It seems that Qobuz is closing down "unofficial" usage of Qobuz APIs. This includes upnpdcli Qobuz plug-in, which powers Qobuz connection of Moode audio.
Here's a little more detail as I understand it.
- Qobuz API requires APP ID and APP SECRET to sign each and every API call. So they can see, which application is making how many calls, etc. This includes the ability to check which app is making problem, (e.g. repeated calls, or copying whole library, etc), and ability to reject specific app for such a reason. Qobuz official announces that, app-developers should never share APP ID or APP SECRET.
- Most of Qobuz open source plug-ins are a version or another implementation of Kodi Qobuz-plugin (https://github.com/tidalf/plugin.audio.qobuz). This includes, Moode audio's underlying upmpdcli and its Qobuz plug-in. (https://www.lesbonscomptes.com/upmpdcli/...anual.html). Most importantly, those plug-ins (including Moode's underlying upmpdcli) uses Kodi Qobuz Plug-in's APP ID and APP SECRET, and signs all API calls with that secret.
- This, is actually kind of abuse of Qobuz API usage agreement (http://static.qobuz.com/apps/api/QobuzAP...sofUse.pdf ). To be faithful to the usage agreement, each app should contact Qobuz and ask for their own ID/SECRET. HOWEVER, up until now, Qobuz allowed this common usage of Kodi APP ID and APP SECRET, on many different applications.
Here's what I believe is happening (but just my opinion, and nothing officially confirmed from Qobuz.)
- Qobuz server had some problems in last few weeks; server goes down, apps (all apps including official app) having hard time playing music, or slow at responding, and so on. It could be a DoS attack, or simply by some abusive usage from some users / tools (e.g. there are tools to copy whole library of Qobuz.)
- Usually such down-time were resolved in a few hours, but such a down time have been repeated for few days, actually.
- It seems that Qobuz has investigated those issues and realized that there are a lot of API abusing.
- Starting from October 1st (or 2nd), it seems that APP-ID/APP-SECRET of KODI Qobuz plug-in is NOT being accepted anymore. API calls are rejected with 400, bad requests.
- This is only limited to the API calls signed with KODI Qobuz plug-in ID/SECRET: Qobuz works as usual for other tools, such as Audirvana, Roon, and so on. I compared the API calls briefly, and it seems that API itself don't seem to have changed (e.g. roughly the same API calls between those tools, but only those API calls with no-longer-secret Kodi APP secrets are being rejected. )
- Qobuz used to have official API documentation on GitHub, for all to read. Now they have removed this page completely. This following now returns 404, no such page. It showed full Qobuz API documantion just till last week. https://github.com/Qobuz/api-documentation
With the above observations, I think that Qobuz has finally changed their policy and decided to forces the API usage agreement; which resulted in dropping (no-longer-secret) API-ID/SECRET usage, such as all Kodi-plugin based API-ID/SECRET API calls. Maybe this is temporary. Maybe not. However, the removal of API documentation on GItHub seems to indicate this isn't a temporary move... but I think we need to wait and see. e.g. what they answer back to official Kodi Qobuz Plug-in developers, etc.
Here's a little more detail as I understand it.
- Qobuz API requires APP ID and APP SECRET to sign each and every API call. So they can see, which application is making how many calls, etc. This includes the ability to check which app is making problem, (e.g. repeated calls, or copying whole library, etc), and ability to reject specific app for such a reason. Qobuz official announces that, app-developers should never share APP ID or APP SECRET.
- Most of Qobuz open source plug-ins are a version or another implementation of Kodi Qobuz-plugin (https://github.com/tidalf/plugin.audio.qobuz). This includes, Moode audio's underlying upmpdcli and its Qobuz plug-in. (https://www.lesbonscomptes.com/upmpdcli/...anual.html). Most importantly, those plug-ins (including Moode's underlying upmpdcli) uses Kodi Qobuz Plug-in's APP ID and APP SECRET, and signs all API calls with that secret.
- This, is actually kind of abuse of Qobuz API usage agreement (http://static.qobuz.com/apps/api/QobuzAP...sofUse.pdf ). To be faithful to the usage agreement, each app should contact Qobuz and ask for their own ID/SECRET. HOWEVER, up until now, Qobuz allowed this common usage of Kodi APP ID and APP SECRET, on many different applications.
Here's what I believe is happening (but just my opinion, and nothing officially confirmed from Qobuz.)
- Qobuz server had some problems in last few weeks; server goes down, apps (all apps including official app) having hard time playing music, or slow at responding, and so on. It could be a DoS attack, or simply by some abusive usage from some users / tools (e.g. there are tools to copy whole library of Qobuz.)
- Usually such down-time were resolved in a few hours, but such a down time have been repeated for few days, actually.
- It seems that Qobuz has investigated those issues and realized that there are a lot of API abusing.
- Starting from October 1st (or 2nd), it seems that APP-ID/APP-SECRET of KODI Qobuz plug-in is NOT being accepted anymore. API calls are rejected with 400, bad requests.
- This is only limited to the API calls signed with KODI Qobuz plug-in ID/SECRET: Qobuz works as usual for other tools, such as Audirvana, Roon, and so on. I compared the API calls briefly, and it seems that API itself don't seem to have changed (e.g. roughly the same API calls between those tools, but only those API calls with no-longer-secret Kodi APP secrets are being rejected. )
- Qobuz used to have official API documentation on GitHub, for all to read. Now they have removed this page completely. This following now returns 404, no such page. It showed full Qobuz API documantion just till last week. https://github.com/Qobuz/api-documentation
With the above observations, I think that Qobuz has finally changed their policy and decided to forces the API usage agreement; which resulted in dropping (no-longer-secret) API-ID/SECRET usage, such as all Kodi-plugin based API-ID/SECRET API calls. Maybe this is temporary. Maybe not. However, the removal of API documentation on GItHub seems to indicate this isn't a temporary move... but I think we need to wait and see. e.g. what they answer back to official Kodi Qobuz Plug-in developers, etc.
