Edit: The endpoint in question appears to be a legacy endpoint that has been replaced by this Open Cloud endpoint. Here is a post that walks through implementing this functionality with Open Cloud.
As stated in the article, “These APIs might change without notice and break your application and do not have the stability guarantees of the newer Open Cloud APIs”. Looks like this may have been exactly what has happened to this legacy endpoint.
The endpoint https://groups.roblox.com/v1/groups/{groupId}/users/{userId} is returning random but frequent “XSRF token invalid” errors for me and a few others I have spoken to. This issue started happening yesterday and has been happening today too. It is hard to reproduce as it does not happen on every request, but it has been popping up a lot in my DigitalOcean server logs and I have been able to reproduce it locally by just making some requests too.
My requests are authenticated properly and interestingly the X-CSRF-TOKEN that is being returned by other endpoints is identical for requests that error and work, as seen below. The token worked to rank someone in my group a few times, then randomly didn’t. The endpoint to request the XSRF token is requested right before making a request to the groups endpoint above, so it should not be invalid within the short time between fetching it and making the request to the groups API.
I noticed that the error appears to happen in waves, e.g. I can make a few requests with no issues and then they suddenly start failing both on my local machine as well as my DigitalOcean server at the same time. Then they start working again together. This rules out the possibility that the cookie is invalid or any possibility that my DigitalOcean server IP has been blocked by Roblox (as I have been able to replicate the issue locally).
At the exact minute I got the errors locally (above), they also appeared on my DigitalOcean server:
Not sure if there is something I am doing wrong when making requests or if Roblox made a change to an API that could affect this. I will note that I have ran this app for months and never seen this issue until yesterday, so seems like something has suddenly changed.