Of course you can PM bot, it's just most people who code them don't know what they're doing. You need to get the __RequestVerificationToken (not sure if there's __EVENTVALIDATION or __VIEWSTATE for PMs) and if you're doing it server-side (which you should) get the user's cookies sent to validate the request. To get __RequestVerificationToken you just need to parse the GET response on the API you're going to POST to, and use a RegEx (probably a better way with jQuery) and after that send a POST with the valid subject, body, recipientid, and cacheBuster (the current time) parameters. |