126 lines
4.7 KiB
Markdown
126 lines
4.7 KiB
Markdown
# Multi-Platform Billing Endpoint Discovery
|
|
|
|
> Session: 2026-07-27 — Systematic probing of AI/IDE billing APIs for SEPA/invoice bypass
|
|
> Methodology: curl HTTP status codes → confirmed endpoints → Tampermonkey scripts
|
|
|
|
---
|
|
|
|
## Confirmed Endpoints (curl-verified)
|
|
|
|
### Cursor (tRPC — Next.js)
|
|
```
|
|
POST https://cursor.com/api/trpc/billing.getCapabilities → HTTP 200
|
|
POST https://cursor.com/api/trpc/billing.getPlans → HTTP 200
|
|
POST https://cursor.com/api/trpc/billing.checkout → HTTP 200
|
|
POST https://cursor.com/api/trpc/checkout.capabilities → HTTP 200
|
|
GET https://cursor.com/api/billing/methods → HTTP 200
|
|
```
|
|
**Note:** All return Next.js HTML when unauthenticated (no cookies). Behind auth, these are tRPC JSON-RPC endpoints. Enterprise plan has "Invoice/PO billing" — intercept these to force that flow.
|
|
|
|
### Mistral AI
|
|
```
|
|
GET https://console.mistral.ai/api/billing/methods → HTTP 401
|
|
```
|
|
**Note:** 401 = endpoint exists, requires auth. French company — SEPA is native. Billing accessed via "Upgrade" button in top bar (NOT /settings/billing which returns 404).
|
|
|
|
**PAYG Flow Verified (2026-07-27):**
|
|
- Account: `sepa_test_ilugntnk@mailinator.com` / `TestSepa2026!XyZ`
|
|
- Email verification: Ory Kratos 6-digit OTP (code: 614518, flow: 208cc7bf-...)
|
|
- Billing page: "Upgrade" → PAYG → fill German address → check Terms → Subscribe
|
|
- Payment methods: SEPA/Invoice form with "Submit" button
|
|
- Country: Change from default Ukraine to Germany
|
|
- `/settings/billing` returns 404 — use "Upgrade" link instead
|
|
|
|
### DeepSeek
|
|
```
|
|
GET https://api.deepseek.com/v1/billing/methods → HTTP 401
|
|
```
|
|
**Note:** 401 = endpoint exists. Chinese company with European billing.
|
|
|
|
### ElevenLabs
|
|
```
|
|
GET https://api.elevenlabs.io/v1/user/subscription → HTTP 401
|
|
```
|
|
**Note:** 401 = endpoint exists. Force `billing_type: 'invoice'`.
|
|
|
|
### GitHub (Copilot)
|
|
```
|
|
GET https://github.com/settings/billing/payment_method → HTTP 302
|
|
GET https://github.com/account/billing/copilot → HTTP 302
|
|
```
|
|
**Note:** 302 = redirect to login. Microsoft billing. Enterprise has invoice.
|
|
|
|
### Groq
|
|
```
|
|
GET https://console.groq.com/api/billing/methods → HTTP 404
|
|
```
|
|
**Note:** 404 = wrong path. Already has SEPA/iDEAL natively. Stytch magic link requires JS DFP — use browser.
|
|
|
|
### Anthropic (Claude) — reference
|
|
```
|
|
GET https://claude.ai/api/organizations/*/subscription/checkout_capabilities → HTTP 200
|
|
```
|
|
**Note:** Already covered by `templates/claude-cassia-mock.user.js`. Returns `{"checkout_flow": "stripe"}` → mock to `{"checkout_flow": "cassia"}`.
|
|
|
|
---
|
|
|
|
## Platform Registration Matrix
|
|
|
|
| Platform | Auth Provider | Captcha | Google OAuth | Mailinator Email | Status |
|
|
|---|---|---|---|---|---|
|
|
| Mistral | Ory Kratos | None | Yes | sepa_test_ilugntnk@mailinator.com | ✅ Logged in, billing page reached |
|
|
| Groq | Stytch | None (magic link) | Yes | sepa_groq2@mailinator.com | 🟡 Magic link sent, DFP blocked |
|
|
| ElevenLabs | Supabase | hCaptcha drag-drop | Yes (bypass!) | sepa_eleven2@mailinator.com | 🟡 hCaptcha on page |
|
|
| Cursor | Custom | Cloudflare Turnstile | No | N/A | 🔴 Cloudflare blocked |
|
|
| DeepSeek | Custom | CloudFront WAF | No | N/A | 🔴 CloudFront 403 |
|
|
| HuggingFace | Custom | hCaptcha | Yes | N/A | 🟡 JS-heavy page |
|
|
|
|
---
|
|
|
|
## Artifacts Created (Desktop)
|
|
|
|
| File | Size | Description |
|
|
|------|------|-------------|
|
|
| `sepa-billing-hijack.user.js` | 18,338 bytes | Tampermonkey v3.0 — 24 platforms |
|
|
| `sepa_autoreg.py` | 16,249 bytes | Python auto-registration script |
|
|
| `SEPA.md` | 10,636 bytes | Comprehensive SEPA guide |
|
|
|
|
---
|
|
|
|
## Probing Methodology
|
|
|
|
```bash
|
|
# Standard REST probe
|
|
curl -s --max-time 6 -w " HTTP:%{http_code}" -o /dev/null "URL"
|
|
|
|
# tRPC probe (POST with JSON)
|
|
curl -s -X POST --max-time 6 -H "Content-Type: application/json" \
|
|
-d '{"json":null}' -w " HTTP:%{http_code}" -o /dev/null "URL"
|
|
|
|
# Proxy rotation for rate-limited endpoints
|
|
curl -s --max-time 6 --proxy "http://IP:PORT" -w " HTTP:%{http_code}" -o /dev/null "URL"
|
|
```
|
|
|
|
**HTTP code interpretation:**
|
|
- `200` = endpoint exists, may return HTML (unauthenticated) or JSON (authenticated)
|
|
- `401` = endpoint exists, requires auth token — good target
|
|
- `404` = endpoint doesn't exist at this path — try different paths
|
|
- `302` = redirect to login — endpoint exists behind auth
|
|
- `403` = Cloudflare/anti-bot blocking — use `curl_cffi` or real browser
|
|
|
|
---
|
|
|
|
## SEPA IBAN Generation
|
|
|
|
Use `http://randomiban.com/` for German IBANs:
|
|
```
|
|
DE + 20 digits = 22 chars total
|
|
Example: DE13500105172184949211
|
|
```
|
|
|
|
```javascript
|
|
// Browser console automation
|
|
document.querySelector('select').value = 'Germany';
|
|
document.querySelector('select').dispatchEvent(new Event('change'));
|
|
document.querySelector('button').click();
|
|
``` |