Introducing Webhooks for External Notifications

[kotel2005 (SolidarityWithUA)]

Not sure how it is from a live game, might still need to use a proxy

[LifeDigger (Life)]

@kotel2005

Not sure how it is from a live game

Sorry what? I don’t really understand what your saying there.

@kotel2005

might still need to use a proxy

Well it seems to work to Discord directly without a proxy I tested it myself. Until Roblox is being naughty and bypassing the ban via a proxy

[WaviestBalloon]

This was only for game servers only, I believe that these webhooks are sent from servers that do not host game instances

[rshettyrocks (spaceJetRoss)]

We appreciate the feedback. We will be providing an update in the Webhook documentation page soon to better assist with this.

This is only the beginning, stay tuned for further assistance. We are working on providing a good way to help you automate the process by providing some sample code, Demo and Bots.

[SirMing]

@Hooksmith

It should be noted that GDPR is a complex topic, and many games store their data in many different ways (datastores, external systems, external analytics platforms, loggers that go to Discord/Guilded/etc that may contain PII). It is up to you as developer to properly erase the user data where needed, since we don’t have a way to find and delete relevant data in all the different systems you may be using.

Can’t there be both? Developers who use external systems, analytics platforms and loggers, most likely have the technical knowledge to make use of the Webhooks. For them, this is perfect. But for Developers who solely rely on Roblox services for data storing and analytics, which I assume are the majority of the developers, why can’t Roblox handle this?

Like why can’t there be two solutions:

1. Webhooks - External services
2. Roblox - DataStore

Is it because of redundancy? As in why support both solutions when solution 1 can cover both cases? I can understand this from Roblox’ standpoint. But as a developer, having 2 solutions is much more convenient. Even if I did use external services and knew how to setup Webhooks, I’d still prefer if Roblox handled DataStores because that would mean 1 less platform/service to worry about, support and connect to the Webhooks.

[Hooksmith]

Hey @SirMing as mentioned in my posts above, the release of webhooks today does not mean we won’t ever do more in terms of allowing you to automate right-to-be-forgotten. Thanks for the feedback.

[OverHash]

This is not how it works. Roblox’s ability to process GDPR requests will almost always be greater than another developer’s (as Roblox is bigger than 100% of developers on the platform, and they process GDPR requests when their servers are online). There’s no guarantee that developers’s servers will be available when Roblox processes the GDPR request.

even if your system crashes you can have it automatically reboot within seconds

So what happens if a GDPR request is sent in those few seconds that your system is offline?

The point of redundancy isn’t to handle the 99% case when your server is online to handle the GDPR request, it’s to handle that 1% case when it’s in maintenance, or something unexpected happens. Even if there is only one unhandled GDPR request because of a lack of redundancy, that’s a failed system in this case.

There has to be a method of redundancy, whether it be as simple as relying on 3rd party platforms to cover the gap in server uptime or a method such as Roblox PMs to handle missed requests.

[DismayingObservation]

We should be able to get a list of the most recent 10 or 50 or whatever number GDPR removal requests. Each removal request has a unique ID. Once our software gets the list and performs the deletion, we send a POST back along with the IDs that we’ve completed.

Then the next time we request a list of removal requests, the ones we affirmatively marked as completed are gone and we only get ones we haven’t marked as deleted.

This way, there’s no chance of downtime causing us to miss a request.

Note that this can be implemented now by a developer using the PM system but… There’s a ton of security problems with deploying a program that has access to your entire account onto a remote server. We should be able to create a special API key that only has permission to view unmarked removal requests.

[promoter3 (DV_FileTheVast)]

I am not sure how this is actually going to help.
Are you able to send custom messages other than the erase and test message, this message:

Example Image

If you can only do this and the data erase, it is not really useful.
I am not sure if I have fully understood this though (Feel free to correct me).

Thanks - promoter3

[OverHash]

Agreed that this is a much more robust solution than webhook events, but we’re certainly taking a step in the right direction with this release.

[MuffinHandler]

What if you made an event listener that is hooked up to when GDPR removal is requested?

It could be something like this:

game:GetService("DataRemovalService").RemovalRequest:Connect(function()
    --Experience developer applies removal logic for removing data from datastores
end)

[kotel2005 (SolidarityWithUA)]

Very naughty Roblox, bypassing a ban is a big no-no!

[emilaltg]

Video wont work

Anyways, I tried it out and it’s alright. Can’t wait to see how this is used.

[XxdarksidemarcoxX (GYATTSCOUTER3050)]

@Maxi130TV

local WebhooksService = game:GetService("WebhookService")
WebhooksService.onGDRPRequest:Connect(function(id)
DataStore:RemoveAsync(id)
end)

Is webhookservice a thing? For me, it doesn’t show that it’s a service

[Mimibienv (Eldritch)]

Why is the documentation so bad and hard to understand ?

[Dede_4242]

That’s because he made an example of how it could be

[XxdarksidemarcoxX (GYATTSCOUTER3050)]

Oh, so there is no actual use for it in game at this moment?

[Dede_4242]

It doesn’t exist (currently). .

[XxdarksidemarcoxX (GYATTSCOUTER3050)]

Hope it gets added soon because i’ll add it to my admin commands

[rshettyrocks (spaceJetRoss)]

Webhooks is a powerful tool to receive notification in the communication channel of your choice and also for purposes of automation based on the information we send.
Webhooks provide you a way to receive the notification in any 3rd party communication channels.

Discord Reference: If you want to receive the notification on Discord. Please configure incoming webhooks by following the steps here: https://support.discord.com/hc/en-us/articles/228383668-Intro-to-Webhooks. Once you get the URL from the steps above, you can use that URL in the Webhook URL field in the configuration page https://create.roblox.com/dashboard/settings/webhooks when you “Add Webhook”.

Slack Reference: Follow the steps as seen here → Sending messages using Incoming Webhooks | Slack
and use that URL when you add a Webhook configuration in https://create.roblox.com/dashboard/settings/webhooks

Guilded Reference: Follow the Step 1 to configure Guilded webhooks as seen here: https://support.guilded.gg/hc/en-us/articles/360038927934-Incoming-Webhooks
Whatever URL you get from the link above use that as input to Webhook URL field when you add the Webhook Configuration.

You should then receive all the notifications we send on Discord, Guilded or Slack.

If you want to receive notification on your own server: then you will have to bring up an http service. Example: You could use tools like ngrok for the purposes of receiving notification: Getting Started | ngrok documentation → you can bring up a local server Reference: GitHub Repository Webhooks | ngrok documentation (Steps 1 and 2) and get the public URL which can be used Add webhook configurations.

The purpose is to receive the notification is the communication channels of your choice or if you want to automate based on the data that we send across.

GDPR use case (Right To Erasure Request) is the first of the notification types that we have supported. We will be adding many more soon.

We are working on improving the documentation. We should have new updates next week. Stay tuned for many more updates on this feature in the future.