ochenstarik/randomayzer
1
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions
randomayzer/docs/VK_METHOD_CAPABILITIES.md

2.9 KiB
Raw Permalink Blame History

VK Method Capabilities Matrix

This document defines the verified VK API method capabilities, token scopes, and known platform constraints according to the official VKCOM/vk-api-schema (API version 5.199).

Verified VK Method Matrix

VK Method Allowed Token Types (Schema) Required Parameters Max Batch / Count Known Privacy & Policy Limitations Verification Status
wall.getById service, user, group, open posts (e.g. "-123_456") Max 100 posts per call Cannot access posts on private user walls or restricted groups without user/group authorization. VERIFIED
likes.getList service, user, group, open type="post", owner_id, item_id Max 100 with extended=1 (profiles), max 1000 with IDs only If a post is from a closed community, requires membership/access. Profiles with deleted accounts are returned with deactivated tag. VERIFIED
wall.getComments service, user, group, open owner_id, post_id Max 100 comments per request Nested replies require recursive traversal or standard chronological fetch. Closed comments return error 210. VERIFIED
groups.isMember service, user, group, open group_id, user_ids Max 500 user_ids per batch call Closed groups return member=0 for non-members even if user has pending join request (unless request status inspected). VERIFIED
wall.getReposts user, group owner_id, post_id Max 100 Cannot enumerate all reposters on arbitrary public posts due to user profile privacy restrictions. Only available to group managers for their own posts. CONFIRMED_LIMITATION
groups.getMembers (Managers) user, group group_id, filter="managers" Max 1000 Requires administrative rights in the target community. Not available via standalone public Service Token. CONFIRMED_LIMITATION

Token Type Definitions (VKCOM/vk-api-schema)

  1. service (Service Token):

    • Application access token obtained from VK Developer Console.
    • Strictly read-only for public methods.
    • Never expires, but cannot act on behalf of a user.

  2. user (User Access Token):

    • Obtained via modern VK ID Web SDK (OAuth 2.1 with PKCE).
    • Can access user-authorized data, private groups user belongs to, and perform user actions.

  3. group (VK Group Access Token):

    • Configured in VK Community Settings (referred to internally as COMMUNITY token in Randomayzer).
    • Scoped strictly to the managing group/public page.

Authentication Architecture for Phase 2.2

  • Protocol: OAuth 2.1 + PKCE (code_verifier, code_challenge SHA-256 base64url).
  • State Security: Cryptographically secure single-use state with TTL, validated on OAuth callback.
  • Endpoints: Modern id.vk.com / vk.ru VK ID Web SDK flow (legacy implicit token flow is deprecated).