I have been notified that this endpoint has been moved to the new apis.roblox.com domain. I haven’t tested it yet, but a lot of stuff has moved there recently and I’d expect an announcement from Roblox at some point.
This is how many universes I was able to make in an hour while testing the API’s capabilities (plus or minus 10)
Sidenote on topic placement
This resources really isn’t significant enough to post in #resources:community-resources, so I’m posting it here instead. Hopefully this will help at least one person at some point.
This is an article about creating universes externally. To create places externally, see this article.
What
This article aims to document the undocumented private universe creation API found at https://api.roblox.com/universes/create. Be warned that this API is private, and therefore could change at any time, much like https://data.roblox.com/Data/Upload.ashx.
Why
While there are public APIs for configuring universes, there is no public API to create them. If you want to be able to create universes, you have to open studio, open a place, go to file, publish to roblox as, create new, publish. That’s way too many steps to just create a universe. I spent a few hours testing various parameters to make it work. Also, someone, somewhere will want to use this one day, and this makes it possible.
The API
To use this API, you must send a POST request to api.roblox.com/universes/create. Note that clicking on the link will just give you a 404.
Headers
Each request must contain the following headers:
Cookie
Must contain your .ROBLOSECURITY cookie in the format .ROBLOSECURITY=_|WARNING:-DO-NOT-SHARE-THIS.--Sharing-this-will-allow-someone-to-log-in-as-you-and-to-steal-your-ROBUX-and-items.|_RestOfHashHere;. Note that no space are allowed, and that a semicolon at the end is required. If invalid or not provided, you will get a 403 Forbidden status.
Content-Type
Must be set to application/json exactly, or you will get a 500 InternalServerError status.
X-CSRF-TOKEN
This must be set to a valid token, or you will get a 403 Forbidden status. Note that the initial request does not need to have it, as you can fetch the X-CSRF-TOKEN header from the response, and the re-request with it as a header. This has been a thing since Febuary, 2021. You can see an example in Rojo’s upload command:
For a much more detailed explanation, see this post about it.
Body
The body must be JSON with the field templatePlaceIdToUse, like {"templatePlaceIdToUse": 95206881}, where the number is a valid template place id. You can find all the templates here.
Example Request
An example request would look like:
{
headers: {
"Cookie": ".ROBLOSECURITY=ABCDEFGH;",
"Content-Type": "application/json",
"X-CSRF-TOKEN": "(once you have it)",
},
body: '{"templatePlaceIdToUse": 95206881}',
}
That’s It!
That’s all you have to do! If you have any questions or issues, feel free to reply here or message me. If this ever stops working, I’ll try to update it again to work.
