BetFair security certification

[PeteMatthews]

My position:
I've developed (most of) an app using the BetFair Free API, and I'm pretty happy with it. I'm at the stage where I think it's probably useful to other people, so I'm seriously looking at taking a "proper" API subscription and selling it on (at a pretty minimal price... so long as I make back the API subscription costs each month, all should be well).

It's just me developing this - There's no startup investment, no company behind it to fund development. Thus, I need the app to start paying for itself almost as soon as I take the subscription. I think I can get enough customers to get going with, but I can't really afford much delay between paying BetFair for the API usage, and collecting cash from customers.

My query:
I came across information about the BetFair security validation at https://bdp.betfair.com/index.php?op...d=76&Itemid=58 - The wording here seems to imply that the certification is mandatory before I can ship my product to users, rather than being an addition level of reassurance for my customers.

It seems that in order to be allowed to sell my product on, I need to get it certified. Fair enough - I can see the rationale behind the rules, and I'm happy to comply, but I've got a few questions:

1 - So, is this mandatory? I'm not going to name names (so don't ask), but I know of at least one popular BF API application which caches usernames and passwords locally. Am I just looking at a well intentioned but out of date set of requirements?

2 - User provisioning - The user provisioning section of the requirements has a long description of a workflow, enabling a vendor to provision a client without having visibility of their username. A few questions about this one...

2a - It makes a reference to a createVendorAccessRequest token, but there's no mention of that in the Vendor API documentation at http://bdphelp.betfair.com/VendorAPI.../VendorAPI.pdf - Am I looking at the right documentation?

2b - Pretty much the whole vendor API is specified using usernames. This seems to be at odds with the requirement that "A Vendor must not have visibility of a user's Betfair username, password or any other sensitive data that may link a user of a product to a Betfair account". I have no interest in collecting users IDs, and have worked out a subscription system that would pretty much allow me to use them when needed and never store them (thus negating any "What happens if my server gets rooted" worries on my part), but this API/requirement conflict seems pretty confusing.

3 - The certification process. It seems that BF want a copy of the binaries and various documentation, which is fair enough, although I'd have thought they'd want the source(?). Once you're certified, they provide a vendor ID, which you use in the login process. So...

3a - I assume you can log in using a productID (which I assume you get when registering for an API subscription?) and no VendorID? This seems at odds with the documentation. If not, do you have to use the Free Access API for the version you send for certification?

3b - Once you've got a vendor ID, you need to embed this in your application for use in the login process. Surely this is going to invalidate the MD5 (or other checksum) of the binaries that BF have certified?

4 - Finally, the time taken in certification. The requirements mention that you should "allow up to four weeks for the security certification and authorisation of your product". Fair enough - These things don't just happen magically, but am I expected to have a valid API subscription during this time? That's pretty much £100-worth of API access when I can't sell the product while it's being certified, and I really can't afford to do that right now.

So - Comments on any or all of these gratefully received... Here's hoping for a happy outcome that lets me pay BF even more money

Thanks

Pete

[woowoo]

Hi Pete,

Thanks for your interest in the Software Vendor programme.

Can I ask first of all (some Q&A's may not be relevant on the basis of this) - do you intend to migrate your application to the Full Access API or do you plan to keep it on the Free Access API?

[PeteMatthews]

Well, that's an interesting question...

I was under the impression that I'd need to migrate to a paid API package in order to sell the software. I guessed (perhaps incorrectly) that BetFair would get annoyed if I was selling apps off the back of the free API

My compelling reasons for paying for the API:

The vendor user provisioning. Looks like a nice easy way to insure against people ripping off my software.
API throttling limits. My application loads a lot of Horse Racing market data (specifically the runner names) in one hit at startup, and caches it for each day. Todays cache contains 47 markets... Given that:
- I need to call GetMarketInfo to get the runner data
- GetMarketInfo is throttled to 5 requests p/m on the Free API
This means a load time of around 9 minutes for the first run of the day. For my personal use, that's not an issue, but for selling to people, this daily startup time is perhaps a bit much. That said, I could pretty much give the app away if I'm not paying for the API

So - I could get on with the Free API, provided:
1 - BF don't mind
2 - I can work some kind of user provisioning in independently
3a - I (and users) can live with long initial startup times or
3b - I can find a faster way of loading the runner data than repeated calls to GetMarketInfo

I can't answer 1, although your post seems to imply that this may not be a problem.

I can probably sort 2 out myself... Suitable chunk of public/private key stuff, little security through obscurity, etc.

Any suggestions for 3?

So - In short, I'm not sure of the answer to your question... If I can get away with staying on the Free API, that'd be lovely

Thanks for your interest and help so far...

Pete

[ThanksFish]

So - I could get on with the Free API, provided:
1 - BF don't mind
2 - I can work some kind of user provisioning in independently
3a - I (and users) can live with long initial startup times or
3b - I can find a faster way of loading the runner data than repeated calls to GetMarketInfo

Don't know about 1 and 2, but my understanding is that it's completely possible to sort three out with a single hit on the server if you are prepared to scrape it from the website. Keeping in mind data charges and so on, scraping the website has a higher "weight" than using the API, but if you are only calling it once per day and caching the result, there is every chance that your app wouldn't generate increased data charges because of that.

Have a look at the data charges info here

Hope that helps,

Alan

[woowoo]

So - I could get on with the Free API, provided:
1 - BF don't mind

Yes, you can use the Free Access API to develop and distribute software provided you are a licensed API Software Vendor (register at http://bdp.betfair.com/index.php?opt...ionType=Vendor noting in the comments box that you are utilising the Free Access API). There is no charge for this license/usage but no BDP technical support available to Free Access API Vendors or their application users.

Note that as a (Free Access) Software Vendor you will need to complete the software Security Certification and Product Authorisation process - details at http://bdp.betfair.com/index.php?opt...d=76&Itemid=58.

[PeteMatthews]

Yes, you can use the Free Access API to develop and distribute software provided you are a licensed API Software Vendor (register at http://bdp.betfair.com/index.php?opt...ionType=Vendor noting in the comments box that you are utilising the Free Access API). There is no charge for this license/usage but no BDP technical support available to Free Access API Vendors or their application users.

Well, that's certainly pretty interesting, and frankly very generous of BF in my opinion... I'll certainly be keeping it in mind. However...

Note that as a (Free Access) Software Vendor you will need to complete the software Security Certification and Product Authorisation process - details at http://bdp.betfair.com/index.php?opt...d=76&Itemid=58.

So I still need to comply with the Security Certification, which leaves me with most of the questions in my original post. The only differences seem to be that...

- With a home-rolled user authentication, it's much more difficult to maintain the seperation of BF username/vendor specific details.
- I guess I don't have to worry about my original Q4, as I won't be paying for anything while I'm waiting for the certification.

As it stands, I'm still undecided about whether or not to take a paid access subscription - Despite the free one being available, I'm still tempted, primarily for the user provisioning.

(And thanks to Alan for the pointer about screen-scraping - I'm certainly not above a little hackery to get this going, but I guess if I take the subscription to get user provisioning, this problem goes away too )

Thanks again for all your help so far,

Pete

[woowoo]

1 - So, is this mandatory? I'm not going to name names (so don't ask), but I know of at least one popular BF API application which caches usernames and passwords locally. Am I just looking at a well intentioned but out of date set of requirements?

Yes, these requirements were recently introduced and will be rolled out to all Software Vendors in due course.

2a - It makes a reference to a createVendorAccessRequest token, but there's no mention of that in the Vendor API documentation at http://bdphelp.betfair.com/VendorAPI.../VendorAPI.pdf - Am I looking at the right documentation?

The documentation you have linked to relates to Vendor Services API v1 which is the old version. I will send you a copy of the new docs shortly.

3a - I assume you can log in using a productID (which I assume you get when registering for an API subscription?) and no VendorID? This seems at odds with the documentation. If not, do you have to use the Free Access API for the version you send for certification?

Yes, you will log-in with a productId which you get when you register for a subscription. The Vendor Id is issued on completion of the software.

3b - Once you've got a vendor ID, you need to embed this in your application for use in the login process. Surely this is going to invalidate the MD5 (or other checksum) of the binaries that BF have certified?

We will issue the vendorId on completion of the software. However the Id will only be activated (i.e. allowing you to provision client accounts) once the review is complete.

[slw009]

Would you be able to make that updated Vendor Services API document generally available? I have exactly the same questions/issues.

Thanks

[woowoo]

Would you be able to make that updated Vendor Services API document generally available? I have exactly the same questions/issues.

Thanks

I've just now sent you a copy of the VS2 documentation as requested.

[sportingbots1]

Is it possible to also get a copy of that, also is it possible you can add it to the knowledgebase or similar so we dont have to trawl the forum to find this sort of info out.
I was amazed this morning to find that the api had been changed over and we had not been informed in anyway that it was happening beyond a couple of words said about it a month or so ago and since we've been waiting to hear more about it until today where we found it had happened.
I think this is a good idea as it will prevent not so reputable sources from gaining info on user accounts as even fr myself I can see why it would be a problem that we hold all our clients betfair details as in this way if there is an issue there are many places the info could have come from but betfair can only assume its them this way if something happens we can guaratee it

[Mr Stokes]

Hi,

I’ll send you a copy of the VS2 documentation.

To be clear Vendor Services VS1 has not been switched off. The new vendor console works on VS2 but VS1 is still available and will be for the foreseeable future.

[mxData]

I'm currently trying to understand the requirements around User Provisioning, could you please send me a copy of V2 documentation? Many thanks.

[Mr Stokes]

Hi mxData

This has now been e-mailed to you.

MS

[OzPunter]

I've managed to get all the way to the near end, just using the free API.. As you are going for your certification too, perhaps we should compare notes.

Kind Regards
punter4211

[shuba]

Hi,

I’ll send you a copy of the VS2 documentation.

To be clear Vendor Services VS1 has not been switched off. The new vendor console works on VS2 but VS1 is still available and will be for the foreseeable future.

Could you send to me Vendor API v2 too? Coz I cant find it around bdp site.