Being able to get user activities through bot API

[MakroCoded]

It would make sense for bots to be able to access user status and user activities because bots can already access stuff like servers, text channels, and so on.

For instance, when making a request to the /users/{user.id} endpoint, instead of receiving only basic user information like:

{
  "id": "80351110224678912",
  "username": "Nelly",
  "discriminator": "1337",
  "avatar": "8342729096ea3675442027381ff50dfe",
  "verified": true,
  "email": "[email protected]",
  "flags": 64,
  "banner": "06c16474723fe537c283b8efa61a30c8",
  "accent_color": 16711680,
  "premium_type": 1,
  "public_flags": 64,
}

We could receive an enhanced response that includes the user's online status and current activities, like in the example below:

{
  "id": "80351110224678912",
  "username": "Nelly",
  "status": 1,
  "activities": [
    {
      "name": "BoD Demo",
      "type": 0,
    },
    {
      "name": "Spotify",
      "type": 2,
      "details": "Never Gonna Give You Up",
    },
  ],
  "discriminator": "1337",
  "avatar": "8342729096ea3675442027381ff50dfe",
  "verified": true,
  "email": "[email protected]",
  "flags": 64,
  "banner": "06c16474723fe537c283b8efa61a30c8",
  "accent_color": 16711680,
  "premium_type": 1,
  "public_flags": 64,
}

What it can be good for?
This feature would be good for making third-party user bios and presence indicators, and yes, while we can use the WebSocket gateway to detect status changes, retrieving the user's current status and activities at the time of the request instead of waiting for an update event would be more efficient.

"But it violates privacy! third-parties will be able to see what we are doing and collect data on us!"
Yes, and for this issue, we can authorize what bots can see on us. (adding apps to yourself, which will come tomorrow from what I hear.)

[TwilightZebby]

There's already OAuth Scopes (specifically activities.read) for being able to read/get a User's activities. Though, as the docs state, that OAuth Scope is not available for public use.

[MakroCoded]

While OAuth2 can be a way to get user activities, working with OAuth2 is a pain, and bots can be an easier way to read activities in my opinion. And we wouldn't need a database to hold client secrets.

[vibhuti019]

I was going through the discord documentation, when I came across the endpoint "/users/{user.id}" , here email is also mentioned as a parameter, is it like discord leaks user-email to admins/bot-users ?
@hawl1 Please, inform about the email param?

[TwilightZebby]

It does not leak the email address of Users as you need to request the User to grant your Bot/App/Activity/etc the email OAuth Scope first.

I assume receiving the email field is only possible via the GET /users/@me endpoint, not via the GET /users/{user.id} endpoint.

[MakroCoded]

I was going through the discord documentation, when I came across the endpoint "/users/{user.id}" , here email is also mentioned as a parameter, is it like discord leaks user-email to admins/bot-users ?
@hawl1 Please, inform about the email param?

e-mail reply was just an example, and I did NOT mean that activities.read should also get email address, sorry for any confusion that happened, I just wanted a activities property.