The URL command retrieves URLs relating to the various MSN services to be opened in an external or integrated browser. It takes one or two parameters. The following values have been observed for the first parameter:

INBOX - Hotmail inbox
FOLDERS - Believed to be the Hotmail's "MSN home" URL.
COMPOSE - Compose an email
CHGMOB - Mobile settings (pager etc.)
PROFILE - Edit your MSN member directory profile.
PERSON - Member services, password, secret question, account info
CHAT - Chat rooms

The official client also seems to send MOBILE, ADDRBOOK, ADVSEARCH andINTSEARCH, but these have never been observed.

INBOX, FOLDERS, and COMPOSE are ways of accessing Hotmail, and are explained in the notification server messages page. COMPOSE may be sent with a second parameter, the e-mail address of the person you're composing a message to.

The PROFILE, PERSON, and CHAT URLs require a second parameter - a hexadecimal number specifying your locale ID (e.g. "0x0409" For U.S. English).

The server will respond with another URL. It always has three parameters: the first two are URLs and the third is an ID number. These parameters are used to determine how to direct the web browser.

Below is an example of requesting the URL information for the Hotmail inbox:

>>> URL 15 INBOX\r\n

<<< URL 15 /cgi-bin/HoTMaiL https://loginnet.passport.com/ppsecure/md5auth.srf?lc=1033 2\r\n

The URL command does not give you the URL to view profiles of people in the MSN Member List. To do this, direct the web browser to http://members.msn.com/default.msnw?mem=ACCOUNTNAME where ACCOUNTNAME is the account name of the principal whose profile you want to view.

Sending an e-mail invitation

You can send an e-mail to someone inviting them to use the MSN Messenger service. We've never had any reports of e-mails addresses being harvested by Microsoft through this service. There are two commands to do this: SDC and SND. You are recommended to use SDC - SND is a relic from earlier versions of the protocol.

With the SDC command

You can send an e-mail saying "<your-name> wants to talk to you!" to a specified e-mail address with the SDC command. It's a payload command with a TrID and eight parameters:

The first parameter is the the e-mail address you want to send a message to.
The second, third, fourth, fifth and sixth parameters are "0x0409 MSNMSGS WindowsMessenger X X"
The seventh parameter is the name in the subject line ("<name> wants to talk to you!") of the e-mail they receive.
The eighth parameter is the length of the payload to this command.

For example, if I wanted to contact someone with the address "example@passport.com", with the message "Hi Mike!", I might send the following:

>>> SDC 3 example@passport.com 0x0409 MSMSGS WindowsMessenger X X Andrew%20Sayers 8\r\n Hi Mike! (no newline)

If the message was successfully sent, the server will return an SDC response with a TrID and a single parameter of "OK":

<<< SDC 21 OK\r\n

With the SND command

Alternatively, you can send an e-mail saying "<your-passport> wants to talk to you!" with the SND command. This command is less well tested than SDC. If you have done any research on the SND command, please let us know!

SND is a normal command with a TrID and 4 parameters:

The first parameter is the e-mail address you want to send the message to.
The second parameter is the locale ID of the language to send the message in.
The third and fourth parameters are "MSMSGS MSMSGS".

If the message was sent successfully, the server will reply with an SND with a single parameter of OK. Here is an example.

>>> SND 22 alice@hotmail.com 0x409 MSMSGS MSMSGS\r\n

<<< SND 22 OK\r\n

If bob@hotmail.com sent this message, Alice would receive an e-mail saying "bob@hotmail.com wants to talk to you!".

Sending Pages

You can page someone on their MSN Mobile device with the PAG command and receive incoming messages with the IPG command.

If someone on your forward list has an MSN Mobile device and have allowed you to send messages to them with it, their "MOB" will be set to "Y". The PAG command has a TrID and two parameters.

The first parameter is the passport of the principal you want to send the message to.
The second parameter is the length of the message body.

The payload can optionally begin with <PHONE pri="1"><LOC>string</LOC><NUM>string</NUM></PHONE>, to specify a callback number. Next comes <TEXT xml:space="preserve" enc="utf-8">string</TEXT>, which contains the message to be sent. Strictly, enc="utf-8" is only necessary if the message includes non-ASCII characters, but it's safest to always include it.

If the command failed to send, the reply is an 800 error. If there is some other error (for example, you are not allowed to send PAGs, or your PAG is malformed), you get a 220 error. If the message was sent successfully, there is no reply.

A message sent with the PAG command must be no more than 113 characters long. It's an XML document, so is XML encoded.

Receiving Pages

Incoming pages can be received with the IPG command. The command has one parameter: the length of the payload. Here is an example:

<<< IPG 643\r\n 643 bytes in the message body

The payload is a notification document. The official client displays the text of the notification in a message box much like a standard chat window, and doesn't use either of the notification URLs.

Notices

Notices are used by services affiliated with MSN Messenger to tell you when something happens (like someone's birthday comes round). At present, only MSN Calendar and MSN Alerts are known to use notices. The command is NOT. Much like IPG, the only parameter is the length of the payload. Here is an example:

<<< NOT 589\r\n 589 bytes in the message body

The payload is a notification document. The official client displays the text of the notification in a pop-up window (called "toast") much like that used when someone logs in. Clicking on the message opens a browser to the action URL, clicking on "options" in the same window goes to the subscription URL.