[✅Solved] Returns empty data via proxy but works directly via browser tab

[Yse3ra (Ysee)]

Avatar API returns empty data via Google Apps Script proxy for specific users

1. What I want to achieve?

I want to fetch a user’s editable outfits using the Avatar API with the isEditable=true parameter through a Google Apps Script as a proxy. The endpoint should return all outfits that the user can edit (their own created outfits not the bought ones).

Expected behavior:

https://avatar.roblox.com/v2/avatar/users/{userId}/outfits?itemsPerPage=50&isEditable=true

Should return an array of editable outfits (same as when accessed directly in a browser from Avatar → Characters → Creations).

---

2. What is the issue?

The Avatar API endpoint returns an empty data array when called through Google Apps Script proxy, but returns correct data (50+ outfits) when accessed directly in a browser.

Important: This issue only affects a very small number of specific users (e.g., user ID 3918678257 and 2809212178). Most users work perfectly fine with the same code. Additionally, these affected users used to work correctly before (the endpoint returned their outfits successfully in the past, but now suddenly returns empty data.)

Evidence:

Browser Request (Works):

Proxy Response (Fails):

-- Roblox Game Server Log:
[DEBUG] Full URL: https://avatar.roblox.com/v2/avatar/users/3918678257/outfits?itemsPerPage=50&isEditable=true&_t=1763940958.4408822
[DEBUG] Proxy returned type: string
[DEBUG] Proxy response: {"data":[],"paginationToken":""}
[DEBUG] data.data type: table, length: 0

---

3. What solutions have been tried so far?

> Attempted Solutions:

1. Cache Busting with Timestamp
   Added a _t={timestamp} query parameter to stop Google Apps Script from serving cached results and force the script to fetch updated data.

   Result: Still returns empty array

2. Two Proxy Fallback System
   So I thought maybe it had something to do with Google Apps Script, or possibly my Google account. I tried using a different account and deployed it there as well. I even added a second attempt; if the first response was empty, it would try the second Script ID; but as expected, that wasn’t it.

   Result: Both proxies return empty data

3. Verified URL Encoding
   Ensured proper URL encoding/decoding in proxy

   Result: URL is correctly formed (checked in logs)

4. Tested Without Parameter
   Attempted Endpoint without isEditable returns 50 outfits successfully in browse.

   Result: changes nothing no data returned

> Code Implementation:

Google Apps Script Proxy (Code.gs):

function fetchWithRetry(url) {
  const options = { method: "get", muteHttpExceptions: true, followRedirects: true, validateHttpsCertificates: true, timeout: 25000 };
  
  const rep = UrlFetchApp.fetch(url, options);
  const statusCode = rep.getResponseCode();
  
  Logger.log("[DEBUG] Roblox response status: " + statusCode);
  Logger.log("[DEBUG] Response: " + rep.getContentText());
  
  return rep;
}

Roblox Game Server (ProxyRobloxAPI.lua):

local function fetchAllOutfits(userId)
    local fullUrl = "https://avatar.roblox.com/v2/avatar/users/" .. tostring(userId) .. "/outfits?itemsPerPage=50&isEditable=true&_t=" .. tick()
    
    print("[DEBUG] Full URL:", fullUrl)
    
    local result = ProxyRobloxAPI.Get(fullUrl)
    
    print("[DEBUG] Proxy returned type:", type(result))
    print("[DEBUG] Proxy response:", result)
    
    local success, data = pcall(function()
        return HttpService:JSONDecode(result)
    end)
    
    if success and data.data then
        print("[DEBUG] data.data type:", type(data.data), "length:", #data.data)
        return data.data
    end
    
    return {}
end

---

4. Additional Details

My thinking:

Why only specific users? Since this affects only a few users who previously worked, it could be:

• Account-specific settings or privacy changes
• Progressive rollout of API authentication requirements
• User-specific rate limiting or flagging
• Changes in outfit visibility or permissions

> Questions:

1. Why would this suddenly stop working for specific users who worked before?
2. Could this be related to account privacy settings or outfit visibility?
3. Am i doing something wrong ??

> Test Results:

I created a test function in Google Apps Script to isolate the issue:

function testUser3918678257() {
  const userId = 3918678257;
  
  // Test WITHOUT isEditable parameter
  const urlNoFilter = `https://avatar.roblox.com/v2/avatar/users/${userId}/outfits?itemsPerPage=50`;
  // Result: Returns empty array

  // Test WITH isEditable=true parameter
  const urlWithFilter = `https://avatar.roblox.com/v2/avatar/users/${userId}/outfits?itemsPerPage=50&isEditable=true`;
  // Result: Returns empty array
  
  // Test with timestamp (cache bust)
  const urlWithTimestamp = urlWithFilter + "&_t=" + new Date().getTime();
  // Result:  Still returns empty array
}

---

TL;DR i need help with:

• Understanding why the very same request works in browser but not via proxy
• Why this suddenly stopped working for specific users who previously worked fine
• Whether this is related to account settings, privacy changes, or API updates
• Alternative approaches to fetch only editable outfits from server-side
• Required headers or authentication for this specific parameter

Any thoughts? I’d be super grateful.. thanks in advance!

Sideeee note : Yes i submitted the whole thing to ai before posting here but i ended up getting sh- bad solutions such as using v1 instead of v2 (well i did try that); using non existent endpoints and whole bunch of useless code which never ended up being a solution.

---

Environment:

• Roblox Studio Version: Latest
• Google Apps Script
• API Endpoint: https://avatar.roblox.com/v2/avatar/users/{userId}/outfits
• Affected User Example: 3918678257 (has 100+ editable outfits verified in browser, previously worked via proxy), 2809212178 (has 9 editable outfits verified in browser, previously worked via proxy)
• Note: Most users work fine - only a small subset is affected (throughout 130 different users tested only 4 of these occured)

[Yse3ra (Ysee)]

Alright so i found the problem, which was that this api requires authentification which Google Apps Script doesn’t provide : .ROBLOSECURITY which my browser have reason to why it would work there. A good alternative id to use Cloud API which i should’ve though of immediatly.. or an authentified proxy ?