Authenticated seller API for buyer verification and profile-post ownership verification

[Boryte]

Feature request

Please consider adding authenticated, author-scoped API endpoints for premium resource buyer verification and account ownership verification workflows.

Use case

I operate the ByteCore SpigotMC author account and maintain a Discord support/verification bot for my premium resources. The bot verifies customers, syncs Discord buyer roles, and helps support staff confirm whether a user owns a specific resource.

Currently, public resource metadata can be retrieved through the existing Resource Manager API, but buyer verification and profile-post verification still require authenticated HTML scraping. This is fragile, difficult to maintain, and can run into Cloudflare/session-management issues even when used at very low frequency.

Why this is needed

Discord verification systems need to solve two separate problems:

1. Purchase verification
   Confirm that a specific SpigotMC user owns a specific premium resource.

2. Account ownership verification
   Confirm that the Discord user claiming the purchase actually controls the SpigotMC account.

A buyer API would solve the purchase-verification part. A profile-post/comment API, or a future native ownership-verification flow, would make the account-ownership part cleaner as well.

Preferred API design

The most privacy-preserving endpoint would be a direct purchase check rather than exposing full buyer lists by default.

Example:

GET /resources/{resourceId}/buyers/{userId}
Authorization: Bearer

Example response:

{
"resource_id": 12345,
"user_id": 67890,
"purchased": true,
"purchased_at": 1710000000
}

This should only return purchase information when:

• the API token belongs to the resource author;
• the requested resource is owned by that author;
• the request is properly authenticated.

A paginated buyer-list endpoint would also be useful for author dashboards, Discord role fills, and local cache synchronization, but the direct purchase-check endpoint is the most important one for verification bots.

Example:

GET /resources/{resourceId}/buyers?page=1
Authorization: Bearer

Profile-post/comment verification

My bot currently use a one-time token flow:

1. Discord user requests verification.
2. Bot gives the user a unique token.
3. User posts that token from their SpigotMC account.
4. Bot reads the profile-post comments and links the Discord account to the SpigotMC user.

An official API endpoint for profile-post comments would remove another fragile scraping dependency.

Example:

GET /profile-posts/{profilePostId}/comments
Authorization: Bearer

This would allow bots to verify account ownership without parsing SpigotMC HTML pages.

A future OAuth/OIDC-like or native SpigotMC account-linking flow would be even better, but profile-post/comment API access would already improve the current verification workflow significantly.

Suggested requirements

• Author-scoped API tokens.
• Access limited to resources owned by the authenticated author.
• Direct buyer verification endpoint: “does user X own resource Y?”
• Optional paginated buyer list endpoint for author-owned resources.
• Profile-post/comment read endpoint for token-based account verification.
• Clear rate limits and integration guidelines.
• Clear user-agent/integration policy for bots.
• No public exposure of private buyer data.

Benefits

This would help legitimate resource authors build reliable Discord verification systems, customer support bots, license checks, purchase synchronization tools, and buyer-role automation without relying on HTML scraping.

It would also reduce unnecessary traffic to protected HTML pages, avoid brittle parser implementations, and make integrations safer and easier to rate-limit properly.