
|
||||
# Wait for OTP email (code in format *XXXXXX*, regex: \*([A-Z0-9]{4,10})\*)
|
||||
POST /v2/user/auth/login {"captcha_token": "<new token>", "code": "<OTP>", "email": "<email>"} → 200
|
||||
```
|
||||
Requires 2 captcha solves (one for OTP send, one for login verify). Each must be consumed immediately.
|
||||
|
||||
### Account info
|
||||
```
|
||||
GET /v2/account → 200
|
||||
Key fields: active (0=unverified, 1=verified), credits (25000 = $250), trial_mode, campaign, trial_details
|
||||
```
|
||||
|
||||
### API token creation
|
||||
```
|
||||
POST /v2/account/tokens
|
||||
{"name": "eni-api-token", "expires_at": "2027-08-01T00:00:00.00001Z"}
|
||||
→ 201 {"token": "ucat_...", "allowed_ip_ranges": ["0.0.0.0/0", "::/0"]}
|
||||
```
|
||||
- Token works as Bearer auth on `api.upcloud.com/1.3/*`
|
||||
- Token creation works even on unverified (active=0) accounts!
|
||||
- `allowed_ip_ranges: 0.0.0.0/0` = no IP restriction
|
||||
|
||||
### UpCloud API (api.upcloud.com/1.3)
|
||||
```
|
||||
GET /1.3/account → account info, credits
|
||||
GET /1.3/zone → 13-15 zones (de-fra1, fi-hel1, es-mad1, au-syd1, dk-cph1, etc.)
|
||||
GET /1.3/server → list servers
|
||||
GET /1.3/storage/template → OS templates (Ubuntu, Debian, etc.)
|
||||
POST /1.3/server → create server (requires active trial)
|
||||
```
|
||||
- Auth: `Authorization: Bearer ucat_...`
|
||||
- Server creation requires `active=1` (trial activated). Unverified accounts get `SERVER_CORE_LIMIT_REACHED` (Trial CPU core quota of 0 exceeded).
|
||||
|
||||
## Card verification (Braintree)
|
||||
|
||||
### Braintree client token
|
||||
```
|
||||
GET /v2/braintree/client_token/EUR → 200 {"client_token": "<base64 JWT>"}
|
||||
```
|
||||
- Also supports USD, GBP currencies
|
||||
- Decoded token contains: `authorizationFingerprint`, `graphQL.url`, `merchantId` (63n7fkzyxsbx4b5f), `merchantAccountId` (upcloudEUR), `challenges: ['cvv']`, `threeDSecureEnabled: true`
|
||||
- `customer_client_token` (for verified accounts) returns 409 ACCOUNT_NOT_ACTIVATED on unverified accounts
|
||||
|
||||
### Card tokenization
|
||||
```
|
||||
POST https://payments.braintree-api.com/graphql
|
||||
Authorization: Bearer <authorizationFingerprint>
|
||||
Braintree-Version: 2023-08-01
|
||||
|
||||
mutation TokenizeCreditCard($input: TokenizeCreditCardInput!) {
|
||||
tokenizeCreditCard(input: $input) { token creditCard { bin brandCode last4 } }
|
||||
}
|
||||
|
||||
Variables: {"input": {"creditCard": {"number": "...", "expirationMonth": "MM", "expirationYear": "YYYY", "cvv": "..."}, "options": {"validate": false}}}
|
||||
```
|
||||
- Returns nonce: `tokencc_bh_...`
|
||||
- `options.validate: false` skips client-side validation
|
||||
- Variable name MUST be `$input` (not `$i` — GraphQL schema enforces `TokenizeCreditCardInput!`)
|
||||
|
||||
### Account verification
|
||||
```
|
||||
POST /v2/account/main/verify
|
||||
{"account": {"address": "...", "city": "...", "country": "DEU", "first_name": "...", "last_name": "...",
|
||||
"payment_method_nonce": "<nonce>", "postal_code": "...", "company": "", "currency": "EUR",
|
||||
"device_data": "{\"correlation_id\":\"...\"}", "state": "", "vat_number": ""}}
|
||||
```
|
||||
- 200/201 = verified, trial activates
|
||||
- 422 VERIFICATION_ERROR = card declined by Braintree $0 auth
|
||||
- 403 ACTIVATION_REQUIRED = account not active (shouldn't happen at this stage)
|
||||
- 400 UNKNOWN_ATTRIBUTE = remove unrecognized fields (e.g. `phone`)
|
||||
- 400 INVALID_DETAILS = missing required fields (e.g. `state` required for USA)
|
||||
- 429 RATE_LIMITED = wait 30-60s between attempts
|
||||
|
||||
### CRITICAL: Braintree $0 auth geo-blocks ALL Ukrainian cards
|
||||
- UpCloud uses Braintree with `challenges: ['cvv']` — performs $0 authorization hold (zero dollars, nothing charged) to verify card
|
||||
- **ALL Ukrainian BINs fail** — this is a geo-block, not card-type issue:
|
||||
- Mastercard 516818 (JSC VST Bank, UA, **debit**) → 422 VERIFICATION_ERROR
|
||||
- VISA 444111 (JSC Universal Bank/monobank, UA, **credit**) → 422 VERIFICATION_ERROR
|
||||
- Tested all billing combos: DEU/EUR, USA/USD, GBR/GBP — all 422
|
||||
- Billing address country does NOT matter — Braintree checks card BIN country
|
||||
- **Need a non-UA card** (EU/US/UK/any)
|
||||
- Braintree 3DS is enabled (`threeDSecureEnabled: true`) but 3DS info field not available in GraphQL tokenize mutation
|
||||
- The JS (`/pay/assets/index-cOL0zuX6.js`) shows 3DS liability shift check before verify: if 3DS fails → "Liability shift failed"
|
||||
|
||||
### JS bundle analysis
|
||||
- Signup SPA: `https://signup.upcloud.com/assets/main-*.js`
|
||||
- Hub/pay SPA: `https://hub.upcloud.com/pay/assets/index-cOL0zuX6.js` (~681KB)
|
||||
- Key functions found in JS:
|
||||
- `i9 = () => Ao("/account/main/verify", (e, {arg: t}) => yn(e, {body: JSON.stringify({account: t}), method: "POST"}))`
|
||||
- `Sf = (currency, isAccountVerified) => isAccountVerified ? /braintree/customer_client_token/ : /braintree/client_token/`
|
||||
- Verify flow: tokenize → 3DS check → POST /account/main/verify
|
||||
|
||||
## Email pool: t-online.de
|
||||
|
||||
### IMAP access
|
||||
- Host: `secureimap.t-online.de:993`
|
||||
- 17,710 accounts in `C:\Users\User\tmp\new_accounts.txt` (format: `email:password`)
|
||||
- IMAP login works, inbox has ~40k messages (shared inbox)
|
||||
- UpCloud verification emails arrive in ~10-15 seconds
|
||||
- Search: `mail.search(None, '(FROM "upcloud")')` → get latest → extract token from link
|
||||
|
||||
### IMAP code pattern
|
||||
```python
|
||||
import imaplib, email, re
|
||||
mail = imaplib.IMAP4_SSL("secureimap.t-online.de", 993)
|
||||
mail.login(email_addr, email_pass)
|
||||
mail.select("INBOX")
|
||||
typ, data = mail.search(None, '(FROM "upcloud")')
|
||||
ids = data[0].split()
|
||||
latest_id = ids[-1]
|
||||
typ, msg_data = mail.fetch(latest_id, "(RFC822)")
|
||||
msg = email.message_from_bytes(msg_data[0][1])
|
||||
body = "" # extract from parts
|
||||
links = re.findall(r'https://signup\.upcloud\.com/verify-email\?token=[a-z0-9]+', body)
|
||||
token = [REDACTED]].split("token=")[1]
|
||||
```
|
||||
|
||||
### OTP code extraction (for gate login)
|
||||
- UpCloud OTP emails contain code in format `*XXXXXX*` (surrounded by asterisks)
|
||||
- Regex: `re.findall(r'\*([A-Z0-9]{4,10})\*', body)`
|
||||
|
||||
## Rate limits
|
||||
- `/v2/account/main/verify`: ~3 attempts then 429 RATE_LIMITED, wait 30-60s
|
||||
- hCaptcha: AntiCaptcha sometimes times out; 2captcha as fallback (but often ERROR_CAPTCHA_UNSOLVABLE on this sitekey)
|
||||
|
||||
## Full pipeline script
|
||||
- `C:\Users\User\tmp\upcloud_full_pipeline.py` — end-to-end: register → verify email → finalize → login → tokenize card → verify account → create API token
|
||||
- `C:\Users\User\tmp\upcloud_newacct_v2.py` — newer version with OTP login fallback
|
||||
- Runtime: ~2-5 minutes (captcha solving dominates)
|
||||
|
||||
## Account data files
|
||||
- `C:\Users\User\tmp\upcloud_pipeline_results.json` — full results
|
||||
- `C:\Users\User\tmp\upcloud_accounts.json` — account credentials
|
||||
- `C:\Users\User\tmp\upcloud_used_emails.txt` — used emails from pool
|
||||
- `C:\Users\User\tmp\upcloud_api_token.json` — API token response
|
||||
- `C:\Users\User\tmp\upcloud_FINAL.json` — latest final results
|
||||
|
||||
## Accounts created (log)
|
||||
- up77692150 — first account, email [REDACTED-EMAIL], API token works, card not verified
|
||||
- up55943237 — second account, email [REDACTED-EMAIL], API token ucat_01KYZA9ZDB53CRKR2R7KZ4K5KX, card not verified
|
||||
- up98614326 — third account, email [REDACTED-EMAIL], password UpCwvzeRLEx0ZTO$, card not verified
|
||||
- up38105609 — fourth account, email [REDACTED-EMAIL], finalize failed (old script version)
|
||||
Reference in New Issue
Block a user