/v1 and communicates exclusively over HTTPS using JSON.
Base URL
All requests must be sent to:Request Format
Send all request bodies as JSON and include the appropriate content-type header:GET and DELETE) should omit the header entirely.
Authentication
The API uses cookie-based authentication. After completing an OAuth flow, the server sets a signed access-token cookie (valid for 24 hours) and a refresh-token cookie (valid for 8 days) on your domain. Subsequent requests automatically include these cookies as long as you send them withcredentials: 'include' (or the equivalent in your HTTP client).
See the Authentication guide for a full walkthrough of how to obtain and refresh tokens.
Versioning
All endpoints are served under the/v1 path prefix. Breaking changes will be introduced under a new version prefix (e.g., /v2) with advance notice.
Endpoint Groups
Users
Look up user profiles and fetch Roblox avatar assets tied to a user account.
Characters
Create, update, submit, and cancel roleplay characters belonging to a user.
Economy
Read and modify character wallets that track in-game currency balances.
Banking
Manage banks, open accounts, track balances, and perform account operations.
OAuth
Initiate OAuth 2.0 flows with Discord and Roblox to authenticate your users.
Staff
Review, approve, and reject character submissions — restricted to staff roles.
