试图制作一个Roblox组支付API; 没有支付或提供输出

Question

I am working on a Roblox group payout API, and if it works I am planning to set it open for public

Problem: It shows output {}, but it doesn't payout anything

Before I could start working on this, I first needed to create a manual payout where I got all the POST parameters and headers. Here is what I got:

METHOD: POST
URL: https://web.roblox.com/groups/3182156/one-time-payout/false
REQUEST BODY: percentages=%7B%22457792390%22:%221%22%7D

HEADERS:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.181 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
referer: https://web.roblox.com/my/groupadmin.aspx?gid=3182156&_=1528631875891
cookie: GuestData=UserID=-608861174; RBXMarketing=FirstHomePageVisit=1; RBXSource=rbx_acquisition_time=6/9/2018 6:18:42 AM&rbx_acquisition_referrer=https://v3rmillion.net/showthread.php?tid=583440&rbx_medium=Direct&rbx_source=v3rmillion.net&rbx_campaign=&rbx_adgroup=&rbx_keyword=&rbx_matchtype=&rbx_send_info=1; rbx-ip=; __utmc=200924205; __utmz=200924205.1528621282.6.4.utmcsr=robuxrewards.site|utmccn=(referral)|utmcmd=referral|utmcct=/; __utma=200924205.428322191.1519910430.1528621282.1528630905.7; RBXImageCache=timg=63313634633937632D393938342D346262642D613663612D333133653130363363373938253231372E3130332E32392E32303925362F31302F323031382031313A34333A303220414D3E2434B19B5881BB5B51486D88F43FC8F5D5787F; __utmt_b=1; gig_hasGmid=ver2; .ROBLOSECURITY=HERE_WAS_A_COOKIE; RBXEventTrackerV2=CreateDate=6/10/2018 6:52:37 AM&rbxid=455629576&browserid=15138233029; __RequestVerificationToken=w6L7tvgTk0c8TeMvuz8QnvVEoF7W7mMxk6UcefoCygoXk97mWkqQGKiLD6XLz5Bssx9FTqkFCzvclhqdrVyww9VcrNY1; RBXSessionTracker=sessionid=a45dce07-ff59-4590-8881-b4200425cf02; __utmb=200924205.11.10.1528630905

I deleted the .ROBLOSECURITY because with that you can login into my account. But that is all the info I got. With the request body: percentages=%7B%22457792390%22:%221%22%7D, When I decode that, I get this: percentages={"457792390":"1"} That is good, because my user id is 457792390 and the amount I payed out is 1. So I created a code that should make this work, and make it automatic. Here it is:

<?php

// Receive
$module = $_GET['module'];
$cookie = $_GET['cookie'];
$amount = $_GET['amount'];
$group_id = $_GET['group_id'];
$user_id = $_GET['user_id'];
/* https://freewebhost.fun/api.php?module=group_payout&cookie=YOUR_COOKIE_HERE&amount=YOUR_AMOUNT_HERE&group_id=YOUR_GROUP_ID_HERE&user_id=USERNAME_HERE */

// The function
function group_payout($cookie, $amount, $group_id, $user_id) {
    // preset stuff
    $content_type = "application/x-www-form-urlencoded; charset=UTF-8";
    
    // further
    $ch = curl_init();
    curl_setopt($ch, CURLOPT_URL,"https://web.roblox.com/groups/".$group_id."/one-time-payout/false");
    curl_setopt($ch, CURLOPT_POST, 1);
    curl_setopt($ch, CURLOPT_POSTFIELDS, "percentages=%7B%22" . $user_id . "%22:%22" . $amount . "%22%7D");
    curl_setopt($ch, CURLOPT_USERAGENT, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.181 Safari/537.36");
    curl_setopt($ch, CURLOPT_HTTPHEADER, Array("Content-Type: ".$content_type, "Cookie: .ROBLOSECURITY=".$cookie."; RBXViralAsquisition=time=1/24/2018 11:50:50 AM&referrer=https://www.google.nl/&originatingsite=www.google.nl&viraltarget=945929481; RBXSource=rbx_acquisition_time=6/11/2018 1:47:00 AM&rbx_acquisition_referrer=&rbx_medium=Direct&rbx_source=&rbx_campaign=&rbx_adgroup=&rbx_keyword=&rbx_matchtype=&rbx_send_info=1; __utzm=200924205.1516985949.4.3.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=(not%20provided); "));
    curl_setopt($ch, CURLOPT_REFERER, 'https://web.roblox.com/my/groupadmin.aspx?gid='.$group_id.'#nav-payouts');
    
    
    
    // Lets go
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    $server_output = curl_exec ($ch);
    curl_close ($ch);
    echo $server_output;
    
}

if ($module == "group_payout") {
    group_payout($cookie, $amount, $group_id, $user_id);
}

?>

I really don't know what the problem can be.

Edit

So, in the comments somebody told me to try out PostMan. Here are the results: https://pastebin.com/raw/iN4UQPBE (it's too big for the character limit here).

I don't know what to do with these results.

</div>

Answer 1

Your XSRF token is invalid. You should include it in the request headers.

To get your XSRF token, send a POST request to https://api.roblox.com/sign-out/v1 with your cookie in the headers. The XSRF token should be in the response headers.