Files

T

funman300 6ef4c40e29 Initial commit: OpenFUT Core + Bridge scaffold

Two-repo monorepo for an offline FUT backend inspired by SPT.

openfut-core: game-independent REST API backend (Axum, SQLite, SQLx)
- 19 API endpoints: auth, profiles, clubs, cards, packs, squads,
  objectives, SBCs, match rewards, NPC market, statistics
- JSON-driven card/pack/objective/SBC data (fully moddable)
- SQLx migrations, weighted pack generator, SBC validation engine
- 5 integration tests passing

openfut-bridge: FIFA 23 traffic proxy + reverse-engineering scaffold
- Catch-all HTTP proxy with request capture to captures/
- Known-route mapper (FUT paths → Core API calls)
- Placeholder responses for unknown endpoints
- Admin endpoints: captures, unknown endpoint list
- 4 unit tests passing

cargo fmt ✓  cargo clippy -D warnings ✓  cargo test ✓

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-06-25 14:42:16 -07:00

2.3 KiB

Raw Blame History

Reverse Engineering Notes — FIFA 23 FUT API

This document tracks what is known and unknown about EA's FUT API as used by FIFA 23.

Status

🔴 Very early — almost nothing confirmed. All mappings in src/mapper.rs are speculative.

Known / Suspected Endpoints

These are guesses based on:

Common FUT API patterns from public research
Observations from older FIFA titles
Community reverse-engineering work

Method	Path	Purpose	Status
`POST`	`/ut/auth`	Authentication / session	Suspected
`GET`	`/ut/game/fut/user/settings`	User settings	Suspected
`GET`	`/ut/game/fut/usermassinfo`	Club + profile bulk	Suspected
`GET`	`/ut/game/fut/squad/active`	Active squad	Suspected
`GET`	`/ut/game/fut/store/packdetails`	Pack store	Suspected
`GET`	`/ut/game/fut/transfermarket`	Transfer market	Suspected

Unknown Endpoints

Run GET /_bridge/unknown after a game session to see what new routes appeared. Each entry represents a real FIFA 23 request that hasn't been mapped yet.

Request Format Notes

Auth

EA FUT auth appears to use a multi-step token flow:

EA account auth (OAuth2-style)
FUT-specific auth with a "nucleus ID"
Session token issued

For offline purposes, OpenFUT Bridge returns a static token that satisfies the client.

Headers

Common headers seen in FUT traffic:

X-UT-SID — session token
X-UT-PHISHING-TOKEN — anti-CSRF token
Content-Type: application/json
X-HTTP-Method-Override — EA sometimes uses POST + this header instead of DELETE/PUT

Tools

mitmproxy — HTTPS interception
Fiddler — Windows-friendly proxy
Wireshark — low-level packet capture
OpenFUT Bridge captures/ folder — automatic request logging

Resources

Previous FIFA FUT API research: search GitHub for "fifa-ut-api", "easfc", "futapi"
ea.com documentation: none public
Community wikis: FUT Trading community resources

TODO

Capture a real FIFA 23 session via mitmproxy
Document the auth flow completely
Map the squad endpoints
Map the pack opening endpoints
Map the objectives endpoints
Map the SBC endpoints
Map the transfer market endpoints
Identify which endpoints are critical vs optional

2.3 KiB Raw Blame History