`/api/get_scores` and `/api/get_replay` are the only endpoints that require a URL parameter for POST requests

[geotim90]

When using the API using POST requests with multi-part form data in the body, all endpoints work as expected except:

• /api/get_scores
• /api/get_replay

These two endpoints only work if the b parameter is provided as a URL parameter. All other parameters (including mandatory ones) work fine when included in the multi-part form data.

Example: GET https://osu.ppy.sh/api/get_scores?k=...&b=252002 returns 50 scores as expected. POST https://osu.ppy.sh/api/get_scores with the same parameters in the multi-part body returns an empty result. POST https://osu.ppy.sh/api/get_scores?b=252002 with the remaining parameters in the multi-part body returns 50 scores.

Is this intentional?

Background: I prefer using POST requests so that I do not expose the API key in the request URL. If this is the wrong approach, then please suggest a viable alternative.

Related issues:

• 139 - get_scores doesn't work with POST requests

• 200 - get_replay only works on GET requests

I am aware that GET is the preferred method (e.g. https://stackoverflow.com/questions/19637459/rest-api-using-post-instead-of-get). Is there a header parameter we can use instead for k?

[peppy]

I've adjusted to allow POST in all cases.