Here are my ideas for an Elite API:
Protocol and Format
The API should be based on HTTP and CORS to allow third-party software to be developed in any programming language, even as browser-based applications. Transport format should be XML and/or JSON. One format would be enough, every programming language has libraries to process both formats easily but if possible it would be cool to provide both so the client can tell the server which format it prefers (HTTP Accepts header).
Two APIs
Actually there should be two different APIs. A
GalLink API to access public and global information from the Frontier servers and a
ShipLink API to access local and private data directly from the game.
GalLink
The GalLink is a public API provided by the Elite Game Servers. Third-party applications can access this API anonymously to fetch global public stuff from the game. I will list some ideas what kind of information can be provided through this API in the next section.
The GalLink should ALWAYS be anonymous, there should be no way to authenticate a player because this would be a large security problem because third-party applications will then ask for the players login and password to be able to display player-based information. That's a no-go.
ShipLink
The ShipLink is an API which is provided by the game itself on a custom TCP port (But still using HTTP protocol). This API should be disabled by default and can be enabled in the settings menu in the game. For security reasons there should be two additional settings (But it is not that important because this is simply an API to a game and not to your bank account and there should be no API calls for bad things like reading/changing account passwords, self destruction and so on):
- A "remote access" checkbox. When disabled (default) then the server listens only on localhost so no other machine on the LAN can access the API. When enabled then the server listens on all addresses so it is possible to connect other devices (Android tablets, Notebook, whatever) to the API. I think it is not necessary to implement an IP white list or authentication to allow only access from specific devices. A gaming PC should normally be operated in a trusted LAN and if this is not the case then the player should use firewall rules on the machine anyway so further security is in the responsibility of the player, not the game.
- An "allowed domains" input field. This field can contain a comma-separated list of domain names which are allowed to access the API. This is needed for CORS to allow web browsers to send cross-domain-requests to the API. By default this field should be empty which means that CORS is disabled (In that way the browser can't use the API, only normal applications can).
Here are some scenarios how different types of applicatons can access the API:
- Someone wrote an Android application which displays ship statistics (Shield strength, Hull strength, whatever...) in a nice way. To use it the player has to enable the ShipLink API and the remote access to it in the game settings (And if a firewall is installed then the correspding TCP port must be opened there, too). Then the Android application can scan the LAN to find the game PC (Or let the player enter the IP address of it) and connect to the custom HTTP port. Link is established, the App can access the information. When the game is closed then the connection will be lost.
- Someone wrote a web site which displays some player-based in-game information. The website will use JavaScript and Ajax requests to access the API on localhost. The player has to enable the ShipLink API and has to enter the domain name of the website into the "Allowed domains" field in the game settings. The website (And only THIS website because only this domain was white-listed in the settings) can now send cross-domain requests (CORS) to the ShipLink API (For example http://localhost:20000/).
- A local windows application reads ship/player data from the game and displays it on the display of a gaming keyboard for example. For this kind of application the player only needs to enable the ShipLink API in the settings. Remote access is not needed because the local application connects to localhost.
To prevent TCP port conflicts it might be useful to allow changing the port in the game settings. But this means that all applications must also ask for the port number and that's annoying. So I would prefer a port range technique. The game starts on port 20000 for example and when this port is already occupied then it tries the next port (20001) until it finds a free port. The applications can do the same, connecting to port 20000 first and when no Elite is answering there then they try the next few port. When all ports in the defined range do not work then they abort.
Provided information
This section lists some ideas what kind of information the two APIs could provide and how it could be used by a third-party application:
GalLink
- The GalNet news (To implement a simple news feed on a website for example)
- Top-100 lists for lot of different stuff (Money, Kills, Visited systems, and so on). See the UPLINK statistics in Egosoft's X3 for example.
- Global game statistics (How many players are online, which ships are used by how many players, how many ships were destroyed in the last hour, and so on)
- Public player data. Stuff like the current fight/trade/explore rank should be public (Or maybe a player can decide in the game settings if he wants the data to be public). Then the GalNet API can be used to access the public state of a specific player. This kind of API can be used by applications to provide automatic rank icons for forum websites for example. I could simply include an image with the URL http://servername/kayahr/fightrank for example to display a nice "Competent" rank image wherever I want and it will automatically update when I gain a new ranking.
ShipLink
Read-only information:
- Player statistics. Used to compare myself against the top-100 lists provided by the public GalLink API.
- Current state of the ship (Type, Outfitting, Shield, Hull, Gear down, Cargo scoop active, Weapons deployed, Mass lock, ...) This can be used to display nice ship stats on an external device like an Android tablet or a notebook or show the data on the display of a gaming keyboard or joystick.
- Current state of the player (Name, Money, Ranking, Current position (Star system, station), wanted status, ...). This kind of stuff is also useful for displaying on an external device or to see my own status on a website allowed to access the data.
- Galaxy-Map data. Divide the galaxy into sectors and allow applications to query the star system names and positions in a specific sector and let them query all information about a specific star system which is accessible to the player. Such an API will work even for the 400 billion star systems because there is no API call to request ALL star systems. So the API can not be used to display the whole galaxy (Simply too much data) but it can be used to access the interesting parts of it (Like the sectors/systems in the near vicinity or along a specific path (To calculate a hyperspace route). When someone has a lot of time then he can iterate over all sectors and fetch the whole galaxy for whatever reason. But that's ok because this only affects the local machine, not the game servers or other players.
- Market data. Let applications access the market data of the current system and the bought trade data. I guess this is the most wanted API because lot of people want to calculate profitable routes. But be warned: This data will be shared between the players. If Frontier has a problem with this then market data should not be accessible by third-party applications (But this will not prevent the trade tools which already exists and which work with manually entered or OCR'd trade data).
Modifiable information:
- Power-management: Allowing an application to read and modify the power management (System power states and priorities) would allow us to create applications to select different power profiles for example. But this feature would not be necessary if the game would allow this already.
- Controls: All the simple stuff which is controlled by keyboard (like lowering the landing gear for example) can already be automated by third-party tools by simply simulating the corresponding key-press. So it would not harm the game if some stuff can be controlled by an application through the ShipLink-API so players can create fancy input gadgets for controlling the landing gear, turning on the ship lights and so on. I don't think this kind of API can be used for cheating. Instead it might bring some interesting features like morse code signaling apps for the ship lights ;-)