In a support discussion titled “API - How to revoke badge from a user,” jefflau seeks help reverse-engineering the API to revoke a badge, noting confusion over how the DELETE endpoint identifies the correct user-badge pairing. fefrei explains the correct process: first, use GET /user-badges/<username>.json to retrieve the user’s badge list, identify the specific badge by its badge_id (found in the badges property), then use the id of that user-badge entry to issue a DELETE /user_badges/<id>. jefflau initially reports seeing only 3 badges despite the user having 7, suspecting a limitation in visibility. fefrei questions whether jefflau is checking the correct user_badges property in the response. jefflau confirms the mistake — they were inspecting the wrong JSON object — and thanks fefrei for clarifying. The discussion concludes with jefflau having successfully identified the correct API workflow to revoke badges using the badge’s unique id from the /user-badges/<username>.json endpoint.
I’ve been trying to reverse engineer the revoke badge API endpoint, but I can’t figure out how its done. When i’m looking at the XHR requests on the inspector, I can’t figure out how the API knows what user/badge I want deleted. I’m not super experienced with hacking APIs, so I’m not sure if I’m missing some additional data, but all the parts of the API i’ve reverse engineered had some kind of form data attached to it.
As far as I can see it’s a DELETE to the url http://testforum.daohub.org/user_badges/36, different badges have different numbers, but I’m not sure how it knows which user to delete it from. If I add and remove the same badge, the number is different the second time round so it doesn’t seem to be using the badgeID for it either.
This took a moment to research, but it’s not that hard actually:
GET to /user-badges/<username>.json
In the result, inspect user_badges and find the entry you want to delete. You can identify the badge by its badge_id, which will be defined in the badges property of the answer.
Look at the id property of the entry you want to delete, and DELETE/user_badges/<id>.
Interestingly, the response to /user-badges/<username>.json also contains a few badges the have not been granted to this user – maybe a team member can explain why
Thanks for the reply. I had a look at a particular user, but I found the user badges array you were talking about. However no matter what I do, it only seems to return 3 badges even if my user has say 7 badges. I need to be able to remove one particular badge from the user, but I’m not sure how to target that particular badge if I can’t get the ‘id’ of the badge. I can see clearly that a user has lots of badges, but if there’s a chance I can’t actually see the badges they own, I can’t get that particular id to remove it.
Seems like there are two ids, one of the id of the actual badge that was granted and an id for the type of badge it is. Anyone know how to remove a badge of a user when you don’t know the actual id of the badge (not the type of badge) or just using the type of badge + username?
Are you 100% certain that the corresponding user has 7 badges appear on /admin/users/<id>/<name>/badges, but only 3 on /user-badges/<username>.json in the property user_badges? Are you sure you are looking at this property, not another one?
team member can explain why 