/scripting/security/third-party-vulnerabilities.md

Learn about vulnerability vectors from third-party assets.

Protecting your game

Vulnerabilities from third-party assets

Experiences

Avatar

Assets

Samples and projects

Engine API

Open Cloud API

Studio

Analytics

Platform

Tutorials

Creator programs

Education

Courses

Learn

This method is asynchronous and returns an `Operation`, which represents the current state of the operation. It contains an endpoint path that you can poll to obtain the real response and applicable metadata. See the [documentation]({longRunningOperationsLink}) on long-running operations for more information.
            
The following sections describe the response and metadata objects that are provided when an operation completes.

Beta endpoints are ready for public use. Breaking changes are possible but rare.

These Open Cloud documentation pages will be removed on March 31, 2026. You will be automatically redirected to the new Open Cloud documentation at that time. {linkStart}Learn more{linkEnd}

These old Open Cloud pages will be removed and redirected on March 31, 2026. {linkStart}Learn more{linkEnd}

Experimental endpoints are ready for public use, but may experience breaking changes occasionally as the API contract is finalized.

This endpoint can be called in-experience through {httpServiceLinkStart}HttpService{httpServiceLinkEnd} with an API key.

This field may be set when creating a resource, but may not be modified by subsequent requests.

These fields may be set when creating a resource, but may not be modified by subsequent requests.

This field may be provided in requests, but will never be included in responses.

Legacy authentication method. Always prefer using API Key or OAuth 2.0 when available.

Per API Key: {maxInPeriod} requests every {periodInSeconds} seconds per IP Address

Requires no authentication to call. Typically has significantly lowered rate limits. Always prefer using API Key or OAuth 2.0 when available.

For each grouping, only one of the following fields in the schema has to be provided, the remaining can be excluded.

You can opt back in at any time. {linkStart}Provide feedback.{linkEnd}

You are viewing the old docs. {linkStart}Provide feedback.{linkEnd}

You can opt out at any time and be redirected back to the old reference pages. {linkStart}Provide feedback.{linkEnd}

You are viewing the revamped docs. {linkStart}Provide feedback.{linkEnd}

This field may be set on responses, but will be ignored in requests.

Note: Rate limits can be lower during high-traffic periods. Certain endpoints have additional rate limits. [Learn more about rate limits]({link}).

{limit} requests per day across all API keys for a user or group

{limit} requests per hour across all API keys for a user or group

{limit} requests per minute across all API keys for a user or group

{limit} requests per second across all API keys for a user or group

{limit} requests per minute per API key owner

{limit} request(s) per second per API key owner

Scopes control what permissions your credentials have. Your credentials can only access the endpoints supported by the scopes you selected.

Stable endpoints are production-ready and will almost never experience breaking changes during their lifetime.

This target enables you to limit your key's access to selected {requiredParts}

This target enables you to limit your key's access to selected {requiredParts} and {optionalParts}

Target types are used to restrict the resources that your credentials have permissions on. Only the selected resources can be acted on even if your account has permissions on additional resources. Some scopes do not have target parts. In these cases, all of your relevant resources can be acted on.

The universe Top Level Part does not need to be selected for user-owned API Keys. In this case, your API Key will have access to all of your user-owned experiences and group-owned experiences that you have the right group permissions on.

Try It Out is not yet supported for endpoints requiring API key or OAuth 2.0 authentication

Cookie authentication is disabled for high risk operations for safety.

Critical risk endpoints are extremely sensitive and Try It Out is disabled for safety

Note: Authentication headers are not included in this code sample. You may need to add an authentication header for this command to work.

This is a high risk endpoint that can modify or delete critical data. Use extreme caution when testing.

This API endpoint has been classified as HIGH RISK and may affect live data or user accounts.

Authenticated requests to high-risk APIs can make changes that cannot be undone. Please review your request parameters carefully before proceeding.

Please login to use cookie authentication

This is a low risk endpoint that retrieves data. This is generally safe to test.

This is a medium risk endpoint that modifies data. Test carefully with non-critical accounts, as changes may be permanent.

To keep your account safe, never paste text here from other sources or send information from this page to others.

You are about to test live API endpoints using your actual account credentials.

Only proceed if you understand the implications of the API calls you're about to make. Review the API documentation carefully before testing.

API calls will be made using your authenticated session

These are real API calls that may affect your account or data

Rate limits and other API restrictions apply

Some operations may modify or delete data

This endpoint has been superseded by these recommended alternative endpoints:

The following scopes are required to call this endpoint. For more
information on generating proper keys, see [Manage API keys]({apiKeyReferenceDocLink}).

For more information on generating keys, see [Manage API keys]({apiKeyReferenceDocLink}).

The following endpoints are available at paths relative to the base URL.

This string is formatted as a [FieldMask](/cloud/reference/types#fieldmask).

A JSON value can be `null`, `boolean`, `string`, `number`, `array`, or `object`.

The following scopes are required for your OAuth 2.0 application to use this endpoint. For more information on how to register an OAuth 2.0 application, see [App registration and review]({oauth2ReferenceDocLink}).

For more information on how to register an OAuth 2.0 application, see [App registration and review]({oauth2ReferenceDocLink}).

The following objects describe payloads that are accepted or returned. See each individual endpoint for more information on when these objects are used.

The following scopes are required to call this endpoint.

Resource Paths

This string is formatted as a [Timestamp](/cloud/reference/types#timestamp).

The following scopes are required for your OAuth 2.0 application to use this endpoint. For more information on how to register an OAuth 2.0 application, see [App Registration and Review]({oauth2ReferenceDocLink}).

Not Recommended

You are viewing the revamped Open Cloud reference.

You've opted out of the new Open Cloud reference.

View your ad campaigns and their performance.

Create, update, and manage your ad campaigns.

This allows viewing information about your assets.

This allows uploading and updating assets to Roblox.

This allows viewing asset permissions for subjects (including groups and experiences) and assets your account has access to.

This allows granting asset permissions to any subjects (including groups and experiences) and assets your account has access to.

This allows you to view the status and results of avatar auto-setup jobs on your behalf.

This allows you to create and manage avatar auto-setup jobs on your behalf.

Grants the ability to update badges owned by the user.

This allows viewing information about your commerce items.

This allows making changes to your synced commerce items.

This allows viewing information about your commerce merchant connections.

This allows editing of your commerce merchant connections.

This allows you to view information about your Creator Store products.

This allows you to modify information about your Creator Store products.

This allows you to view information about your Creator Store saves.

This allows you to modify information about your Creator Store saves.

Grants access to create data stores on your behalf.

Grants access to delete data stores on your behalf.

Grants access to read a list of data stores.

Grants access to take a snapshot of your data stores.

Grants access to create entries in your data stores.

Grants access to mark specified entries for deletion.

Grants access to list your data store's entries.

Grants access to read specified entries in your data stores.

Grants access to update the value, attributes, and users of an entry.

Grants access to delete revisions of your data store's entries.

Grants access to list revisions for your data store's entries.

Grants access to read revisions of your data store's entries.

Grants access to view configuration details for the authorized user's developer products.

Grants access to edit the authorized user's developer products.

This allows viewing information about your universe's environments.

This allows editing of your universe's environments.

Grants access to view configuration details for the authorized user's game passes.

Grants access to edit the authorized user's game passes.

Grants access to view community forums information for your account.

Grants access to manage community forums information for your account.

This allows viewing information about your communities.

This allows you to manage community join requests and role updates of lower-ranked community members for your account.

Allows you to view an instance's property data.

Allows you to modify the property data of instances (currently only supports Scripts).

This allows viewing information about your inventory.

Grants access to manage your badges and spend Robux.

Grants access to update the authorized user's badges.

Grants access to manage your developer products.

Grants access to read information about the experiences you have notifications on for.

Grants access to turn on or off notifications for experiences on your behalf.

Grants access to manage your communities.

Grants permission to read community information.

Grants access to read and write your localization tables

Grants access to manage team collaboration for all experiences you own.

Grants access to manage your experiences and certain information associated with your experiences (e.g. localization information).

Grants access to read your experiences' localization information.

Grants access to modify your experiences' localization preferences.

Grants access to manage your user account.

Grants access to modify user localization preferences.

Allows you to view the status, logs, and results of Luau execution tasks for the associated place.

Allows you to create new Luau execution tasks for the associated place.

Grants access to asynchronously flush all data structures in the universe.

Grants access to discard read items from the front of the queue.

Grants access to read items at the front of the queue.

Grants access to read your memory store items.

Grants access to create, update, and delete map items.

This grants the ability to publish messages on behalf of users.

This allows sending notifications from your experience to users.

(Deprecated) Grants access to read a list of entries in an ordered data store.

(Deprecated) Grants access to create a new entry in an ordered data store.

Grants access to list entries from an ordered data store.

Grants access to create entries in an ordered data store.

This allows listing secrets associated with your experience.

This allows creating and updating secrets associated with your experience.

This permission allows you to submit an evaluation job and view the job result.

Grants access to read about your subscription products.

This allows you to read thumbnail information on your behalf.

Grants the ability to read game analytics.

Grants the ability to read place information.

Grants the ability to edit place information.

Grants access to publish new versions of experiences to Roblox.

Grants the ability to read experience information.

Grants access to edit the authorized user's experiences.

Allows you to view user restrictions in the experience.

Allows you to edit user restrictions in the experience.

This allows viewing notifications sent to your account.

Grants the ability to read the authorized user's premium and verified status.

This allows you to view the authorized user's social accounts.

This enables Single Sign-On functionality.

This grants access to read your profile information.

This function returns immediately if possible, but can yield the thread that called it until it can return a value.

Learn more about {linkStart}capabilities{linkEnd}.

{nameStart}name{nameEnd} is no longer supported or maintained by Roblox.

This endpoint is no longer supported or maintained by Roblox.

This math operation is no longer supported or maintained by Roblox.

This member doesn’t appear in the object browser and is not intended for widespread use.

This member is only accessible only through the command bar. Attempting to access this member from scripts causes an error.

This function can’t pause the Lua thread that called it.

Attempting to access this member in scripts causes an error. You might be able to access this member from Roblox Studio's property window.

This member doesn’t appear in Roblox Studio’s Object Browser.

You can’t create an instance of this class with the Instance.new constructor.

Roblox does not replicate this member across its server-client boundary.

Lua code can’t access this member. You might be able to change its value from the property window in Roblox Studio.

This member is accessible from OpenCloud Luau execution tasks.

This object’s replication behavior is dependent on the player who owns it.

This member is accessible through the command bar and plugins. Attempting to access this member from scripts causes an error.

This member is read only. Attempting to write to this member causes an error.

This property is read-only and is safe to read in unsynchronized threads. Attempting to write to it causes an error.

There are alternative endpoints available that supersede this endpoint.

This member is accessible only in CoreScripts.

Only Roblox CoreScripts can access this member, and it isn’t usable by Players.

You can read and write to this property safely from multiple threads.

This class is a top-level singleton. Retrieve an instance of this class with the GetService function.

Can be accessed within callbacks bound via {link1Start}RunService:BindToSimulation(){link1End}. Participates in rollbacks. See {link2Start}server authority{link2End}.

Multiple threads can potentially write to this property, so it’s unsafe to read from unsynchronized threads.

This function pauses the Lua thread that called it until it returns a result. This doesn’t interrupt other scripts.

Manage and analyze all your experiences in one convenient place.

Documentation and resources for all creators.

Learn how to create Roblox experiences with guides, tutorials, and code samples.

Build your experiences in Studio, our all-in-one IDE, and deploy to a wide variety of devices.

An engineering manager shares how to think about game development with AI.

Get the Studio MCP server connected to your favorite AI coding tools.

Dependable ways to offer value over time to your audience

Choose audiences, control spend, and measure impact with Ads Manager.

Since March, most creators who used the New Ads Manager experienced a 44% drop in cost per play and an 89% increase in quality play-through rates.

Find users for your experience with Ads Manager!

A great way to find initial players for your game!

Use the Reactivate Users objective to bring users back

Learn how to create successful ads that drive traffic to your creations

Keep your experience social with text chat signal and custom matchmaking.

Chart your experience's growth and discover opportunities to improve

Learn how to apply movement to your characters and environments

This April 2026 update introduces new tools to accelerate development.

The team answers audience questions for the latest features.

Learn how to put together an asset repo for an FPS with Hal_Apenyo.

Learn how to upload or use assets from Store in your creations

Create stylish boots with auto setup to speed up the process!

Learn how to convert a model into an avatar in less than 5 minutes.

Create Avatar items and publish it to Marketplace

Sorted by highest revenue over the last 7 days

Learn about what you can make and sell on the marketplace

The avatar represents every Roblox user as a customizable character

Create a fashionable bag and charm from scratch!

Manage your permanent and temporary bans from Creator Hub.

See this thread of cool creations being built by the community

Learn basic modeling techniques in blender

Find models, scripts, and plugins made by other creators

Two new programs to help you turn your vision into a launch-ready game with marketing support,  hands on partners, and a direct line into the Roblox team.

Learn how to cage your avatar items from Roblox's own 3D artist

Learn about cutscenes, camera shake, and even custom camera systems.

Learn how to configure characters to ensure all avatar features work properly

Learn how to create objects that interact with the world or other users

Learn best practices around client memory usage on low-end devices.

If you've used other engines, get comfortable developing on Roblox.

Make and sell your first basic clothing item on Roblox

Learn where to put code and how to organize by type or by feature.

Use Studio's collaboration tools to work with your team at the same time

Check out what’s trending on the Creator Marketplace

Check out what's trending on the Creator Store

Participate in community events held by other Creators

Find tutorials written by the Creator community

Learn how to implement a Connection invite reward system

Keep players engaged and monetized with content updates

Captivate your audience with an enjoyable gameplay cycle

Drive engagement and progress with fun, repetitive gameplay

Kick off your creator journey by making your very first place.

Learn how to create a sliding door without writing any code

Create your first experience or get Roblox Studio to unlock your full creation toolkit.

Alex shares first-hand experience behind creating the hit experience, Jailbreak

Blake found a passion in making realistic, quirky carnival games

The Clemens are the family-owned studio behind hits like The Survival Game

Jasmine is the artist behind some of the most popular avatar items on Marketplace

Jessica is the designer behind imaginative environments like in Alo Yoga

Jenni is the UGC creator and artist behind many popular collaborations

Morphist’s unique style combines cutesy and emo aesthetics

The Riotfall creators travel to find inspiration for their immersive environments

Stephen shares their love of programming tools

Sam shares how they got started designing fashion items that they wish existed

All objects that make up a 3D world, such as parts and lighting

Use data stores to save player progress and handle player position.

Learn about the range of debugging tools available in Studio

See your progress towards your next cash out!

Use the developer console to debug your experience when testing

Adding subscriptions to your experience helps build long term relationships with your user base. Enable subscriptions before December 15, 2023, and enjoy 3 months of lower rates.

Look at the top Experiences out to get inspiration

Get started with Studio, Roblox’s creation engine

Add a few lines of code to unlock new dashboards to understand your onboarding and other funnels and track your in-game economy.

Minty teaches Enyu about constructive solid geometry.

Build live, cross-server events and cutscenes on a structured sequence

Learn how to create timed events for your experiences

Create time-based events for increased discoverability across Roblox. Announce your latest update, highlight an activity, or celebrate a milestone with your players!

Learn about how to target the age group right for your Creation through Experienced Guidelines

Gain knowledge and expertise directly from Roblox

Start your next first-person shooter with a three-lane design.

Learn how to implement a friend invite reward system

Understand the basics of how to create a game

Learn how you can control how your data is used to train AI. {linkStart}Read More{linkEnd}

Easily create custom textures using our AI tools

Use our all-in-one creation engine to build anything you can imagine

PolarCub shares all the tips tricks to make UGC items

Learn best practices for blocking out your environments.

Leverage Guilded to build a community for your Creation

Catch up with voguebrunette and create a hairstyle. With a headband!

Join our incredible cast of creators for a Halloween game jam

Learn how testing on hardware is critical to your development process.

Use the head part to create facial animations or trigger emotes

Using metrics to understand where you can improve your gameplay

Figure out how to keep them coming back to your game

User input allow users to interact with your experience environment

Dive into case studies for building easy-to-extend control schemes.

Guide players through their first time playing your experience

Create clothing that stretchs and fit over any avatar body

At Roblox, we believe you learn best by doing. Choose one of our guides to explore more of what the platform offers.

Get help writing code and answers to your creation questions

The Lighting and SoundService let you control environmental effects

Take a deep dive into lighting your environment and adding terrain.

Learn how to adapt your content to different languages and cultural norms

Roblox's LOD settings can help your experience look better and run better.

Object-oriented programming in Luau. When does it make sense?

This walkthrough covers attachments, beams, and some basic scripting concepts that shows you how to set player health to 0 if they touch something

Cultivating an active player base is an instrumental part of developing a successful and enduring game.

Learn how to use the LuauHeap tool to keep an eye on memory usage.

Get started with the performance optimization and troubleshooting tool

Microprofiler provides timing information for the task scheduler

Dive deep into frame colors, flame graphs, and more

Learn how module scripts work and when to use them.

Understand how to use metrics to be more successful

Improve the performance of computationally intensive Luau scripts

View your daily benchmarks, insights, and real-time metrics to take {boldStart}{experienceName}{boldEnd} to the next level.

Check your eligibility to publish before late May.

Learn how to use NPCs (non-player characters) in your experiences

@minty creates an obby live from scratch using suggestions from chat

Our platform provides you with unparalleled opportunities to create. Get started by exploring the Creator Hub, Roblox Studio, and our vibrant Creator community.

Our platform provides you with unparalleled opportunities to create.

Apply to our Jumpstart and Incubator programs to build the next hit game on Roblox.

Explore and tap into fanbases of beloved global IPs.

Apply to full or part time jobs from leading studios in our new Talent Hub.

Our community of award-winning studios and self-taught creators all started here, just like you. 

A principal environment artist at Roblox covers how and why to use packages

Learn how to deal with the most common performance problems.

Staff stream about gravity, material properties, and constraints

Learn about what happens when a user joins an experience

Plugins add additional features or functionality to your creations

Let's tour PolarCub's UGC Homestore! Also, Temprist shows up.

Finalize your assets, spruce up your terrain, add effects, and oh my.

Learn how to drive traffic and awareness to your creations

Catch up on all the highlights from this year's RDC

Learn how to sell and promote avatar items with insights from the experts.

Learn efficient workflows for making avatar items in Blender.

Madison_Hatter2 shows how to texture and publish a simple avatar item.

Learn about what’s possible with our creation engine

Use the recommendation service to surface personalized content.

Iterate on your models so much more easily with the new reimport feature.

Learn how to implement rewarded video ads in your experiences.

Hear all about running a studio from the creator of Dead Rails.

Learn hwo to rig an R15 humanoid character model

Make and sell your first basic rigid accessory on Roblox

Get a preview of some of the new features and capabilities coming soon to Roblox

Studio is the tool that lets you create experiences on Roblox

DucksAreYellow and Rush Bogin talk best practices and gotchas for UGC.

Learn how to use the script editor in Studio to create custom scripts

Andrew shows you where to place your scripts, so they run properly.

Scripting lets you add immersive interactions for your users

Now run ads across Home and Search in the new Ads Manager. {learnMoreLinkStart}Learn More{learnMoreLinkEnd}

Learn how optimism and time travel power the server authority beta.

Make and sell your first pair of shoes on Roblox.

Learn Studio shortcuts and key commands that make building quicker

What are the pros and cons of the two approaches?

Keep your transitions smooth even when the target value changes.

Learn how to integrate features that allow players to play with friends

Learn how to integrate features that allow players to play with Connections

Create a Sponsored Ad to get your Creation in front of more Creators

Learn all about programming NPC AI with a finite state machine.

When should you consider using an UnreliableRemoteEvent?

Collaborate with your team or just jot down your thoughts with comments.

An in-depth look at how to debug your code in Roblox Studio.

Studio is an all-in-one tool for building on Roblox. Try making something today!

Learn how to offer players recurring benefits for a monthly fee

Grow your experience with the help of other Creators

Use the terrain editor to generate and alter terrain in Studio

Experiences like {boldStart}{experienceName}{boldEnd} saw an average +8.5% lift in qualified play through rate with personalization.

Learn about all the best methods for telling time in Roblox experiences.

Translations can help your Creation reach tons of different audiences

Tour the new UGC Homestore template with Minty and SCHLEEMPH

Explore shadows and per-corner rounding for GUI objects.

Use the new Style Manager to create, manage, and apply UI styles.

Learn about how to build for Roblox's unique audience

What are they and how you can use them to build

Learn how Roblox verifies avatar UGC heads and other helpful tips.

Learn all about place versions, packages, and script history.

Watch a quick introduction to creating on Roblox, then jump into Studio

Add gameplay preview videos to your experience pages!

Read the latest announcements from Roblox Staff

Use this button to expand the updates sidebar again.

Manage and grow your creations all in one convenient place

Track performance metrics and user engagement for any creations

Now you can monitor experiences across all your groups

Workspace holds objects that you want the engine to render in your project

Staff stream covering parts, meshes, terrain, and lighting

Continue creating your experience or get Roblox Studio to unlock your full creation toolkit.

Intro to texturing for UGC ft. Madison_Hatter2

Click here to view updates

Every public experience must have a content maturity label to be playable.