`data.roblox` upload endpoint appears to no longer function

Rojo and other tools utilize https://data.roblox.com/Data/Upload.ashx to upload model files to the website. They cannot upload them using the Open Cloud API because it does not currently support .rbxm or .rbxmx files.

A short while ago, this endpoint stopped functioning and is returning an internal server error. Whether it be because the endpoint changed its format unexpectedly or because it no longer works is unclear, as it was never officially documented to my knowledge.

This impacts everyone using Rojo to upload models to the website and any number of users of other tools and workflows.

Expected behavior

My expectation is that endpoints work as expected and that the endpoint we use for Rojo not be removed or disabled until we have an officially supported method for uploading model files via Open Cloud.

Page URL: https://data.roblox.com/Data/Upload.ashx

28 Likes

The endpoint worked as expected at 23:43 UTC on August 3. My first record of it throwing 500 Internal Server Error was at 6:09 UTC on August 4.

12 Likes

ROBLOX EMPLOYEES

Please look into this! It is preventing us from releasing important updates to our game!!!

It needs to be fixed ASAP please!

5 Likes

We are also affected by this error. Has been degrading over time but seems to be completely broken today.

4 Likes

Me and my entire art team have been affected by this issue for several days. Made the same observations as @lexandstuff where it was sometimes off a couple days ago, now it’s just entirely broken.

We’ve been getting error code 500 on almost all uploads even directly through the Roblox Studio ‘Import 3D…’ and ‘Avatar Importer’ tools, nevermind Tarmac/Rojo.

3 Likes

These Studio bug reports might be related:

4 Likes

Took the time to figure out why this is happening, so might as well provide some additional context here.

The error page for /Data/Upload.ashx has been screwing up recently, causing it to respond with HTTP 500 whenever it tries to show an error page, complaining that it can’t display it. For example, sending a request to it without a CSRF token is supposed to respond with HTTP 403 (Forbidden), but since it fails to load the error page, it ends up responding with HTTP 500.

But if you just add the token anyway, it works just fine.

Most programs that use /Data/Upload.ashx send one request without the CSRF token, expecting to grab it from the HTTP 403 response (as it’s always in the response headers), and then send a second request with the token. While an error page not working shouldn’t be problematic, because we kind of depend on it, it actually screws up this whole process.

That’s what Rojo does, that’s what Tarmac does, that’s what I used to do in my automation scripts, and chances are that Studio might be trying to do that too?

So the endpoint is kind of broken, just not completely broken.

10 Likes

Thank you!

If anyone’s using Lune with the Remodel shim, I got it working by replacing the uploadAssetId function with this:

local function uploadAssetId(assetId: number, contents: string)
	local cookie = getAuthCookieWithFallbacks()
 
	local csrfHeaders = {
		["User-Agent"] = "Roblox/WinInet",
		Accept = "application/json",
		Cookie = cookie,
	}
 
	local csrfResponse = net.request({
		url = `https://auth.roblox.com/`,
		body = contents,
		method = "POST",
		headers = csrfHeaders,
	})

	local csrfToken = csrfResponse.headers["x-csrf-token"]
	if csrfToken == nil then error('Failed to fetch CSRF token.') end

	local uploadHeaders = {
		["User-Agent"] = "Roblox/WinInet",
		["Content-Type"] = "application/octet-stream",
		['X-CSRF-Token'] = csrfToken,
		Accept = "application/json",
		Cookie = cookie,
	}
 
	local uploadResponse = net.request({
		url = `https://data.roblox.com/Data/Upload.ashx?assetid={assetId}`,
		body = contents,
		method = "POST",
		headers = uploadHeaders,
	})
 
	if not uploadResponse.ok then
		error(
			string.format(
				"Failed to upload asset with id %s to Roblox!\n%s (%s)\n%s",
				tostring(assetId),
				tostring(uploadResponse.statusCode),
				tostring(uploadResponse.statusMessage),
				tostring(uploadResponse.body)
			)
		)
	end
end
5 Likes

This isn’t just a problem with third-party tools. Almost all first-party import tools in Studio are broken and return error 500 ~80% of the time.

1 Like

We’re taking a look at the issue right now and will keep you updated.

Is this issue happening consistently across several days, or does it vary day-to-day? e.g. one day it’s broken, next day it works

3 Likes

As far as I can tell, it broke around midnight on Friday and has been broken if you don’t send a csrf token since then.

2 Likes

We’ve been getting reports that it isn’t working consistently for a few days but I failed to put 2 and 2 together because they were from different programs. It seems to impact other endpoints on data.roblox.com too, as Tarmac hasn’t been working but it uses https://data.roblox.com/data/upload/json rather than the endpoint in the OP.

4 Likes

For me in the U.S., this has been a consistent and worsening issue over the span of about a week or so… it started 1 out of 3 publishes would be successful, and over days has progressively gotten to the point that over weekend that 1 out of 10 would successfully publish… and now I can’t even get 10% success… I published 15 times and all failed… I’ve now had to jump on VPN to different regions, and when I do I may get a good publish or two and then it starts happening again.

3 Likes

Hey everyone,

We’ve been working on this for several hours and believe the issue is now resolved. We are seeing successful Studio uploads based on our metrics.

Can you please let us know if you’re able to successfully upload models and other assets to production?

If you continue to have issues, please post:

  • The error you are seeing
  • Your Roblox username
11 Likes

Thanks for getting this fixed! My Rojo uploads are working as expected now.

4 Likes

Thank y’all so much for spending that time! Know that your work is appreciated :slightly_smiling_face:

3 Likes

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.