Create Places Externally - Documentation of /ide/places/createV2

ThatTimothy · August 7, 2021, 7:42pm

Sidenote on topic placement

This resources really isn’t significant enough to post in #resources:community-resources, so I’m posting it here instead. Hopefully this will help at least one person at some point.

This is an article about creating places externally. To create universes externally, see this article.

What

This article aims to document the undocumented private place creation API found at https://www.roblox.com/ide/places/createV2. Be warned that this API is private, and therefore could change at any time, much like https://data.roblox.com/Data/Upload.ashx.

Why

While there are public APIs for configuring places, there is no public API to create them. If you want to be able to create places, you have to open studio, open a universe, go to file, open asset manager, create new. That’s way too many steps to just create a place.

The API

To use this API, you must send a POST request to www.roblox.com/ide/places/createV2. Note that clicking on the link will just give you a 404.

Headers

Each request must contain the following headers:

`Cookie`

Must contain your .ROBLOSECURITY cookie in the format .ROBLOSECURITY=_|WARNING:-DO-NOT-SHARE-THIS.--Sharing-this-will-allow-someone-to-log-in-as-you-and-to-steal-your-ROBUX-and-items.|_RestOfHashHere;. Note that no space are allowed, and that a semicolon at the end is required. If invalid or not provided, you will get a 403 Forbidden status.

`X-CSRF-TOKEN`

This must be set to a valid token, or you will get a 403 Forbidden status. Note that the initial request does not need to have it, as you can fetch the X-CSRF-TOKEN header from the response, and the re-request with it as a header. This has been a thing since Febuary, 2021. You can see an example in Rojo’s upload command:

github.com

rojo-rbx/rojo/blob/5d62bf9b60f255fde0db5bf012ad2c5a49ec4036/src/cli/upload.rs#L108-L116

      
        
            // Starting in Feburary, 2021, the upload endpoint performs CSRF challenges.
            // If we receive an HTTP 403 with a X-CSRF-Token reply, we should retry the
            // request, echoing the value of that header.
            if response.status() == StatusCode::FORBIDDEN {
                if let Some(csrf_token) = response.headers().get("X-CSRF-Token") {
                    log::debug!("Received CSRF challenge, retrying with token...");
                    response = build_request().header("X-CSRF-Token", csrf_token).send()?;
                }
            }

For a much more detailed explanation, see this post about it.

Query Parameters

When sending a post request, you must provide several query parameters. This looks like: https://www.roblox.com/ide/places/createV2?templatePlaceIdToUse=TEMPLATE_ID&universeId=UNIVERSE_ID. You can find all the templates here . The UNIVERSE_ID should be the id of the universe you want to add a place too.

That’s It!

That’s all you have to do! If you have any questions or issues, feel free to reply here or message me. If this ever stops working, I’ll try to update it again to work.