We are excited to announce “Try It Out” functionality for Cloud endpoints as a significant enhancement to our Creator Hub documentation! Previously, creators could access comprehensive information regarding Cloud endpoints within the Creator Hub. However, there was no way to send and view sample requests directly within the documentation.
“Try It Out” addresses that gap, bringing a popular aspect of our existing legacy API sites directly into our more current documentation site. The “Try It Out” functionality empowers creators to interact with Cloud endpoints in real-time, providing a practical understanding of how these endpoints behave. We hope this will help creators of all levels understand and use Cloud endpoints within the Roblox ecosystem.
How it works
This feature allows you to make real requests using your cookie authentication and returning (or altering) real data.
Be very careful when testing Medium and High risk endpoints, as they can alter real data associated with your account. To help you identify these, there are different alerts in the Creator Hub for each risk level, and some endpoints have “Try It Out” disabled for now (see below).
When you expand a section in Cloud documentation, you will now see the option to “Try It Out” on the right side.
You can toggle your Authentication mode to send authenticated or unauthenticated requests.
You can add and alter parameters for the request, and execute the request to view a real response.
You need to be logged in to attach authentication to requests.
Risk levels
We have classified our Cloud endpoints into risk levels. In general, riskier endpoints are the ones that mutate data, affect owned items, or access sensitive data. To start, these are the risk levels we are using:
Low Risk: Endpoint can read public data.
Medium Risk: Endpoint can create, update, or read non-public data.
High Risk: Endpoint can change or delete non-public data. * “Try It Out” is not currently enabled for high risk endpoints that require authentication. We do provide sample cURL commands for such requests. This is now supported (after accepting an additional warning)
Critical: Endpoint can change or access very sensitive data.
“Try It Out” is not currently enabled for any critical risk endpoints.
What’s Next
We soon plan to add Try It Out functionality for the other endpoints that use API key or OAuth authentication.
We are also considering ways to allow high-risk endpoints to be tested with “Try It Out” without altering your real data. If this would be useful to you, please let us know!
Once we have parity with our legacy API sites, we will redirect from the legacy API sites to Creator Hub so that there is a single source of truth for Roblox endpoints.
Please share any feedback with us below. Thank you!
Our main priority is getting all the apis.roblox.com endpoints documented, but we’ll look into this one (data.roblox.com) you shared as well and see what’s possible. Thanks for sharing that.
Yes, great question, you will see this added in the near future (allowing you to hit endpoints unauthenticated while logged out), it was just not included in this particular initial release.
Thank you thats really nice to know. Because its really useful if we can make our own serializers to e.g export meshes into the Roblox .mesh format and upload it to the CDN directly, bypassing studio’s upload process entirely.
I THINK it’s because we need XSRF/CSRF tokens. I use both of ROBLOX’s normal and Open Cloud endpoints, and the normal API requires a CSRF token (But Open Cloud does not require a CSRF token or cookies)
It’s not a problem, we can do it either way and we already do for cookie requests. We just didn’t include hitting endpoints while logged out in the initial release.
This is great, thanks for finally adding this. However, the lack of sending cookies for “sensitive” endpoints makes no sense as it simply just renders the endpoint useless.
I was eager for this… but I still prefer the old site. Swagger UI is more condensed and easier to read. The new site feels too big and the colors aren’t very prominent.
(Note: I’m using a custom dark theme for Swagger UI)
And it doesn’t help that you can’t even test all of the endpoints here. This isn’t really a replacement for “try it out” when I literally cannot try it out.
I used to frequently make calls to the Avatar API because of Roblox’s default avatar editor not providing all of the functionality I need. Thanks to browser extensions, this isn’t really an issue anymore, but this is just one example.
The new site also doesn’t even list all of the APIs or available endpoints, but to be fair, the old site didn’t either. Apparently this is still being worked on, so if you guys could try to document absolutely everything then that would be great.
Thanks for the feedback, is the avatar outfit update one the only one you’re concerned about or are there others that you frequently try out that are marked as high risk?
Outfits V2 was just one of the first ones I clicked “try it out” on. In general, I’ve used the Avatar API more than any other cloud API, and there seems to be a bunch of other Avatar endpoints that are affected by this.
For other APIs I’ve used besides Avatar: I think most of them are fine, but I also wouldn’t really know for sure unless I check every single endpoint that exists.
I also don’t want to have to try out some random endpoint in the future, only to be suddenly blocked by this new security measure. I think there should really be some way around this for people who actually know what they’re doing, because it kind of defeats the point of having “try it out” in the first place. If it’s truly necessary, maybe require a 2FA prompt or something?
I generally agree that we want to allow as much as possible, but also we have other non-creator concerns, such as avoiding footguns for players that land here or inappropriate phishing usage of these pages by bad actors.
I just discussed with the team and we’re going to reduce the risk level on updating avatar outfits. Feel free to keep posting if you see other endpoints where you feel we are overly cautious.
Also, I’ll forward your feedback on wanting some sort of mode that just allows you to try out everything, but yeah realistically we have some other concerns that we need to worry about as above. I still really appreciate your feedback here though and we’ll discuss it.
Be very careful when testing Medium and High risk endpoints, as they can alter real data associated with your account. To help you identify these, there are different alerts in the Creator Hub for each risk level, and some endpoints have “Try It Out” disabled for now (see below).
