[API Update] API Rate Limit Tuning

[huaraz]

Key Takeaways

We’re lowering cookie and unauthenticated IP rate limits for six web API services after October 19. The new limits sit above observed peak usage, and Open Cloud limits don’t change.

Find the affected endpoints in the tables below.

---

Hi Creators,

After October 19, we are updating cookie and unauthenticated IP based rate limits for the following services to better reflect real-world usage patterns:

• badges-api
• datastores-api
• game-persistence-api
• inventory-api
• thumbnails-api
• users-api

Open Cloud limits are not impacted. The new limits are data-driven, based on observed request rates.

If you run a tool, extension, or workflow that calls these endpoints, check the tables below and file a bug report if you expect impact.

Who Is impacted

• Regular users/clients: Minimal to no impact. Limits are set above observed peak usage.
• Third party integrations, extensions, and workflows: We don’t expect you to hit the new limits, but bursts above normal peak usage could trigger rate limiting.

For each endpoint your tool, workflow, or extension uses:

• If you expect to be affected or are affected by the rate limit change, please file a bug report.
• If you don’t expect to be affected and you are still using cookies for automation, please file a feature request/bug report detailing your current use case and what you would like to see supported on Open Cloud.

What To Do If You’re Affected

If you hit rate limits after this change, or expect to:

1. Review your request volume and add caching where possible.
2. File a bug report in this forum with your use case and request volume so we can evaluate adjustments.
3. See if there’s an Open Cloud alternative you can use.

Updated Limits by Service

thumbnails-api

Endpoint	Limit	Before	After	Open Cloud Alternative
/v1/assets-thumbnail-3d	Per auth cookie, per minute	10,000	100	Get 3D asset thumbnail
/v1/batch	Per auth cookie, per minute	10,000	260	None
/v1/bundles/thumbnails	Per auth cookie, per minute	10,000	100	None
/v1/developer-products/icons	Per auth cookie, per minute	10,000	150	None
/v1/games/{universeId}/thumbnails	Per auth cookie, per minute	10,000	100	None
/v1/users/outfit-3d	Per auth cookie, per minute	10,000	100	Get 3D outfit thumbnail
/v1/places/gameicons	Per auth cookie, per minute	10,000	130	None

badges-api

Endpoint	Limit	Before	After
/v1/users/{userId}/badges	Per unauthenticated IP, per minute	1,000	100
/v1/universes/{universeId}/badges/is-authorized-to-reorder	Per unauthenticated IP, per minute	1,000	100
/v2/universes/{universeId}/badges	Per unauthenticated IP, per minute	1,000	100

inventory-api

Endpoint	Limit	Before	After	Open Cloud Alternative
/v1/packages/{packageId}/assets	Per auth cookie, per minute	1,000	140	None
/v1/collections/items/{itemType}/{itemTargetId}	Per auth cookie, per minute	1,000	100	None
/v1/users/{userId}/items/{itemType}/{itemTargetId}/is-owned	Per auth cookie, per minute	10,000	730	List inventory items
/v1/users/{userId}/items/{itemType}/{itemTargetId}	Per auth cookie, per second	10,000	220	List inventory items
/v1/users/{userId}/categories	Per auth cookie, per minute	10,000	100	None
/v1/users/{userId}/categories/favorites	Per auth cookie, per minute	10,000	100	None
/v2/inventory/asset/{assetId}	Per auth cookie, per minute	10,000	100	None
/v1/users/{userId:long}/places/inventory	Per auth cookie, per minute	10,000	590	None
/v1/users/{userId:long}/places/inventory	Per unauthenticated IP, per minute	1,000	280	None

users-api

Endpoint	Limit	Before	After	Open Cloud Alternative
/v1/users/	Per auth cookie, per second	1,000	100	Get user (one user per call)
/v1/users/	Per unauthenticated IP, per second	1,000	100	Get user (one user per call)

game-persistence-api

Endpoint	Limit	Before	After	Open Cloud Alternative
/v2/persistence/{universeId}/datastores/objects/ (GET)	Per auth cookie, per minute	1,000	200	List data store entries
/v2/persistence/{universeId}/datastores/objects/ (POST)	Per auth cookie, per minute	1,000	200	Create data store entry

datastores-api

Endpoint	Limit	Before	After	Open Cloud Alternative
/datastores/v1/user/universes/{universeId}/standard-datastores	Per auth cookie, per minute	1,000	200	List data stores
/datastores/v1/user/{universeId}/standard-datastores	Per auth cookie, per minute	1,000	110	List data stores

[luaClass]

so who abused the apis for this to happen?

for anyone who wanted a simplified, summed up version of what important changed:

also a bit off topic but can we get a fix to this so third party sites can fix dynamic face tracking finally?

Inventory & Owners API does not return collectibleItemInstanceId

For devs who aren’t aware, Roblox has been migrating to collectibleItemInstanceId (CIIID) as the canonical identifier for collectible copies. Every endpoint already accepts CIIIDs like /v2/assets/{assetId}/owners and Dynamic Head limiteds only have CIIIDs available, they no longer have a valid userAssetId. The Inventory API endpoint https://inventory.roblox.com/v1/users/{userId}/assets/collectibles returns ownership rows for a user’s limiteds but does not include the collectibleItemInstanceId f…

[8_CV]

Hey all my games either 0 ccu or average 6 and below are all being flagged for “over limit”, this fr? RN only in datastore manager. How u expect a brand new game that has no earnings yet to pay for more? That’s no profit for a new game

[biscuitify (max)]

a complete idiot probably using some vibecoded bot making way more requests than necessary by the sounds of it

[Inkthirsty]

This is a visual bug and will be fixed soon. You aren’t actually over the limit.

Datastore Manager Pagination Issue

this should be fixed now, sry about that

[8_CV]

Oh thank you! Can confirm its fixed on my end, was trying to find a bug report on this but couldn’t find it when I first saw this, thought the first thing I do is complain while seeing this announcement, thank you again for letting me know I was worried

[RuizuKun_Dev (Kitsune)]

i understand why you wanna lower it but some of us (I) have valid use cases

At least replace the cookie based API first

Again, Roblox keeps stepping on Developers foot

[TheGrimDeathZombie (Reapimus)]

If you have valid use cases why are you not explaining your use case and why it needs such an absurdly large rate limit in the first place so that they have a better time understanding if it is actually valid and should be considered?

[ThatRobloxGamer28]

well this sucks, gonna impact my new game a lot

[RuizuKun_Dev (Kitsune)]

I have a Discord bot that checks for Badges and Gamepasses for my game

those are the only concerns and use case that I have

Now I don’t think my bot would hit rate limits BUT I’m still not happy with how Roblox is operating here, they could have provided a more elegant solution and transition

[lSteveRogersl (Steve)]

Great, so where’s the Roblox announcement regarding the ban wave that’s affected a large chunk of your platform for transferring Robux (or uploading items)?

[TheGrimDeathZombie (Reapimus)]

@RuizuKun_Dev

they could have provided a more elegant solution and transition

You already clearly have a third party server, is the elegant solution not just to have your game send updated information about the player’s badges and gamepasses as state changes in-game to your server to store/cache?

Keeping your own cache/mirror of third party data you need immediate/constant access to has practically always been the standard expectation when using an API has it not? Shouldn’t have ever hinged on Roblox keeping such luxuriously high rate limits indefinitely when presumably they were simply that high to help gauge what standard usage looked like and update to match like they have now done.

[HealthyKarl]

So, is it easier to get rate limited now?

[BENJAMIN10T (Tumored_Benji)]

im a bit worried about the huge issues on the site since there’s like high chance of being rate limited with lots of extensions enabled.

[Ethanlovir (Devz)]

How likely are we estimating sites like Towerstats or Rolimons to be affected?

[jdc20181 (jdc)]

This is absolutely insane. WHY on earth would you nuke API limits so much??? How does one switch to “open cloud” apis for in game things for external tools..

Absolutely aseinine move and I hope you reverse it with such a small window we don’t have time to change anything to prevent the crazy throttle.

[Pradzuhs (Nico)]

Nice! Another update that wasn’t needed

[BastonGeneral (Latouffe95)]

??? Unprovoked ??? this is kinda unnecessary…

[IAmCalledAlotOfNames (adc)]

oops