Roblox Data Stewardship Principles & Cookie-based API Update

Updates Announcements
, , ,
1

Hello Creators,

Our goal is to protect user data privacy across the platform while enabling creators to build engaging games that are safe and within policy.

Today, we’re sharing our principles on data stewardship: how user platform data needs to be safeguarded. We define platform-level user data as data that is surfaced within Roblox’s website and application, including:

  • Usernames (including history), User ID
  • Descriptions (profile about bio), social links, avatar information
  • Information about activity, including active dates and badge ownership
  • Friends, followers, community memberships
  • Posts, messages, social affinities (votes)

We are also sharing plans for changes to cookie-based APIs and policy updates guided by these principles. This includes removing unauthenticated access for sensitive endpoints, reducing rate limits to proper human-usage levels, sunsetting endpoints no longer in use, and updating our policies (details below).

Lastly, thanks to your feedback, we have plans for additional Open Cloud capabilities in the works as alternatives to cookie-based APIs. We have heard of several use cases on how the community would like to use Open Cloud, and we are excited to share our plans later this year.

Data Stewardship Principles

This is how we’re thinking about user data and respective rights and responsibilities amongst users, creators, and Roblox:

1. Users are in control of their data.

Users control their data and can access, manage, and obtain their data on Roblox. Users can make requests about their data directly to creators of games. Users may allow games to access their platform-level data through official Roblox-supported channels (i.e., Engine and Open Cloud APIs). Users may revoke grants from games.

Example: Users may choose to share their obtained badges on their profile via an account setting.

2. Creators are responsible for the user data they collect.

Creators are responsible for ensuring their use of user data abides by Roblox policies and that they respect user rights. Creators may programmatically gather platform-level user data as long as they have consent from the user and may only access user data through official Roblox-supported channels.

Example: Creators looking to access User Badge data may do so via BadgeService. Creators are responsible for user data they have collected within Data Stores.

3. Creators control data used to build their games.

Creators control their game data and assets. Creators may not access data of games that they do not control, unless they obtain consent from the game’s owner and only access data through official Roblox-supported channels.

Example: Creators are not allowed to pull other games’ Badge data through unofficial means.

4. Roblox has a responsibility to protect user and creator data.

Roblox is the steward of platform-level user data. Roblox is responsible for protecting the Roblox service and platform-level user data.

Example: Roblox made updates to Badges APIs to mitigate the risk of the data being used to track users.

5. Significant platform changes will have advance notification.

Roblox’s goal is to make the platform more safe, scalable, easy to use, and accessible for building new games. In the event that we make significant changes to the platform, our principle is to provide as much advance notice as we can before rolling out the changes.

Example: Badge privacy changes had a 1-month advanced notice time.

Cookie-based API Updates

We know many creators use unofficial cookie-based APIs for automation and custom features, which we respect. Cookie-based APIs are officially for supporting Roblox website and application surface usage by humans only. In order for Roblox to protect user data, we will be progressively reducing the ease by which user data can be scraped from cookie-based APIs.

Changes include:

  • Removing unauthenticated access
  • Set rate limits for appropriate human use (typically reducing, but in some cases may be increasing)
  • Sunsetting endpoints

Additionally, we do not recommend them for production due to their instability for programmatic use cases. We’ve previously shared that cookie-based APIs “can incorporate breaking changes without notice, and have minimal stability guarantees.”

View the full set of cookie-based API changes in plan below. Early updates to APIs with inventory and badges have already been launched. We will update this list as new API plans are defined and ready for sharing.

What actions should I take as a Creator?

The official supported method of accessing data continues to be with Engine and Open Cloud APIs. These APIs have stability guarantees and scale with your games. We will continue to improve Open Cloud coverage as we identify allowed use cases and will keep you updated on this, so you can migrate away from unofficial APIs as soon as use cases that fall within our policies are fully supported.

Policy Updates

We will be updating our policies to reflect these principles in the next few months, some of which built on existing policies. At a high-level, our updates will cover who gets access to data, how they should access it, for what purposes, and other guardrails to ensure user privacy. Here are the two types of changes we are working towards:

  1. Creators are not allowed to use data for user tracking (e.g., deriving a history of which games a user has visited via Badges).

  2. Creators are not allowed to mine and derive user profile data (e.g., deriving a user’s connections social graph, whether a user is a creator, etc). This is an extension of our Third-Party App Policy.

We are open to your feedback

Our principles are first and foremost to provide a safer privacy-centric ecosystem for our community. We understand this represents a considerable shift from the existing game and may pose short-term difficulties. However, we are providing advance notice because we believe these updates are vital for protecting user privacy.

Creator Services team

FAQ

What is unauthenticated?

  • Unauthenticated refers to APIs that are open to the public. In other words, these APIs are accessed even when a user is not logged into Roblox, and may still gather data.

Is there a page or document by which we can reference these principles?

  • Principles have typically been shared and live in DevForum posts. This allows for easy referencing, updates, and a history of community discussions.

Cookie-Based APIs Plan Details


`GET https://apis.roblox.com/activity-feed-api/v1/history`

**Date**: Already Implemented

**Changes**:
- Cookie: 100 rpm (from 1000 rpm)

---

`GET https://apis.roblox.com/activity-feed-api/v1/orgs/history`

**Date**: Already Implemented

**Changes**:
- Cookie: 100 rpm (from 1000 rpm)

---

`POST https://apis.roblox.com/user-blocking-api/v1/users/{userId}/block-user`

**Date**: Already Implemented

**Changes**:
- Cookie: 3 rpm (from 10 rpm)

---

`POST https://apis.roblox.com/creator-home-api/v1/groups/{groupId}/homepage/banner/disable`

**Date**: 4 May '26

**Changes**:
- Cookie: 10 rpm (from 6000 rpm)

---

`POST https://apis.roblox.com/creator-home-api/v1/users/{userId}/homepage/banner/disable`

**Date**: 4 May '26

**Changes**:
- Cookie: 10 rpm (from 6000 rpm)

---

`GET https://apis.roblox.com/creator-home-api/v1/users/{userId}/homepage/content`

**Date**: 4 May '26

**Changes**:
- Cookie: 120 rpm (from 6000 rpm)

---

`PUT https://apis.roblox.com/creator-notifications/v1/creator-stream-notifications/users/{userId}/notification/{notificationId}`

**Date**: 4 May '26

**Changes**:
- Cookie: 30 rpm (from 1000 rpm)

---

`GET https://apis.roblox.com/creator-notifications/v1/creator-stream-notifications/users/{userId}/notifications`

**Date**: 4 May '26

**Changes**:
- Cookie: 120 rpm (from 1000 rpm)

---

`PUT https://apis.roblox.com/creator-notifications/v1/creator-stream-notifications/users/{userId}/notifications`

**Date**: 4 May '26

**Changes**:
- Cookie: 30 rpm (from 1000 rpm)

---

`PATCH https://apis.roblox.com/creator-settings/v1/notifications/settings`

**Date**: 4 May '26

**Changes**:
- Cookie: 30 rpm (from 1000 rpm)

---

`POST https://apis.roblox.com/creator-settings/v1/notifications/settings`

**Date**: 4 May '26

**Changes**:
- Cookie: 30 rpm (from 1000 rpm)

---

`PATCH https://apis.roblox.com/creator-settings/v1/settings`

**Date**: 4 May '26

**Changes**:
- Cookie: 30 rpm (from 1000 rpm)

---

`POST https://apis.roblox.com/creator-settings/v1/settings`

**Date**: 4 May '26

**Changes**:
- Cookie: 30 rpm (from 1000 rpm)

---

`GET https://apis.roblox.com/creator-settings/v2/settings/user/{user_id}`

**Date**: 4 May '26

**Changes**:
- Cookie: 120 rpm (from 1000 rpm)

---

`GET https://apis.roblox.com/creator-settings/v2/settings/user/{user_id}/setting/{setting_name}`

**Date**: 4 May '26

**Changes**:
- Cookie: 120 rpm (from 1000 rpm)

---

`PATCH https://apis.roblox.com/creator-settings/v2/settings/user/{user_id}/setting/{setting_name}`

**Date**: 4 May '26

**Changes**:
- Cookie: 30 rpm (from 1000 rpm)

---

`GET https://apis.roblox.com/creator-teams/v1/groups/{groupId}`

**Date**: 4 May '26

**Changes**:
- Cookie: 120 rpm (from 1000 rpm)

---

`POST https://apis.roblox.com/creator-teams/v1/teams`

**Date**: 4 May '26

**Changes**:
- Cookie: 10 rpm (from 1000 rpm)

---

`GET https://apis.roblox.com/creator-teams/v1/teams/contents`

**Date**: 4 May '26

**Changes**:
- Cookie: 120 rpm (from 1000 rpm)

---

`POST https://apis.roblox.com/creator-teams/v1/teams/groupIds`

**Date**: 4 May '26

**Changes**:
- Cookie: 10 rpm (from 1000 rpm)

---

`POST https://apis.roblox.com/creator-teams/v1/teams/media`

**Date**: 4 May '26

**Changes**:
- Cookie: 30 rpm (from 1000 rpm)

---

`DELETE https://apis.roblox.com/creator-teams/v1/teams/{teamId}`

**Date**: 4 May '26

**Changes**:
- Cookie: 10 rpm (from 1000 rpm)

---

`GET https://apis.roblox.com/creator-teams/v1/teams/{teamId}`

**Date**: 4 May '26

**Changes**:
- Cookie: 120 rpm (from 1000 rpm)

---

`PATCH https://apis.roblox.com/creator-teams/v1/teams/{teamId}`

**Date**: 4 May '26

**Changes**:
- Cookie: 10 rpm (from 1000 rpm)

---

`PATCH https://apis.roblox.com/creator-teams/v1/teams/{teamId}/contents`

**Date**: 4 May '26

**Changes**:
- Cookie: 30 rpm (from 1000 rpm)

---

`GET https://apis.roblox.com/creator-teams/v1/teams/{teamId}/groupId`

**Date**: 4 May '26

**Changes**:
- Cookie: 120 rpm (from 1000 rpm)

---

`GET https://apis.roblox.com/creator-teams/v1/teams/{teamId}/users`

**Date**: 4 May '26

**Changes**:
- Cookie: 120 rpm (from 1000 rpm)

---

`POST https://apis.roblox.com/creator-teams/v1/teams/{teamId}/users`

**Date**: 4 May '26

**Changes**:
- Cookie: 10 rpm (from 1000 rpm)

---

`POST https://apis.roblox.com/creator-teams/v1/teams/{teamId}/users/delete`

**Date**: 4 May '26

**Changes**:
- Cookie: 10 rpm (from 1000 rpm)

---

`DELETE https://apis.roblox.com/creator-teams/v1/teams/{teamId}/users/{userId}`

**Date**: 4 May '26

**Changes**:
- Cookie: 10 rpm (from 1000 rpm)

---

`GET https://apis.roblox.com/creator-teams/v1/users/{userId}/teams`

**Date**: 4 May '26

**Changes**:
- Cookie: 120 rpm (from 1000 rpm)

---

`GET https://apis.roblox.com/marketplace-fiat-service/v1/prices/{productNamespace}/{productType}`

**Date**: 4 May '26

**Changes**:
- Unauth: 240 rpm (from 10000 rpm)

---

`GET https://apis.roblox.com/oauth/v1/groups/{groupId}/applications`

**Date**: 4 May '26

**Changes**:
- Cookie: 120 rpm (from 1000 rpm)

---

`POST https://apis.roblox.com/oauth/v1/groups/{groupId}/applications`

**Date**: 4 May '26

**Changes**:
- Cookie: 10 rpm (from 1000 rpm)

---

`GET https://apis.roblox.com/orgs/v1/organizations`

**Date**: 4 May '26

**Changes**:
- Cookie: 120 rpm (from 1000 rpm)

---

`POST https://apis.roblox.com/orgs/v1/organizations`

**Date**: 4 May '26

**Changes**:
- Cookie: 10 rpm (from 1000 rpm)

---

`GET https://apis.roblox.com/orgs/v1/organizations/{organizationId}/invitations`

**Date**: 4 May '26

**Changes**:
- Cookie: 120 rpm (from 1000 rpm)

---

`POST https://apis.roblox.com/orgs/v1/organizations/{organizationId}/invitations`

**Date**: 4 May '26

**Changes**:
- Cookie: 30 rpm (from 1000 rpm)

---

`DELETE https://apis.roblox.com/orgs/v1/organizations/{organizationId}/invitations/{invitationId}`

**Date**: 4 May '26

**Changes**:
- Cookie: 30 rpm (from 1000 rpm)

---

`GET https://apis.roblox.com/orgs/v1/organizations/{organizationId}/invitations/{invitationId}`

**Date**: 4 May '26

**Changes**:
- Cookie: 120 rpm (from 1000 rpm)

---

`PATCH https://apis.roblox.com/orgs/v1/organizations/{organizationId}/invitations/{invitationId}`

**Date**: 4 May '26

**Changes**:
- Cookie: 30 rpm (from 1000 rpm)

---

`GET https://apis.roblox.com/orgs/v1/organizations/{organizationId}/invitations/{invitationId}/roleIds`

**Date**: 4 May '26

**Changes**:
- Cookie: 120 rpm (from 1000 rpm)

---

`GET https://apis.roblox.com/orgs/v1/organizations/{organizationId}/payouts/universes`

**Date**: 4 May '26

**Changes**:
- Cookie: 120 rpm (from 1000 rpm)

---

`GET https://apis.roblox.com/orgs/v1/organizations/{organizationId}/payouts/{universeId}`

**Date**: 4 May '26

**Changes**:
- Cookie: 120 rpm (from 1000 rpm)

---

`PATCH https://apis.roblox.com/orgs/v1/organizations/{organizationId}/payouts/{universeId}`

**Date**: 4 May '26

**Changes**:
- Cookie: 30 rpm (from 1000 rpm)

---

`GET https://apis.roblox.com/orgs/v1/organizations/{organizationId}/roles`

**Date**: 4 May '26

**Changes**:
- Cookie: 120 rpm (from 1000 rpm)

---

`POST https://apis.roblox.com/orgs/v1/organizations/{organizationId}/roles`

**Date**: 4 May '26

**Changes**:
- Cookie: 30 rpm (from 1000 rpm)

---

`DELETE https://apis.roblox.com/orgs/v1/organizations/{organizationId}/roles/{roleId}`

**Date**: 4 May '26

**Changes**:
- Cookie: 30 rpm (from 1000 rpm)

---

`GET https://apis.roblox.com/orgs/v1/organizations/{organizationId}/roles/{roleId}/invitations`

**Date**: 4 May '26

**Changes**:
- Cookie: 120 rpm (from 1000 rpm)

---

`GET https://apis.roblox.com/orgs/v1/organizations/{organizationId}/roles/{roleId}/metadata`

**Date**: 4 May '26

**Changes**:
- Cookie: 120 rpm (from 1000 rpm)

---

`PATCH https://apis.roblox.com/orgs/v1/organizations/{organizationId}/roles/{roleId}/metadata`

**Date**: 4 May '26

**Changes**:
- Cookie: 30 rpm (from 1000 rpm)

---

`PATCH https://apis.roblox.com/orgs/v1/organizations/{organizationId}/roles/{roleId}/position`

**Date**: 4 May '26

**Changes**:
- Cookie: 30 rpm (from 1000 rpm)

---

`GET https://apis.roblox.com/orgs/v1/organizations/{organizationId}/roles/{roleId}/users`

**Date**: 4 May '26

**Changes**:
- Cookie: 120 rpm (from 1000 rpm)

---

`GET https://apis.roblox.com/orgs/v1/organizations/{organizationId}/users`

**Date**: 4 May '26

**Changes**:
- Cookie: 120 rpm (from 1000 rpm)

---

`DELETE https://apis.roblox.com/orgs/v1/organizations/{organizationId}/users/{userId}`

**Date**: 4 May '26

**Changes**:
- Cookie: 60 rpm (from 1000 rpm)

---

`POST https://apis.roblox.com/orgs/v1/organizations/{organizationId}/users/{userId}`

**Date**: 4 May '26

**Changes**:
- Cookie: 60 rpm (from 1000 rpm)

---

`GET https://apis.roblox.com/orgs/v1/organizations/{organizationId}/users/{userId}/invitations`

**Date**: 4 May '26

**Changes**:
- Cookie: 120 rpm (from 1000 rpm)

---

`GET https://apis.roblox.com/orgs/v1/organizations/{organizationId}/users/{userId}/permissions`

**Date**: 4 May '26

**Changes**:
- Cookie: 120 rpm (from 1000 rpm)

---

`GET https://apis.roblox.com/orgs/v1/organizations/{organizationId}/users/{userId}/roles`

**Date**: 4 May '26

**Changes**:
- Cookie: 120 rpm (from 1000 rpm)

---

`DELETE https://apis.roblox.com/orgs/v1/organizations/{organizationId}/users/{userId}/roles/{roleId}`

**Date**: 4 May '26

**Changes**:
- Cookie: 60 rpm (from 1000 rpm)

---

`POST https://apis.roblox.com/orgs/v1/organizations/{organizationId}/users/{userId}/roles/{roleId}`

**Date**: 4 May '26

**Changes**:
- Cookie: 60 rpm (from 1000 rpm)

---

`GET https://apis.roblox.com/orgs/v2/organizations/{organizationId}/roles/{roleId}/permissions`

**Date**: 4 May '26

**Changes**:
- Cookie: 120 rpm (from 1000 rpm)

---

`POST https://apis.roblox.com/orgs/v2/organizations/{organizationId}/roles/{roleId}/permissions`

**Date**: 4 May '26

**Changes**:
- Cookie: 30 rpm (from 1000 rpm)

---

`POST https://apis.roblox.com/ownership-transfer/v1/transfers`

**Date**: 4 May '26

**Changes**:
- Cookie: 10 rpm (from 100 rpm)

---

`POST https://apis.roblox.com/ownership-transfer/v1/transfers/accept`

**Date**: 4 May '26

**Changes**:
- Cookie: 10 rpm (from 100 rpm)

---

`POST https://apis.roblox.com/ownership-transfer/v1/transfers/acknowledge`

**Date**: 4 May '26

**Changes**:
- Cookie: 10 rpm (from 100 rpm)

---

`POST https://apis.roblox.com/ownership-transfer/v1/transfers/cancel`

**Date**: 4 May '26

**Changes**:
- Cookie: 10 rpm (from 100 rpm)

---

`POST https://apis.roblox.com/ownership-transfer/v1/transfers/invalidTargets`

**Date**: 4 May '26

**Changes**:
- Cookie: 10 rpm (from 100 rpm)

---

`POST https://apis.roblox.com/ownership-transfer/v1/transfers/reject`

**Date**: 4 May '26

**Changes**:
- Cookie: 10 rpm (from 100 rpm)

---

`POST https://apis.roblox.com/ownership-transfer/v1/transfers/resource`

**Date**: 4 May '26

**Changes**:
- Cookie: 10 rpm (from 100 rpm)

---

`GET https://apis.roblox.com/ownership-transfer/v1/users/permissibleGroups`

**Date**: 4 May '26

**Changes**:
- Cookie: 120 rpm (from 100 rpm)

---

`GET https://apis.roblox.com/talent/v1/authorized`

**Date**: 4 May '26

**Changes**:
- Cookie: 120 rpm (from 1000 rpm)

---

`GET https://apis.roblox.com/talent/v1/chat/get-conversation`

**Date**: 4 May '26

**Changes**:
- Cookie: 120 rpm (from 1000 rpm)

---

`GET https://apis.roblox.com/talent/v1/chat/get-conversations-by-job`

**Date**: 4 May '26

**Changes**:
- Cookie: 120 rpm (from 1000 rpm)

---

`GET https://apis.roblox.com/talent/v1/chat/get-conversations-by-user`

**Date**: 4 May '26

**Changes**:
- Cookie: 120 rpm (from 1000 rpm)

---

`GET https://apis.roblox.com/talent/v1/chat/get-messages`

**Date**: 4 May '26

**Changes**:
- Cookie: 120 rpm (from 1000 rpm)

---

`GET https://apis.roblox.com/talent/v1/chat/multi-get-latest-messages`

**Date**: 4 May '26

**Changes**:
- Cookie: 120 rpm (from 1000 rpm)

---

`POST https://apis.roblox.com/talent/v1/chat/send-message`

**Date**: 4 May '26

**Changes**:
- Cookie: 30 rpm (from 1000 rpm)

---

`POST https://apis.roblox.com/talent/v1/chat/start-conversation`

**Date**: 4 May '26

**Changes**:
- Cookie: 10 rpm (from 1000 rpm)

---

`GET https://apis.roblox.com/talent/v1/jobs/media`

**Date**: 4 May '26

**Changes**:
- Cookie: 120 rpm (from 1000 rpm)

---

`POST https://apis.roblox.com/talent/v1/search/creators`

**Date**: 4 May '26

**Changes**:
- Cookie: 60 rpm (from 1000 rpm)

---

`GET https://apis.roblox.com/talent/v1/team/{teamId}/reports`

**Date**: 4 May '26

**Changes**:
- Cookie: 120 rpm (from 1000 rpm)

---

`GET https://apis.roblox.com/talent/v1/teams/authorized`

**Date**: 4 May '26

**Changes**:
- Cookie: 120 rpm (from 1000 rpm)

---

`GET https://apis.roblox.com/talent/v1/teams/{teamId}`

**Date**: 4 May '26

**Changes**:
- Cookie: 120 rpm (from 1000 rpm)

---

`PATCH https://apis.roblox.com/talent/v1/teams/{teamId}`

**Date**: 4 May '26

**Changes**:
- Cookie: 10 rpm (from 1000 rpm)

---

`GET https://apis.roblox.com/talent/v1/users/advanced`

**Date**: 4 May '26

**Changes**:
- Cookie: 120 rpm (from 1000 rpm)

---

`GET https://apis.roblox.com/talent/v1/users/media`

**Date**: 4 May '26

**Changes**:
- Cookie: 120 rpm (from 1000 rpm)

---

`GET https://apis.roblox.com/talent/v1/users/verification`

**Date**: 4 May '26

**Changes**:
- Cookie: 120 rpm (from 1000 rpm)

---

`GET https://apis.roblox.com/talent/v1/users/{userId}/applications`

**Date**: 4 May '26

**Changes**:
- Cookie: 120 rpm (from 1000 rpm)

---

`POST https://apis.roblox.com/talent/v1/users/{userId}/applications`

**Date**: 4 May '26

**Changes**:
- Cookie: 10 rpm (from 1000 rpm)

---

`GET https://apis.roblox.com/talent/v1/users/{userId}/experiences`

**Date**: 4 May '26

**Changes**:
- Cookie: 120 rpm (from 1000 rpm)

---

`POST https://apis.roblox.com/talent/v1/users/{userId}/experiences`

**Date**: 4 May '26

**Changes**:
- Cookie: 30 rpm (from 1000 rpm)

---

`GET https://apis.roblox.com/talent/v1/users/{userId}/jobs`

**Date**: 4 May '26

**Changes**:
- Cookie: 120 rpm (from 1000 rpm)

---

`POST https://apis.roblox.com/talent/v1/users/{userId}/jobs`

**Date**: 4 May '26

**Changes**:
- Cookie: 10 rpm (from 1000 rpm)

---

`POST https://apis.roblox.com/talent/v1/users/{userId}/media`

**Date**: 4 May '26

**Changes**:
- Cookie: 30 rpm (from 1000 rpm)

---

`GET https://apis.roblox.com/talent/v1/users/{userId}/profile`

**Date**: 4 May '26

**Changes**:
- Cookie: 120 rpm (from 1000 rpm)

---

`PATCH https://apis.roblox.com/talent/v1/users/{userId}/profile`

**Date**: 4 May '26

**Changes**:
- Cookie: 30 rpm (from 1000 rpm)

---

`GET https://apis.roblox.com/talent/v1/users/{userId}/reports`

**Date**: 4 May '26

**Changes**:
- Cookie: 120 rpm (from 1000 rpm)

---

`GET https://apis.roblox.com/talent/v1/warnings`

**Date**: 4 May '26

**Changes**:
- Cookie: 120 rpm (from 1000 rpm)

---

`POST https://apis.roblox.com/talent/v1/warnings/acknowledge`

**Date**: 4 May '26

**Changes**:
- Cookie: 10 rpm (from 1000 rpm)

---

`GET https://apis.roblox.com/talent/v2/chat/get-conversation`

**Date**: 4 May '26

**Changes**:
- Cookie: 120 rpm (from 1000 rpm)

---

`GET https://apis.roblox.com/talent/v2/chat/get-conversations-by-job`

**Date**: 4 May '26

**Changes**:
- Cookie: 120 rpm (from 1000 rpm)

---

`GET https://apis.roblox.com/talent/v2/chat/get-conversations-by-user`

**Date**: 4 May '26

**Changes**:
- Cookie: 120 rpm (from 1000 rpm)

---

`GET https://apis.roblox.com/talent/v2/chat/get-messages`

**Date**: 4 May '26

**Changes**:
- Cookie: 120 rpm (from 1000 rpm)

---

`GET https://apis.roblox.com/talent/v2/chat/multi-get-latest-messages`

**Date**: 4 May '26

**Changes**:
- Cookie: 120 rpm (from 1000 rpm)

---

`POST https://apis.roblox.com/talent/v2/chat/send-message`

**Date**: 4 May '26

**Changes**:
- Cookie: 30 rpm (from 1000 rpm)

---

`POST https://apis.roblox.com/talent/v2/chat/start-conversation`

**Date**: 4 May '26

**Changes**:
- Cookie: 10 rpm (from 1000 rpm)

---

`GET https://apis.roblox.com/webhook-configuration/v1/groups/{groupId}/webhooks`

**Date**: 4 May '26

**Changes**:
- Cookie: 60 rpm (from 1000 rpm)

---

`POST https://apis.roblox.com/webhook-configuration/v1/groups/{groupId}/webhooks`

**Date**: 4 May '26

**Changes**:
- Cookie: 30 rpm (from 1000 rpm)

---

`GET https://apis.roblox.com/webhook-configuration/v1/users/{userId}/webhooks`

**Date**: 4 May '26

**Changes**:
- Cookie: 60 rpm (from 1000 rpm)

---

`POST https://apis.roblox.com/webhook-configuration/v1/users/{userId}/webhooks`

**Date**: 4 May '26

**Changes**:
- Cookie: 30 rpm (from 1000 rpm)

---

`GET https://voice.roblox.com/v2/rcc/getroomserver/`

**Date**: 4 May '26

**Changes**:
- Unauthenticated access removed.
- Planned to be deprecated.

---

`POST https://voice.roblox.com/v2/rcc/mpspipelinecleanup/`

**Date**: 4 May '26

**Changes**:
- Unauthenticated access removed.
- Planned to be deprecated.

---

`POST https://voice.roblox.com/v2/rcc/mpspipelinesetup/`

**Date**: 4 May '26

**Changes**:
- Unauthenticated access removed.
- Planned to be deprecated.

---

`POST https://voice.roblox.com/v2/rcc/recordmetadataevent/`

**Date**: 4 May '26

**Changes**:
- Unauthenticated access removed.
- Planned to be deprecated.

---

`GET https://voice.roblox.com/v2/turn/auth/`

**Date**: 4 May '26

**Changes**:
- Unauthenticated access removed.
- Planned to be deprecated.

---

`GET https://badges.roblox.com/v1/users/{userId}/badges`

**Date**: 4 May '26

**Changes**:
- Unauthenticated access removed.
- Cookie: 100 rpm (from 1000 rpm)

**Open Cloud and Engine options**:
- [Cloud API](https://create.roblox.com/docs/cloud/reference/features/inventories#Cloud_ListInventoryItems)

---

`GET https://develop.roblox.com/v1/groups/{groupId}/universes`

**Date**: 4 May '26

**Changes**:
- Unauth: 1000 rpm (from 10000 rpm)
- Cookie: 100 rpm (from 1000 rpm)

---

`GET https://groups.roblox.com/v0/groups/{groupId}`

**Date**: 4 May '26

**Changes**:
- Unauthenticated access removed.

---

`GET https://groups.roblox.com/v0/groups/{groupId}/relationships`

**Date**: 4 May '26

**Changes**:
- Unauthenticated access removed.

---

`GET https://groups.roblox.com/v0/users/{userId}/groups`

**Date**: 4 May '26

**Changes**:
- Unauthenticated access removed.

---

`PATCH https://groups.roblox.com/v1/groups/icon`

**Date**: 4 May '26

**Changes**:
- Cookie: 20 rpm (from 100 rpm)

---

`DELETE https://groups.roblox.com/v1/groups/{groupId}/blocked-keywords/{keywordId}`

**Date**: 4 May '26

**Changes**:
- Cookie: 75 rpm (from 100 rpm)

---

`PATCH https://groups.roblox.com/v1/groups/{groupId}/description`

**Date**: 4 May '26

**Changes**:
- Cookie: 60 rpm (from 100 rpm)

**Open Cloud and Engine options**:
- [Cloud API](https://create.roblox.com/docs/cloud/reference/features/groups#patch_legacy_groups_v1_groups__groupId__description)

---

`GET https://groups.roblox.com/v1/groups/{groupId}/join-requests`

**Date**: 4 May '26

**Changes**:
- Cookie: 100 rpm (from 120 rpm)

**Open Cloud and Engine options**:
- [Cloud API](https://create.roblox.com/docs/cloud/reference/features/groups#Cloud_ListGroupJoinRequests)

---

`GET https://groups.roblox.com/v1/groups/{groupId}/membership`

**Date**: 4 May '26

**Changes**:
- Unauthenticated access removed.

**Open Cloud and Engine options**:
- [Cloud API](https://create.roblox.com/docs/cloud/reference/features/groups#Cloud_ListGroupJoinRequests)
- [Cloud API](https://create.roblox.com/docs/cloud/reference/features/groups#Cloud_GetGroupRole)

---

`GET https://groups.roblox.com/v1/groups/{groupId}/name-history`

**Date**: 4 May '26

**Changes**:
- Unauth: 100 rpm (from 120 rpm)

---

`GET https://groups.roblox.com/v1/groups/{groupId}/roles/permissions`

**Date**: 4 May '26

**Changes**:
- Cookie: 100 rpm (from 120 rpm)

**Open Cloud and Engine options**:
- [Cloud API](https://create.roblox.com/docs/cloud/reference/features/groups#Cloud_ListGroupRoles)

---

`GET https://groups.roblox.com/v1/groups/{groupId}/roles/{roleSetId}/permissions`

**Date**: 4 May '26

**Changes**:
- Cookie: 90 rpm (from 120 rpm)

**Open Cloud and Engine options**:
- [Cloud API](https://create.roblox.com/docs/cloud/reference/features/groups#Cloud_ListGroupRoles)

---

`DELETE https://groups.roblox.com/v1/groups/{groupId}/rolesets/{rolesetId}`

**Date**: 4 May '26

**Changes**:
- Cookie: 100 rpm (from 1000 rpm)

---

`GET https://groups.roblox.com/v1/groups/{groupId}/social-links`

**Date**: 4 May '26

**Changes**:
- Cookie: 100 rpm (from 300 rpm)

**Open Cloud and Engine options**:
- [Cloud API](https://create.roblox.com/docs/cloud/reference/features/groups#Cloud_GetGroup)

---

`PATCH https://groups.roblox.com/v1/groups/{groupId}/users/{userId}`

**Date**: 4 May '26

**Changes**:
- Cookie: 50 rpm (from 500 rpm)

**Open Cloud and Engine options**:
- [Cloud API](https://create.roblox.com/docs/cloud/reference/features/groups#Cloud_UpdateGroupMembership)

---

`POST https://apis.roblox.com/user-blocking-api/v1/users/batch-check-reciprocal-block`

**Date**: 4 May '26

**Changes**:
- Cookie: 100 rpm (from 200 rpm)

---

`GET https://apis.roblox.com/user-blocking-api/v1/users/get-blocked-users`

**Date**: 4 May '26

**Changes**:
- Cookie: 100 rpm (from 200 rpm)

---

`GET https://apis.roblox.com/user-blocking-api/v1/users/{userId}/is-blocked`

**Date**: 4 May '26

**Changes**:
- Cookie: 100 rpm (from 200 rpm)

---

`GET https://badges.roblox.com/v1/users/{userId}/badges/awarded-dates`

**Date**: 4 May '26

**Changes**:
- Unauthenticated access removed.
- BadgeService Engine APIs: The user must be in the game OR the request must be for a badge awarded by the current game for it to be included in the response.
HTTP cookie API:  Only badges the requesting user has permission to view will be included in the response. This respects the Inventory Privacy settings of the target user.

https://devforum.roblox.com/t/upcoming-breaking-change-to-checkuserbadgesasync-userhasbadgeasync-and-badges-web-apis/4438920

**Open Cloud and Engine options**:
- [BadgeService Engine API](https://create.roblox.com/docs/reference/engine/classes/BadgeService#CheckUserBadgesAsync)
- [Cloud API](https://create.roblox.com/docs/cloud/reference/features/inventories#Cloud_ListInventoryItems)

---

`GET https://badges.roblox.com/v1/users/{userId}/badges/{badgeId}/awarded-date`

**Date**: 4 May '26

**Changes**:
- Unauthenticated access removed.
- BadgeService Engine APIs: The user must be in the game OR the request must be for a badge awarded by the current game for it to be included in the response.
HTTP cookie API:  Only badges the requesting user has permission to view will be included in the response. This respects the Inventory Privacy settings of the target user.

https://devforum.roblox.com/t/upcoming-breaking-change-to-checkuserbadgesasync-userhasbadgeasync-and-badges-web-apis/4438920

**Open Cloud and Engine options**:
- [BadgeService Engine API](https://create.roblox.com/docs/reference/engine/classes/BadgeService#UserHasBadgeAsync)
- [Cloud API](https://create.roblox.com/docs/cloud/reference/features/inventories#Cloud_ListInventoryItems)

---

`GET https://friends.roblox.com/v1/my/friends/count/`

**Date**: 4 May '26

**Changes**:
- Cookie: 100 rpm (from 10000 rpm)

---

`GET https://friends.roblox.com/v1/my/friends/requests/`

**Date**: 4 May '26

**Changes**:
- Cookie: 100 rpm (from 10000 rpm)

---

`GET https://friends.roblox.com/v1/my/luobu-friends/requests/`

**Date**: 4 May '26

**Changes**:
- Cookie: 60 rpm (from 10000 rpm)

---

`GET https://friends.roblox.com/v1/my/trusted-friends/{userId}/status/`

**Date**: 4 May '26

**Changes**:
- Cookie: 100 rpm (from 1000 rpm)

---

`GET https://friends.roblox.com/v1/tencent-friends-suggestion/`

**Date**: 4 May '26

**Changes**:
- Cookie: 100 rpm (from 10000 rpm)

---

`POST https://friends.roblox.com/v1/user/following-exists/`

**Date**: 4 May '26

**Changes**:
- Cookie: 10 rpm (from 10000 rpm)

---

`POST https://friends.roblox.com/v1/user/{userId}/multiget-are-friends/`

**Date**: 4 May '26

**Changes**:
- Cookie: 500 rpm (from 10000 rpm)

---

`GET https://friends.roblox.com/v1/user/{userId}/multiget-are-trusted-friends/`

**Date**: 4 May '26

**Changes**:
- Unauthenticated access removed.
- Cookie: 100 rpm (from 1000 rpm)

---

`GET https://friends.roblox.com/v1/users/{targetUserId}/followers/`

**Date**: 4 May '26

**Changes**:
- Unauthenticated access removed.
- Cookie: 100 rpm (from 10000 rpm)

---

`GET https://friends.roblox.com/v1/users/{targetUserId}/followers/count/`

**Date**: 4 May '26

**Changes**:
- Unauth: 100 rpm (from 10000 rpm)
- Cookie: 100 rpm (from 10000 rpm)

---

`GET https://friends.roblox.com/v1/users/{targetUserId}/followings/`

**Date**: 4 May '26

**Changes**:
- Unauthenticated access removed.
- Cookie: 100 rpm (from 10000 rpm)

---

`GET https://friends.roblox.com/v1/users/{targetUserId}/followings/count/`

**Date**: 4 May '26

**Changes**:
- Unauth: 100 rpm (from 10000 rpm)
- Cookie: 100 rpm (from 10000 rpm)

---

`GET https://friends.roblox.com/v1/users/{userId}/friends/count/`

**Date**: 4 May '26

**Changes**:
- Unauth: 100 rpm (from 10000 rpm)
- Cookie: 100 rpm (from 10000 rpm)

---

`GET https://friends.roblox.com/v1/users/{userId}/friends/find/`

**Date**: 4 May '26

**Changes**:
- Unauth: 100 rpm (from 10000 rpm)
- Cookie: 100 rpm (from 10000 rpm)

---

`GET https://friends.roblox.com/v1/users/{userId}/friends/inactive/`

**Date**: 4 May '26

**Changes**:
- Cookie: 100 rpm (from 10000 rpm)

---

`GET https://friends.roblox.com/v1/users/{userId}/friends/recommendations/`

**Date**: 4 May '26

**Changes**:
- Unauthenticated access removed.
- Cookie: 100 rpm (from 10000 rpm)

---

`GET https://friends.roblox.com/v1/users/{userId}/friends/search/`

**Date**: 4 May '26

**Changes**:
- Cookie: 100 rpm (from 10000 rpm)

---

`GET https://friends.roblox.com/v1/users/{userId}/friends/statuses/`

**Date**: 4 May '26

**Changes**:
- Cookie: 200 rpm (from 10000 rpm)

---

`GET https://friends.roblox.com/v1/users/{userId}/luobu-friends/`

**Date**: 4 May '26

**Changes**:
- Unauth: 100 rpm (from 10000 rpm)
- Cookie: 100 rpm (from 10000 rpm)

---

`POST https://presence.roblox.com/v1/presence/users/`

**Date**: 4 May '26

**Changes**:
- Unauth: 60 rpm (from 2640 rpm)
- Cookie: 100 rpm (from 1320 rpm)

---

`POST https://accountinformation.roblox.com/v1/email/verify`

**Date**: 4 May '26

**Changes**:
- Unauth: 5 rpm (from 1000 rpm)

---

`GET https://accountinformation.roblox.com/v1/phone`

**Date**: 4 May '26

**Changes**:
- Unauthenticated access removed.

---

`POST https://accountinformation.roblox.com/v1/phone`

**Date**: 4 May '26

**Changes**:
- Unauthenticated access removed.

---

`POST https://accountinformation.roblox.com/v1/phone/delete`

**Date**: 4 May '26

**Changes**:
- Unauthenticated access removed.

---

`POST https://accountinformation.roblox.com/v1/phone/resend`

**Date**: 4 May '26

**Changes**:
- Unauthenticated access removed.

---

`POST https://accountinformation.roblox.com/v1/phone/verify`

**Date**: 4 May '26

**Changes**:
- Unauth: 5 rpm (from 1000 rpm)

---

`GET https://apis.roblox.com/access-management/v1/feature-access`

**Date**: 4 May '26

**Changes**:
- Unauthenticated access removed.

---

`GET https://apis.roblox.com/access-management/v1/upsell-feature-access`

**Date**: 4 May '26

**Changes**:
- Unauthenticated access removed.

---

`GET https://apis.roblox.com/access-management/v1/user-owner-feature-access`

**Date**: 4 May '26

**Changes**:
- Unauthenticated access removed.

---

`POST https://apis.roblox.com/creator-settings/v1/notifications/unsubscribe`

**Date**: 4 May '26

**Changes**:
- Unauth: 30 rpm (from 10000 rpm)

---

`POST https://apis.roblox.com/creator-settings/v1/notifications/validate`

**Date**: 4 May '26

**Changes**:
- Unauth: 30 rpm (from 10000 rpm)

---

`POST https://apis.roblox.com/creator-settings/v1/unsubscribe/unsubscribe`

**Date**: 4 May '26

**Changes**:
- Unauth: 30 rpm (from 10000 rpm)

---

`POST https://apis.roblox.com/creator-settings/v1/unsubscribe/validate`

**Date**: 4 May '26

**Changes**:
- Unauth: 30 rpm (from 10000 rpm)

---

`POST https://apis.roblox.com/marketplace-fiat-service/v1/product/purchase`

**Date**: 4 May '26

**Changes**:
- Unauthenticated access removed.

---

`GET https://apis.roblox.com/marketplace-fiat-service/v1/purchaser/payments`

**Date**: 4 May '26

**Changes**:
- Unauthenticated access removed.

---

`GET https://apis.roblox.com/marketplace-fiat-service/v1/purchaser/report/payments`

**Date**: 4 May '26

**Changes**:
- Unauthenticated access removed.

---

`GET https://apis.roblox.com/marketplace-fiat-service/v1/seller/balance`

**Date**: 4 May '26

**Changes**:
- Unauthenticated access removed.

---

`POST https://apis.roblox.com/marketplace-fiat-service/v1/seller/onboard`

**Date**: 4 May '26

**Changes**:
- Unauthenticated access removed.

---

`GET https://apis.roblox.com/marketplace-fiat-service/v1/seller/payments`

**Date**: 4 May '26

**Changes**:
- Unauthenticated access removed.

---

`GET https://apis.roblox.com/marketplace-fiat-service/v1/seller/payouts`

**Date**: 4 May '26

**Changes**:
- Unauthenticated access removed.

---

`GET https://apis.roblox.com/marketplace-fiat-service/v1/seller/payouts-total`

**Date**: 4 May '26

**Changes**:
- Unauthenticated access removed.

---

`GET https://apis.roblox.com/marketplace-fiat-service/v1/seller/products/{productType}`

**Date**: 4 May '26

**Changes**:
- Unauthenticated access removed.

---

`GET https://apis.roblox.com/marketplace-fiat-service/v1/seller/report/payments`

**Date**: 4 May '26

**Changes**:
- Unauthenticated access removed.

---

`GET https://apis.roblox.com/marketplace-fiat-service/v1/seller/status`

**Date**: 4 May '26

**Changes**:
- Unauthenticated access removed.

---

`GET https://apis.roblox.com/marketplace-publishing-requirements-api/v1/requirements`

**Date**: 4 May '26

**Changes**:
- Unauthenticated access removed.

---

`GET https://apis.roblox.com/service-efficiency-api/v1/accounts/groups/{groupId}`

**Date**: 4 May '26

**Changes**:
- Cookie: 100 rpm (from 6000 rpm)

---

`PUT https://apis.roblox.com/service-efficiency-api/v1/accounts/groups/{groupId}`

**Date**: 4 May '26

**Changes**:
- Cookie: 100 rpm (from 6000 rpm)

---

`GET https://apis.roblox.com/service-efficiency-api/v1/accounts/users/{userId}`

**Date**: 4 May '26

**Changes**:
- Cookie: 100 rpm (from 6000 rpm)

---

`PUT https://apis.roblox.com/service-efficiency-api/v1/accounts/users/{userId}`

**Date**: 4 May '26

**Changes**:
- Cookie: 100 rpm (from 6000 rpm)

---

`GET https://apis.roblox.com/service-efficiency-api/v1/billing_activities/groups/{group_id}`

**Date**: 4 May '26

**Changes**:
- Cookie: 100 rpm (from 5000 rpm)

---

`GET https://apis.roblox.com/service-efficiency-api/v1/billing_activities/users/{user_id}`

**Date**: 4 May '26

**Changes**:
- Cookie: 100 rpm (from 5000 rpm)

---

`GET https://apis.roblox.com/service-efficiency-api/v1/bills/groups/{group_id}`

**Date**: 4 May '26

**Changes**:
- Cookie: 100 rpm (from 5000 rpm)

---

`GET https://apis.roblox.com/service-efficiency-api/v1/bills/users/{user_id}`

**Date**: 4 May '26

**Changes**:
- Cookie: 100 rpm (from 5000 rpm)

---

`GET https://apis.roblox.com/service-efficiency-api/v1/eligibility/groups/{groupId}`

**Date**: 4 May '26

**Changes**:
- Cookie: 100 rpm (from 6000 rpm)

---

`GET https://apis.roblox.com/service-efficiency-api/v1/payment_profiles/groups/{groupId}/service_efficiency`

**Date**: 4 May '26

**Changes**:
- Cookie: 100 rpm (from 6000 rpm)

---

`PUT https://apis.roblox.com/service-efficiency-api/v1/payment_profiles/groups/{groupId}/service_efficiency`

**Date**: 4 May '26

**Changes**:
- Cookie: 100 rpm (from 6000 rpm)

---

`DELETE https://apis.roblox.com/service-efficiency-api/v1/payment_profiles/users/{userId}`

**Date**: 4 May '26

**Changes**:
- Cookie: 100 rpm (from 6000 rpm)

---

`GET https://apis.roblox.com/service-efficiency-api/v1/payment_profiles/users/{userId}`

**Date**: 4 May '26

**Changes**:
- Cookie: 100 rpm (from 6000 rpm)

---

`POST https://apis.roblox.com/service-efficiency-api/v1/payment_profiles/users/{userId}`

**Date**: 4 May '26

**Changes**:
- Cookie: 100 rpm (from 6000 rpm)

---

`GET https://apis.roblox.com/service-efficiency-api/v1/payment_profiles/users/{userId}/service_efficiency`

**Date**: 4 May '26

**Changes**:
- Cookie: 100 rpm (from 6000 rpm)

---

`PUT https://apis.roblox.com/service-efficiency-api/v1/payment_profiles/users/{userId}/service_efficiency`

**Date**: 4 May '26

**Changes**:
- Cookie: 100 rpm (from 6000 rpm)

---

`POST https://apis.roblox.com/service-efficiency-api/v1/payments/groups/{groupId}`

**Date**: 4 May '26

**Changes**:
- Cookie: 100 rpm (from 6000 rpm)

---

`POST https://apis.roblox.com/service-efficiency-api/v1/payments/users/{userId}`

**Date**: 4 May '26

**Changes**:
- Cookie: 100 rpm (from 6000 rpm)

---

`POST https://apis.roblox.com/user-heartbeats-api/action-report`

**Date**: 4 May '26

**Changes**:
- Unauth: 10 rpm (from 6000 rpm)

---

`POST https://apis.roblox.com/user-heartbeats-api/client/action-report`

**Date**: 4 May '26

**Changes**:
- Unauth: 10 rpm (from 6000 rpm)

---

`POST https://apis.roblox.com/user-heartbeats-api/client/pulse`

**Date**: 4 May '26

**Changes**:
- Unauth: 10 rpm (from 6000 rpm)

---

`POST https://apis.roblox.com/user-heartbeats-api/pulse`

**Date**: 4 May '26

**Changes**:
- Unauth: 10 rpm (from 6000 rpm)

---

`GET https://apis.roblox.com/voting-api/user/get-vote-count`

**Date**: 4 May '26

**Changes**:
- Unauthenticated access removed.

---

`GET https://badges.roblox.com/v1/badges/{badgeId}`

**Date**: 4 May '26

**Changes**:
- Cookie: 100 rpm (from 600 rpm)

**Open Cloud and Engine options**:
- [BadgeService Engine API](https://create.roblox.com/docs/reference/engine/classes/BadgeService#GetBadgeInfoAsync)

---

`POST https://badges.roblox.com/v1/badges/{badgeId}/icon`

**Date**: 4 May '26

**Changes**:
- Cookie: 100 rpm (from 1000 rpm)

---

`GET https://badges.roblox.com/v1/universes/{universeId}/badges`

**Date**: 4 May '26

**Changes**:
- Cookie: 100 rpm (from 1000 rpm)

---

`PATCH https://badges.roblox.com/v1/universes/{universeId}/badges`

**Date**: 4 May '26

**Changes**:
- Cookie: 100 rpm (from 1000 rpm)

**Open Cloud and Engine options**:
- [Cloud API](https://create.roblox.com/docs/cloud/reference/features/badges#patch_legacy_badges_v1_badges__badgeId_)

---

`POST https://badges.roblox.com/v1/universes/{universeId}/badges`

**Date**: 4 May '26

**Changes**:
- Cookie: 100 rpm (from 1000 rpm)

**Open Cloud and Engine options**:
- [Cloud API](https://create.roblox.com/docs/cloud/reference/features/badges#post_legacy_badges_v1_universes__universeId__badges)

---

`GET https://badges.roblox.com/v1/universes/{universeId}/badges/is-authorized-to-reorder`

**Date**: 4 May '26

**Changes**:
- Cookie: 100 rpm (from 1000 rpm)

---

`DELETE https://badges.roblox.com/v1/user/badges/{badgeId}`

**Date**: 4 May '26

**Changes**:
- Cookie: 100 rpm (from 1000 rpm)

---

`DELETE https://badges.roblox.com/v1/user/{userId}/badges/{badgeId}`

**Date**: 4 May '26

**Changes**:
- Cookie: 100 rpm (from 1000 rpm)

---

`POST https://badges.roblox.com/v1/users/{userId}/badges/{badgeId}/award-badge`

**Date**: 4 May '26

**Changes**:
- Cookie: 100 rpm (from 1000 rpm)

**Open Cloud and Engine options**:
- [BadgeService Engine API](https://create.roblox.com/docs/reference/engine/classes/BadgeService#AwardBadgeAsync)

---

`GET https://badges.roblox.com/v2/universes/{universeId}/badges`

**Date**: 4 May '26

**Changes**:
- Cookie: 100 rpm (from 1000 rpm)

---

`POST https://friends.roblox.com/v1/contacts/{targetContactId}/request-friendship/`

**Date**: 4 May '26

**Changes**:
- Cookie: 10 rpm (from 10000 rpm)

---

`GET https://friends.roblox.com/v1/metadata/`

**Date**: 4 May '26

**Changes**:
- Unauth: 100 rpm (from 10000 rpm)
- Cookie: 100 rpm (from 10000 rpm)

---

`POST https://friends.roblox.com/v1/my/friends/validate-nickname/`

**Date**: 4 May '26

**Changes**:
- Cookie: 10 rpm (from 10000 rpm)

---

`GET https://friends.roblox.com/v1/my/friends/{userId}/status/`

**Date**: 4 May '26

**Changes**:
- Cookie: 100 rpm (from 10000 rpm)

---

`DELETE https://friends.roblox.com/v1/my/new-friend-requests/`

**Date**: 4 May '26

**Changes**:
- Cookie: 10 rpm (from 10000 rpm)

---

`GET https://friends.roblox.com/v1/my/new-friend-requests/count/`

**Date**: 4 May '26

**Changes**:
- Cookie: 100 rpm (from 10000 rpm)

---

`GET https://friends.roblox.com/v1/user/friend-requests/count/`

**Date**: 4 May '26

**Changes**:
- Cookie: 100 rpm (from 10000 rpm)

---

`POST https://friends.roblox.com/v1/user/friend-requests/decline-all/`

**Date**: 4 May '26

**Changes**:
- Cookie: 10 rpm (from 10000 rpm)

---

`POST https://friends.roblox.com/v1/users/{requesterUserId}/accept-friend-request/`

**Date**: 4 May '26

**Changes**:
- Cookie: 10 rpm (from 10000 rpm)

---

`POST https://friends.roblox.com/v1/users/{requesterUserId}/decline-friend-request/`

**Date**: 4 May '26

**Changes**:
- Cookie: 10 rpm (from 10000 rpm)

---

`POST https://friends.roblox.com/v1/users/{senderUserId}/accept-friend-request-with-token/`

**Date**: 4 May '26

**Changes**:
- Cookie: 10 rpm (from 10000 rpm)

---

`POST https://friends.roblox.com/v1/users/{targetUserId}/accept-trusted-friend-request/`

**Date**: 4 May '26

**Changes**:
- Cookie: 10 rpm (from 1000 rpm)

---

`POST https://friends.roblox.com/v1/users/{targetUserId}/ignore-trusted-friend-request/`

**Date**: 4 May '26

**Changes**:
- Cookie: 10 rpm (from 1000 rpm)

---

`POST https://friends.roblox.com/v1/users/{targetUserId}/remove-trusted-friend/`

**Date**: 4 May '26

**Changes**:
- Cookie: 10 rpm (from 1000 rpm)

---

`POST https://friends.roblox.com/v1/users/{targetUserId}/request-friendship/`

**Date**: 4 May '26

**Changes**:
- Cookie: 10 rpm (from 15 rpm)

---

`POST https://friends.roblox.com/v1/users/{targetUserId}/send-trusted-friend-request/`

**Date**: 4 May '26

**Changes**:
- Cookie: 10 rpm (from 1000 rpm)

---

`POST https://friends.roblox.com/v1/users/{targetUserId}/unfollow/`

**Date**: 4 May '26

**Changes**:
- Cookie: 10 rpm (from 10000 rpm)

---

`POST https://friends.roblox.com/v1/users/{targetUserId}/unfriend/`

**Date**: 4 May '26

**Changes**:
- Cookie: 10 rpm (from 10000 rpm)

---

`DELETE https://groups.roblox.com/v1/featured-content/event`

**Date**: 4 May '26

**Changes**:
- Unauthenticated access removed.

---

`POST https://groups.roblox.com/v1/groups/{groupId}/blocked-keywords`

**Date**: 4 May '26

**Changes**:
- Cookie: 60 rpm (from 100 rpm)

---

`GET https://groups.roblox.com/v1/groups/{groupId}/emotes`

**Date**: 4 May '26

**Changes**:
- Unauthenticated access removed.

---

`GET https://groups.roblox.com/v1/groups/{groupId}/forums`

**Date**: 4 May '26

**Changes**:
- Unauthenticated access removed.

---

`GET https://groups.roblox.com/v1/groups/{groupId}/forums/{categoryId}/posts`

**Date**: 4 May '26

**Changes**:
- Unauthenticated access removed.

---

`GET https://groups.roblox.com/v1/groups/{groupId}/forums/{categoryId}/posts/pinned`

**Date**: 4 May '26

**Changes**:
- Unauthenticated access removed.

---

`GET https://groups.roblox.com/v1/groups/{groupId}/forums/{categoryId}/posts/{postId}/comments`

**Date**: 4 May '26

**Changes**:
- Unauthenticated access removed.

---

`GET https://groups.roblox.com/v1/groups/{groupId}/forums/{categoryId}/posts/{postId}/comments/{commentId}/notifications`

**Date**: 4 May '26

**Changes**:
- Unauthenticated access removed.

---

`GET https://groups.roblox.com/v1/groups/{groupId}/forums/{categoryId}/posts/{postId}/notifications`

**Date**: 4 May '26

**Changes**:
- Unauthenticated access removed.

---

`POST https://groups.roblox.com/v1/groups/{groupId}/join-requests`

**Date**: 4 May '26

**Changes**:
- Cookie: 60 rpm (from 100 rpm)

**Open Cloud and Engine options**:
- [Cloud API](https://create.roblox.com/docs/cloud/reference/features/groups#Cloud_AcceptGroupJoinRequest)

---

`PATCH https://groups.roblox.com/v1/groups/{groupId}/name`

**Date**: 4 May '26

**Changes**:
- Cookie: 60 rpm (from 100 rpm)

---

`PATCH https://groups.roblox.com/v1/groups/{groupId}/notification-preference`

**Date**: 4 May '26

**Changes**:
- Cookie: 60 rpm (from 100 rpm)

**Open Cloud and Engine options**:
- [Cloud API](https://create.roblox.com/docs/cloud/reference/features/groups#patch_legacy_groups_v1_groups__groupId__notification_preference)

---

`PATCH https://groups.roblox.com/v1/groups/{groupId}/roles/{roleSetId}/permissions`

**Date**: 4 May '26

**Changes**:
- Cookie: 90 rpm (from 60 rpm)

**Open Cloud and Engine options**:
- [Cloud API](https://create.roblox.com/docs/cloud/reference/features/groups#Cloud_ListGroupRoles)

---

`POST https://groups.roblox.com/v1/groups/{groupId}/rolesets/create`

**Date**: 4 May '26

**Changes**:
- Cookie: 30 rpm (from 100 rpm)

---

`PATCH https://groups.roblox.com/v1/groups/{groupId}/settings`

**Date**: 4 May '26

**Changes**:
- Cookie: 60 rpm (from 100 rpm)

**Open Cloud and Engine options**:
- [Cloud API](https://create.roblox.com/docs/cloud/reference/features/groups#patch_legacy_groups_v1_groups__groupId__settings)

---

`GET https://thumbnails.roblox.com/v1/badges/icons`

**Date**: 4 May '26

**Changes**:
- Unauth: 60 rpm (from 500 rpm)

---

`GET https://thumbnails.roblox.com/v1/users/avatar`

**Date**: 4 May '26

**Changes**:
- Cookie: 500 rpm (from 10000 rpm)

---

`GET https://thumbnails.roblox.com/v1/users/avatar-3d`

**Date**: 4 May '26

**Changes**:
- Cookie: 100 rpm (from 50000 rpm)

---

`GET https://thumbnails.roblox.com/v1/users/avatar-bust`

**Date**: 4 May '26

**Changes**:
- Cookie: 100 rpm (from 10000 rpm)

---

`GET https://thumbnails.roblox.com/v1/users/avatar-headshot`

**Date**: 4 May '26

**Changes**:
- Unauth: 120 rpm (from 10000 rpm)
- Cookie: 500 rpm (from 10000 rpm)

---

`GET https://thumbnails.roblox.com/v1/users/outfits`

**Date**: 4 May '26

**Changes**:
- Cookie: 100 rpm (from 10000 rpm)

---

`GET https://users.roblox.com/v1/birthdate/`

**Date**: 4 May '26

**Changes**:
- Cookie: 100 rpm (from 10000 rpm)
34 Likes
2

This topic was automatically opened after 10 minutes.

4

Cool update! This will indeed help make sure users will have an extremely more difficult time being able to track us!

11 Likes
5

Are there plans to give players privacy settings for connections and communities in the near future? Just because the Third-Party App Policy says that we can’t mine data, doesn’t mean everyone’s going to listen. It’s incredibly creepy that someone can use Roblox’s API to track our friend history, building information which can and has been used to stalk people.

17 Likes
6

If yall keep moving away from cookie based requests extensions as we know them are dead.

At the time of this reply I have not had the time to look through all the API changes however there is at least a few that will effect my extension project personally.

This honestly is a loss for both extensions developers like my self, and users of extensions who want more quality of life.

With these changes developers are limited with what they can make (again)

Also using tracking as a half baked reason behind this change is kinda funny considering I know of at least 3 different tracking related issues that has been reported and are still yet to be fixed.

17 Likes
7

It would be nice if players could, within a game, allow access to specific endpoints. I would like to be able to read a player’s decals inventory for stuff they’ve uploaded, but have no way to ask for permission, and stuff like this lowers rate limits for the use cases where they have.

11 Likes
8

um its called FRIENDS now

anyway it’s nice to see that a lot of APIs will have better rate limits since me and some of my friends like to play around with APIs and harsh rate limits sometimes get in the way of that
edit: my bad I misread I thought they were increasing them but they are being decreased

btw will 18+ users in the UK have the option to show their friend list since the law is only supposed to apply to children? users in the UK who are 18+ can already play games with “paid random items” so I don’t think this would be hard to add

4 Likes
9

I agree, being able to prompt users for access to specific data would allow developers to only get certain instead of all information to the endpoint and would give players notice that their information is being used. An in-game API prompt would be nice for this

Could look something like this: Player is prompted for access to view their inventory, which generates a temporary token for access to the endpoint

3 Likes
10

+1 this would absolutely be a great addition for both games’s functionality and user privacy without needing the user to turn a global setting, game specific permission control would also be a nice addition too for those who care deeply about their privacy, only issue I would see with this is keeping creators compliant and respecting of permission changes

1 Like
11

I originally replied under the Upcoming Breaking Change to CheckUserBadgesAsync, UserHasBadgeAsync, and Badges Web APIs announcement, but I haven’t seen any official response, so I’ll be resending it here (and also wording it a little better in the process).

Will there ever be an OAuth badge API alternative for creators to read badge info of users under their own experience?

Some external tooling depends on this data, and I don’t believe it would be a privacy concern as BadgeService already grants this exclusion in-game.

Please do correct me if such alternative already exists, but from what I can see nothing quite fulfills this.

13

User tracking through data like friends and badges is what we are looking to safeguard against. At the same time, we recognize there are games with benign uses of data for creating fun social game mechanics. We are exploring user permissions as a way to balance between privacy and what is given consent for a game to use.

5 Likes
14

How will this change affect external sites like Rolimons which scrap and aggregate user data using Roblox’s APIs:

image
image1153×369 96.5 KB

Based on the policy updates mentioned, it seems the user data aspect of this application now violates the TOS.

10 Likes
15

This seems like a response to Rodetector

7 Likes
16

Believe it or not using any undocumented API is actually against ToS.

If I understood it correctly at least

17

I give up, roblox has now changed so many things last year, and this year, regarding api’s, and now they are killing it, by restricting it even more.
My Discord bot will most likely remove all Roblox APIs, and i will remove them from my website, because of this stupid move to keep adding breaking changes.
Made all the changes into a .pdf
cookie_based_apis_plan_details_print_friendly.pdf (7.0 . KB)

3 Likes
18

I don’t believe it’s that far because they literally said

We know many creators use unofficial cookie-based APIs for automation and custom features, which we respect.

This change seems to be more focused on user data collection

20

Will this mean that it’ll be possible to Automate group payouts without the use of cookies? or is that not planned yet, it would be great to have that as a feature to avoid any hassles

21

Doubled checked and it says “Only access an API by the means described in the documentations of that API”
So I might have misunderstood

22

Thank you for this feedback - this is exactly what we are exploring next. We want to support games that use data in a positive way and want to provide players with more control over their data. Enabling users the ability to grant games consent to certain data would be one possible path. Other than decal, do you have other use cases of data you’d like to request access from the user - and for what game mechanic?

2 Likes
23

That’s just a warning against misuse and that you have to use it the way it is intended to be

1 Like