The ?at= parameter normally returns the UUID of the name at the provided UNIX timestamp (in seconds, not milliseconds). If there is no timestamp provided the current time will be used. ?at=0 can be used to find the original user that had that username, but for whatever reason this only works if the account's name was changed at least once or if the account is unmigrated/legacy. This isn't even the main issue, although this should be fixed as well if possible...
Currently, the ?at= parameter seems to be broken, as it returns 200 (profile is found) for any timestamp provided, which shouldn't happen - for example, the account "MCB" seems to exist in 2010 according to the API (when I passed it the timestamp 1263146630) when in reality it was created in 2014. This issue should be fixed as there are numerous services that rely on this endpoint to provide user information, or help migrate old user records from servers.
This is my first public Jira report so I hope I've done a good job explaining this issue. If not, please let me know and I'll do my best to clarify.
Linked issues
blocks 1
is duplicated by 2
Comments 24
Hi Mr. Sjödahl,
The impact is that users cannot fetch the current username of a user that has changed their name. For example, let's say we had a user with the name "test_account" - they had the name "simonatator11" which was their name at 1423422139. However, they have since changed their name and we don't know their current name. We would use the endpoint https://api.mojang.com/users/profiles/minecraft/simonatator11?at=1423422140 (one second after they changed their name to simonatator11) to find their current username and UUID. This endpoint is currently broken, since if we pass in this time, when they did, in fact, have this username, it still shows up as 204 No Content when it should return 200 with the user's current name (test_account) and their UUID (3d28908693324417bb78f90c3cc5e0b7). Alternatively, requesting the name "Test_Account" and passing any Unix time in the ?at= parameter returns 200 when it should return 204 for any time before 1426100819. A further explanation of this is located here: https://wiki.vg/Mojang_API#Username_-.3E_UUID_at_time
We also can see that this program (finding a Minecraft account's date of creation) is impacted by this issue as well, and no longer functions correctly - https://gist.github.com/jomo/be7dbb5228187edbb993 This program has worked for years and today it has stopped working as well.
I can verify that this is a pretty big issue. I work as a dev with a large multiplayer server, and we use (Old) Username -> Name history to unban users after verifying that they have changed their explicit/inappropriate username. Hoping its fixed soon so we don't have to redesign our solution.
If the creation date was meant to be publicly accessible then it would be returned in the API similar to how name change times are returned (changedToAt). Brute-forcing the epoch time to get an account's creation was not an intentional feature of this endpoint.
Server owners use the profile name history endpoint for checking changes from explicit/inappropriate usernames, i.e.:
@Mustermaster1402
You can still request username history if you know his uuid.
And since the swap from names to uuids was 10 years ago there shouldn't be any database or other userdata storage which is solely based on names in 2022.
And you apparantly cannot read. In WEB-13 is was said that the parameter was removed INTENTIONALLY. You won't get it back.
Edit: Also projects exist to use namemc as api like https://github.com/jaqobb/namemc-api so I really don't see the problem here.
Sorry, but if you don't see the problem here, then you don't know what you're talking about. Removing ?at was a HUGE deal and a throwback to the community, even with its bugs. NameMC also doesn't have any API regarding profile lookups. It's now impossible to find who else has had a certain name, giving namemc a great advantage due to their enormous database, and compiling such database yourself is just not feasible
> there shouldn't be any database or other userdata storage which is solely based on names in 2022
The vanilla Minecraft server ban list is based solely on names and not UUIDs (I agree that it shouldn't be). So are the data storage structures of multiple legacy ban/mute plugins I've inspected.
> Edit: Also projects exist to use namemc as api like https://github.com/jaqobb/namemc-api so I really don't see the problem here.
NameMC now uses a CAPTCHA to protect their site from automated traffic, so we cannot rely upon this and similar projects
This issue should be closed, as Mojang no longer supports player username history lookups, making it illogical to support the username-at-time endpoint. Their lack of communication with regard to this ticket makes sense given that deprecation was planned but unannounced.
> Mojang no longer supports player username history lookups
I wish there was an open dialogue with the third party devs who use these kinds of APIs before they are removed without notice. Seems as though this is just an API change under the guise of privacy and nothing more. It would've been nice to have discussed an alternative or middle ground where a similar API could be leveraged if the player wished to opt in to showing their name history.
If I've missed the dialogue of "user demand and to meet player expectations" somewhere else, please crosspost as I'd love to have a read.
Hi, can you elaborate on what services are broken and what the impact is?