[Updated] Upcoming Changes to Groups-API

Hi Creators,

As part of our ongoing effort to expand the capabilities of Roblox Communities, we are preparing a number of changes that may impact third-party developers. Please review the details below and prepare your code for these changes where necessary.

Member List Privacy

This January, we will be releasing a new community privacy setting that will let communities control whether their member list is visible to non-members. When this update rolls out, all existing communities will automatically have the Members list publicly visible setting enabled, while all new communities will have the setting disabled by default. Owners will be able to change this setting at any time.

Non-members making requests to groups with this setting disabled will now receive a 403 (Forbidden) response. See below the impacted routes:

Open-cloud-groups

ListGroupMemberships: GET /cloud/v2/groups/{groupId}/memberships

A member of a community with the setting disabled will see no difference in response.

Example
Request: https://apis.roblox.com/cloud/v2/groups/{groupId}/memberships?maxPageSize=10

Response for a member

{
	"groupMemberships": [
		{
			"path": "groups/{groupid}/memberships/{membership1}",
			"createTime": "2023-01-30T18:59:55.563Z",
			"updateTime": "0001-01-01T00:00:00Z",
			"user": "users/{userId1}",
			"role": "groups/{groupid}/roles/{roleid2}"
		},
		{
			"path": "groups/{groupid}/memberships/{membership2}",
			"createTime": "2023-02-10T17:54:59.160Z",
			"updateTime": "0001-01-01T00:00:00Z",
			"user": "users/{userId2}",
			"role": "groups/{groupid}/roles/{roleid1}"
		},
		{
			"path": "groups/{groupid}/memberships/{membership3}",
			"createTime": "2024-08-12T17:12:33.670Z",
			"updateTime": "0001-01-01T00:00:00Z",
			"user": "users/{userId3}",
			"role": "groups/{groupid}/roles/{roleid1}"
		}
	],
	"nextPageToken": "id_2zwAAAZLuuVOdxBBpFVwTAv9O96AU245oYHoS"
}

Response for a non-member
Error with status code: 403 (Forbidden)

Groups-api

GetGroupMembersInRole: GET /v1/groups/{groupId}/roles/{roleSetId}/users
GetGroupMembers: GET /v1/groups/{groupId}/users

Similar to the above example, the response for a member of the community using the above endpoints will remain unchanged.

Response for a non-member
Error with status code: 403 (Forbidden)

We’re targeting a release of this update for the week of January 12th, 2026, so please review and revise any impacted code prior to January 12th to avoid any disruption to your tools.

Display Names in Audit Logs

Currently, audit log descriptions feature Roblox Display Names for acting users, and Roblox Usernames for the target users. To reduce confusion, all users in audit log descriptions will be shown as their Roblox Display Name. This change is reflected in the Groups API endpoint’s TargetName field, which will soon return the user’s display name when one is set instead of their username.

Current audit log example

{
    "actor": {...}
    "actionType": "...",
    "description": {
        "TargetId": ...,
        "TargetName": "MyAwesomeUsername"
    },
    "created": "..."
}

Updated audit log example

{
    "actor": {...}
    "actionType": "...",
    "description": {
        "TargetId": ...,
        "TargetName": "MyDisplayName"
    },
    "created": "..."
}

Updates to the Groups-API audit log endpoint will go into effect December 11th. Please review the changes and prepare accordingly.

Rate Limit Adjustments

The Groups API today supports a number of routes that provide necessary information for our clients to function properly, but are also used by third-party developers to integrate with Roblox. In order to better protect the health of our services while also ensuring continuous availability for developers, we will be fine-tuning our rate-limiting parameters which will result in an overall reduction for most routes. These new limits have been adjusted on a per-route basis to generously accommodate traffic consistent with average daily patterns.

While we do not anticipate a vast majority of third-party developers will notice any changes, some high-volume callers may experience elevated 429 (Too Many Requests) responses.

These rate limit adjustments will go into effect beginning December 11th.

Please let us know if you have any questions or concerns regarding these changes, and thank you for your support!

44 Likes

This topic was automatically opened after 9 minutes.

Display names are totally worthless for any programmatic use of this API. It makes no sense to return display name here. If you’re using this to forward audit logs somewhere, they are completely unsearchable for any moderation purpose. If you’re using this to archive audit logs, the user can change their display name and their connection be completely lost. This completely breaks any reason to use this API. This should return username exclusively. In the UI, you can reach the actual username.

Actually assuming TargetId is the target’s user id then this is not broken, but I still don’t like that the API no longer returns the most broadly useful version of this data that is all of human readable, human searchable, and programmatically useful.

54 Likes

I have a feeling I know why this is going into effect, but might as well ask for official confirmation:

What is the goal with allowing groups to set their member list to private? What use case is Roblox enabling with this?

40 Likes

I was expecting this to be problematic the second I saw “Update to ..[the] API” but this actually seems to be okay besides the rate limits. Not bad.

2 Likes

Or even, why was this not just added as an additional field to the response to begin with?

14 Likes

The new community member list privacy setting is interesting, although I don’t fully see the use case. Unless it also hides the communities on the profile, it won’t stop guesses for what high-profile people are testing for example, although it would make alts harder to figure out.

Any indication of how limited this is going to get? For example, in Sovereign, a service for handling bans between multiple experiences and communities (ex: Innovation Security with a couple sub-experiences and 2 communities), there is an optional check that can be turned on to ensure you don’t ban someone above you. This involves fetching the higher ranks to make sure the target user isn’t in a higher rank, and this was done because large batches of bans reached API limits when checking individual players for their rank. Changing this limit risks making attempts to ban fail because of rate limiting when fetching the ranks.

6 Likes

Can we have actual numbers with actual info? This is one of those things where merely mentioning the existance of a ratelimit ain’t gonna do

Some of these announcements genuinely feel like unfinished drafts that were rushed out, and that’s a very good way to generate tons of complaints and to require intervention from a second staff member to fill in info which should have existed in the original post

6 Likes

I don’t understand what the point of hiding group member lists is, and even worse, making that the default option. What is to stop someone from making a group and filling it with fake, botted accounts to pretend like it is bigger than it actually is? Right now at least it will be seen for what it is.

16 Likes

What does someone gain from doing this?

3 Likes

I don’t know, but people used to do it all the time. I wouldn’t be surprised if people still do it. Years ago, someone made a group with the same name as one of my friend’s groups and filled it with 15,000 botted accounts so it would show up first in searches for his group.

5 Likes

TargetId should be their UserId so I see no issue with the Display Name being returned as well. Not sure if you missed that..

If I’m wrong then idk why it wouldn’t be their UserId.

2 Likes

Sounds like your concerns should be with Roblox’s group search algorithm, not some unrelated member list privacy setting then.

Probably having like closed beta tests, and also developer only groups where developers can’t get targeted for harassment by their playerbase if say they released an update where they banned a bunch of people who were duping items, and those people were very angry.

4 Likes

So this update effectively renders group blacklists and group bans useless if the blacklisted/ banned group just toggles their member list to private.

How exactly is this helpful to anyone?

5 Likes

Your group blacklists and bans could easily be circumvented by them just not joining on whatever account they have that’s in said group. How exactly is something so weak helpful to anyone?

Might have missed it but finding informative docs about the details of this response is surprisingly annoying and I’m not going to continue trying.

In any case, returning displayname here means you need to do an additional webcall to get back the most useful form of this data (human readable, human searchable, and programmatically useful) so I’m still not a fan of it, but it doesn’t break the use case like I thought if that ID field is what I expect it to be.

Because it takes away that option from group owners/ clan leaders. Anything can be circumvented with an alt, should we stop banning people all together because they will use an alt?

2 Likes

My guess is harassment, such as towards people who are credited/roled but have no creative control over the game. eg. Contributors, Play Testers, and Contractors.

1 Like

Yeah same feeling about the docs, tried double checking but I couldn’t find anything for these changes on there yet.

1 Like