Skip to content

Auth v1

Reference for the Auth v1 endpoints on Roblox.

Base URL: https://auth.roblox.com

MethodPathName
GET/v1/account/pingetAccountPin
POST/v1/account/pinpostAccountPin
DELETE/v1/account/pindeleteAccountPin
PATCH/v1/account/pinpatchAccountPin
POST/v1/account/pin/lockpostAccountPinLock
POST/v1/account/pin/unlockpostAccountPinUnlock
GET/v1/auth/metadatagetAuthMetadata
GET/v1/client-assertiongetClientAssertion
GET/v1/external/:identityProviderId/sso/oauth/callbackgetExternalIdentityprovideridSsoOauthCallback
GET/v1/external/:identityProviderId/sso/oauth/initgetExternalIdentityprovideridSsoOauthInit
POST/v1/external/accesspostExternalAccess
POST/v1/external/loginpostExternalLogin
POST/v1/external/loginAndLinkpostExternalLoginandlink
POST/v1/external/signuppostExternalSignup
POST/v1/external/unlinkpostExternalUnlink
POST/v1/identity-verification/loginpostIdentityVerificationLogin
POST/v1/identity/initialize-loginpostIdentityInitializeLogin
POST/v1/loginpostLogin
POST/v1/login/linkedpostLoginLinked
POST/v1/logoutpostLogout
POST/v1/logoutfromallsessionsandreauthenticatepostLogoutfromallsessionsandreauthenticate
GET/v1/metadatagetMetadata
POST/v1/passkey/DeleteCredentialBatchpostPasskeyDeletecredentialbatch
POST/v1/passkey/finish-ar-preauth-registrationpostPasskeyFinishArPreauthRegistration
POST/v1/passkey/finish-preauth-registrationpostPasskeyFinishPreauthRegistration
POST/v1/passkey/FinishRegistrationpostPasskeyFinishregistration
POST/v1/passkey/ListCredentialspostPasskeyListcredentials
POST/v1/passkey/start-authentication-by-userpostPasskeyStartAuthenticationByUser
POST/v1/passkey/start-preauth-registrationpostPasskeyStartPreauthRegistration
POST/v1/passkey/StartAuthenticationpostPasskeyStartauthentication
POST/v1/passkey/StartRegistrationpostPasskeyStartregistration
GET/v1/passwords/validategetPasswordsValidate
POST/v1/passwords/validatepostPasswordsValidate
GET/v1/recovery/metadatagetRecoveryMetadata
GET/v1/revert/accountgetRevertAccount
POST/v1/revert/accountpostRevertAccount
POST/v1/revert/invalidate-ticketspostRevertInvalidateTickets
POST/v1/session/refreshpostSessionRefresh
POST/v1/signuppostSignup
POST/v1/signup/linkedpostSignupLinked
POST/v1/social/:provider/disconnectpostSocialProviderDisconnect
GET/v1/social/connected-providersgetSocialConnectedProviders
POST/v1/user/passwords/changepostUserPasswordsChange
POST/v1/usernamepostUsername
GET/v1/usernamesgetUsernames
POST/v1/usernames/recoverpostUsernamesRecover
GET/v1/usernames/validategetUsernamesValidate
POST/v1/usernames/validatepostUsernamesValidate
GET/v1/validators/emailgetValidatorsEmail
GET/v1/validators/recommendedUsernameFromDisplayNamegetValidatorsRecommendedusernamefromdisplayname
POST/v1/validators/recommendedUsernameFromDisplayNamepostValidatorsRecommendedusernamefromdisplayname
GET/v1/validators/usernamegetValidatorsUsername
POST/v1/validators/usernamepostValidatorsUsername
GET/v1/xbox/connectiongetXboxConnection
POST/v1/xbox/disconnectpostXboxDisconnect
GET/v1/xbox/get-login-consecutive-daysgetXboxGetLoginConsecutiveDays
POST/v1/xbox/translatepostXboxTranslate

GET /v1/account/pin

Gets the account pin status.

Usage
import { fetchApi } from 'rozod';
import { getAccountPin } from 'rozod/lib/endpoints/authv1';
const data = await fetchApi(getAccountPin, undefined);
FieldTypeDescription
isEnabledboolean
unlockedUntilnumber
StatusDescription
4010: Authorization has been denied for this request.

POST /v1/account/pin

Request to create the account pin.

Usage
import { fetchApi } from 'rozod';
import { postAccountPin } from 'rozod/lib/endpoints/authv1';
const data = await fetchApi(postAccountPin, {
body: { /* ... */ }
});
FieldTypeDescription
pinstring
reauthenticationTokenstring
FieldTypeDescription
successboolean
StatusDescription
4010: Authorization has been denied for this request.
4030: Token Validation Failed

DELETE /v1/account/pin

Request for deletes the account pin from the account.

Usage
import { fetchApi } from 'rozod';
import { deleteAccountPin } from 'rozod/lib/endpoints/authv1';
const data = await fetchApi(deleteAccountPin, {
body: { /* ... */ }
});

Type: ModelsAccountPinRequest.optional()

FieldTypeDescription
successboolean
StatusDescription
4010: Authorization has been denied for this request.
4030: Token Validation Failed

PATCH /v1/account/pin

Request made to update the account pin on the account.

Usage
import { fetchApi } from 'rozod';
import { patchAccountPin } from 'rozod/lib/endpoints/authv1';
const data = await fetchApi(patchAccountPin, {
body: { /* ... */ }
});
FieldTypeDescription
pinstring
reauthenticationTokenstring
FieldTypeDescription
successboolean
StatusDescription
4010: Authorization has been denied for this request.
4030: Token Validation Failed

POST /v1/account/pin/lock

Request to locks the account which has an account pin enabled.

Usage
import { fetchApi } from 'rozod';
import { postAccountPinLock } from 'rozod/lib/endpoints/authv1';
const data = await fetchApi(postAccountPinLock, undefined);
FieldTypeDescription
successboolean
StatusDescription
4010: Authorization has been denied for this request.
4030: Token Validation Failed

POST /v1/account/pin/unlock

Requests to unlock the account pin.

Usage
import { fetchApi } from 'rozod';
import { postAccountPinUnlock } from 'rozod/lib/endpoints/authv1';
const data = await fetchApi(postAccountPinUnlock, {
body: { /* ... */ }
});
FieldTypeDescription
pinstring
reauthenticationTokenstring
FieldTypeDescription
unlockedUntilnumber
StatusDescription
4010: Authorization has been denied for this request.
4030: Token Validation Failed

GET /v1/auth/metadata

Gets Auth meta data

Usage
import { fetchApi } from 'rozod';
import { getAuthMetadata } from 'rozod/lib/endpoints/authv1';
const data = await fetchApi(getAuthMetadata, undefined);
FieldTypeDescription
cookieLawNoticeTimeoutnumber

GET /v1/client-assertion

Creates a client assertion to be used when generating an auth ticket.

Usage
import { fetchApi } from 'rozod';
import { getClientAssertion } from 'rozod/lib/endpoints/authv1';
const data = await fetchApi(getClientAssertion, undefined);
FieldTypeDescription
clientAssertionstring
StatusDescription
4010: Authorization has been denied for this request.

getExternalIdentityprovideridSsoOauthCallback

Section titled “getExternalIdentityprovideridSsoOauthCallback”

GET /v1/external/:identityProviderId/sso/oauth/callback

Callback function that external identity provider calls post user authentication.

Usage
import { fetchApi } from 'rozod';
import { getExternalIdentityprovideridSsoOauthCallback } from 'rozod/lib/endpoints/authv1';
const data = await fetchApi(getExternalIdentityprovideridSsoOauthCallback, {
identityProviderId: /* integer */,
code: /* string */,
state: /* string */
});
NameTypeRequiredDescription
identityProviderIdintegerYes
codestringYes
statestringYes

Type: unknown

StatusDescription
302Redirect

GET /v1/external/:identityProviderId/sso/oauth/init

Signs a user up for Roblox and links the account to the authenticated external provider ID.

Usage
import { fetchApi } from 'rozod';
import { getExternalIdentityprovideridSsoOauthInit } from 'rozod/lib/endpoints/authv1';
const data = await fetchApi(getExternalIdentityprovideridSsoOauthInit, {
identityProviderId: /* integer */
});
NameTypeRequiredDescription
identityProviderIdintegerYes

Type: unknown

StatusDescription
302Redirect

POST /v1/external/access

Signs a user up for Roblox and links the account to the authenticated external provider ID.

Usage
import { fetchApi } from 'rozod';
import { postExternalAccess } from 'rozod/lib/endpoints/authv1';
const data = await fetchApi(postExternalAccess, {
body: { /* ... */ }
});
FieldTypeDescription
authenticationProofstring
identityProviderPlatformType`“Undefined""Xbox"
additionalInfoPayloadobjectSee below
FieldTypeDescription
placeIdnumber
isolationContextstring
launchDatastring

POST /v1/external/login

Logs in a user to Roblox based on the user’s authenticated external provider session

Usage
import { fetchApi } from 'rozod';
import { postExternalLogin } from 'rozod/lib/endpoints/authv1';
const data = await fetchApi(postExternalLogin, {
body: { /* ... */ }
});
FieldTypeDescription
identityProvider`01
additionalDataobjectSee below
authenticationProofstring
FieldTypeDescription
successboolean
StatusDescription
40030: Platform is not supported for SSO login.
40131: No linked account found for SSO login.
4030: Token Validation Failed
5000: An unexpected error occurred.
5010: An unexpected error occurred.

POST /v1/external/loginAndLink

Deprecated endpoint

Usage
import { fetchApi } from 'rozod';
import { postExternalLoginandlink } from 'rozod/lib/endpoints/authv1';
const data = await fetchApi(postExternalLoginandlink, {
body: { /* ... */ }
});
FieldTypeDescription
ctype`“Email""Username"
cvaluestring
passwordstring
authenticationProofstring
IdentityProviderPlatformType`“Undefined""Xbox"
additionalInfoPayloadobjectSee below
FieldTypeDescription
userobjectSee below
twoStepVerificationDataobjectSee below
identityVerificationLoginTicketstring
isBannedboolean
accountBlobstring
shouldUpdateEmailboolean
recoveryEmailstring
passkeyRegistrationSucceededboolean
shouldAutoLoginFromRecoveryboolean
shouldPrompt2svRemovalboolean
shouldPromptPasskeyAdditionboolean

user fields:

FieldTypeDescription
idnumber
namestring
displayNamestring

twoStepVerificationData fields:

FieldTypeDescription
mediaType`“Email""SMS"
ticketstring
StatusDescription
4030: Token Validation Failed

POST /v1/external/signup

Signs a user up for Roblox and links the account to the authenticated external provider ID

Usage
import { fetchApi } from 'rozod';
import { postExternalSignup } from 'rozod/lib/endpoints/authv1';
const data = await fetchApi(postExternalSignup, {
body: { /* ... */ }
});
FieldTypeDescription
usernamestring
passwordstring
birthdaystring
localestring
authenticationProofstring
IdentityProviderPlatformType`“Undefined""Xbox"
additionalInfoPayloadobjectSee below

Type: unknown

StatusDescription
4030: Token Validation Failed

POST /v1/external/unlink

Unlink the logged in Roblox account from the current external provider ID

Usage
import { fetchApi } from 'rozod';
import { postExternalUnlink } from 'rozod/lib/endpoints/authv1';
const data = await fetchApi(postExternalUnlink, {
body: { /* ... */ }
});
FieldTypeDescription
IdentityProviderPlatformType`“Undefined""Xbox"
additionalInfoPayloadobjectSee below

Type: unknown

StatusDescription
4030: Token Validation Failed

POST /v1/identity-verification/login

Endpoint for login with identity verification

Usage
import { fetchApi } from 'rozod';
import { postIdentityVerificationLogin } from 'rozod/lib/endpoints/authv1';
const data = await fetchApi(postIdentityVerificationLogin, {
body: { /* ... */ }
});
FieldTypeDescription
loginTicketstring
resultTokenstring

Type: unknown

StatusDescription
4030: Token Validation Failed
1: Invalid login ticket.
2: Invalid result token.
3: Invalid user.
4: Authentication failure.

POST /v1/identity/initialize-login

Initiates identifier-first login flow by returning a list of login methods for user(s).

Usage
import { fetchApi } from 'rozod';
import { postIdentityInitializeLogin } from 'rozod/lib/endpoints/authv1';
const data = await fetchApi(postIdentityInitializeLogin, {
body: { /* ... */ }
});
FieldTypeDescription
ctype`01
cvaluestring
captchaIdstring | undefined
captchaTokenstring | undefined
captchaProviderstring | undefined
challengeIdstring | undefined
FieldTypeDescription
loginMethodsobject[]See below

loginMethods[] item fields:

FieldTypeDescription
method`“EmailOtp""Passkey"
prioritynumber
StatusDescription
4003: User identifier and type are required.
4030: Token Validation Failed
2: Invalid user identifier.
5000: An unknown error occurred.
5031: This feature is disabled.

POST /v1/login

Authenticates a user.

Usage
import { fetchApi } from 'rozod';
import { postLogin } from 'rozod/lib/endpoints/authv1';
const data = await fetchApi(postLogin, {
body: { /* ... */ }
});
FieldTypeDescription
ctype`“Email""Username"
cvaluestring
passwordstring
userIdnumber
securityQuestionSessionIdstring
securityQuestionRedemptionTokenstring
secureAuthenticationIntentobjectSee below
accountBlobstring
accountLinkParametersobjectSee below
captchaIdstring
captchaTokenstring
captchaProviderstring
challengeIdstring

secureAuthenticationIntent fields:

FieldTypeDescription
clientPublicKeystring
clientEpochTimestampnumber
saiSignaturestring
serverNoncestring

accountLinkParameters fields:

FieldTypeDescription
LinkingPlatform`“Invalid""Xbox"
FieldTypeDescription
userobjectSee below
twoStepVerificationDataobjectSee below
identityVerificationLoginTicketstring
isBannedboolean
accountBlobstring
shouldUpdateEmailboolean
recoveryEmailstring
passkeyRegistrationSucceededboolean
shouldAutoLoginFromRecoveryboolean
shouldPrompt2svRemovalboolean
shouldPromptPasskeyAdditionboolean

user fields:

FieldTypeDescription
idnumber
namestring
displayNamestring

twoStepVerificationData fields:

FieldTypeDescription
mediaType`“Email""SMS"
ticketstring
StatusDescription
4000: An unexpected error occurred.
3: Username and Password are required. Please try again.
8: Login with received credential type is not supported.
4030: Token Validation Failed
1: Incorrect username or password. Please try again.
2: You must pass the robot test before logging in.
4: Account has been locked. Please request a password reset.
5: Unable to login. Please use Social Network sign on.
6: Account issue. Please contact Support.
9: Unable to login with provided credentials. Default login is required.
10: Received credentials are unverified.
12: Existing login session found. Please log out first.
14: The account is unable to log in. Please log in to the LuoBu app.
15: Too many attempts. Please wait a bit.
27: The account is unable to login. Please log in with the VNG app.
4297: Too many attempts. Please wait a bit.
50311: Service unavailable. Please try again.

POST /v1/login/linked

Endpoint for logging in a user, specifically for linked

Usage
import { fetchApi } from 'rozod';
import { postLoginLinked } from 'rozod/lib/endpoints/authv1';
const data = await fetchApi(postLoginLinked, {
body: { /* ... */ }
});
FieldTypeDescription
ctype`“Email""Username"
cvaluestring
passwordstring
userIdnumber
securityQuestionSessionIdstring
securityQuestionRedemptionTokenstring
secureAuthenticationIntentobjectSee below
accountBlobstring
accountLinkParametersobjectSee below
captchaIdstring
captchaTokenstring
captchaProviderstring
challengeIdstring

secureAuthenticationIntent fields:

FieldTypeDescription
clientPublicKeystring
clientEpochTimestampnumber
saiSignaturestring
serverNoncestring

accountLinkParameters fields:

FieldTypeDescription
LinkingPlatform`“Invalid""Xbox"
FieldTypeDescription
userobjectSee below
twoStepVerificationDataobjectSee below
identityVerificationLoginTicketstring
isBannedboolean
accountBlobstring
shouldUpdateEmailboolean
recoveryEmailstring
passkeyRegistrationSucceededboolean
shouldAutoLoginFromRecoveryboolean
shouldPrompt2svRemovalboolean
shouldPromptPasskeyAdditionboolean

user fields:

FieldTypeDescription
idnumber
namestring
displayNamestring

twoStepVerificationData fields:

FieldTypeDescription
mediaType`“Email""SMS"
ticketstring
StatusDescription
4000: An unexpected error occurred.
3: Username and Password are required. Please try again.
8: Login with received credential type is not supported.
4030: Token Validation Failed
1: Incorrect username or password. Please try again.
2: You must pass the robot test before logging in.
4: Account has been locked. Please request a password reset.
5: Unable to login. Please use Social Network sign on.
6: Account issue. Please contact Support.
9: Unable to login with provided credentials. Default login is required.
10: Received credentials are unverified.
12: Existing login session found. Please log out first.
14: The account is unable to log in. Please log in to the LuoBu app.
15: Too many attempts. Please wait a bit.
27: The account is unable to login. Please log in with the VNG app.
4297: Too many attempts. Please wait a bit.
50311: Service unavailable. Please try again.

POST /v1/logout

Destroys the current authentication session.

Usage
import { fetchApi } from 'rozod';
import { postLogout } from 'rozod/lib/endpoints/authv1';
const data = await fetchApi(postLogout, undefined);

Type: unknown

StatusDescription
4010: Authorization has been denied for this request.
4030: Token Validation Failed

postLogoutfromallsessionsandreauthenticate

Section titled “postLogoutfromallsessionsandreauthenticate”

POST /v1/logoutfromallsessionsandreauthenticate

Logs out user from all other sessions.

Usage
import { fetchApi } from 'rozod';
import { postLogoutfromallsessionsandreauthenticate } from 'rozod/lib/endpoints/authv1';
const data = await fetchApi(postLogoutfromallsessionsandreauthenticate, {
body: { /* ... */ }
});
FieldTypeDescription
SecureAuthenticationIntentobjectSee below

SecureAuthenticationIntent fields:

FieldTypeDescription
clientPublicKeystring
clientEpochTimestampnumber
saiSignaturestring
serverNoncestring

Type: unknown

StatusDescription
4010: Authorization has been denied for this request.
4030: Token Validation Failed

GET /v1/metadata

Get the metadata

Usage
import { fetchApi } from 'rozod';
import { getMetadata } from 'rozod/lib/endpoints/authv1';
const data = await fetchApi(getMetadata, undefined);
FieldTypeDescription
isUpdateUsernameEnabledboolean
ftuxAvatarAssetMapstring
IsEmailUpsellAtLogoutEnabledboolean
ShouldFetchEmailUpsellIXPValuesAtLogoutboolean
IsAccountRecoveryPromptEnabledboolean
IsContactMethodRequiredAtSignupboolean
IsUserAgreementsSignupIntegrationEnabledboolean
IsPasswordRequiredForUsernameChangeboolean
IsPasskeyFeatureEnabledboolean
IsAltBrowserTrackerboolean
IsLoginRedirectPageEnabledboolean

POST /v1/passkey/DeleteCredentialBatch

Disables a batch of credentials for the specified user.

Usage
import { fetchApi } from 'rozod';
import { postPasskeyDeletecredentialbatch } from 'rozod/lib/endpoints/authv1';
const data = await fetchApi(postPasskeyDeletecredentialbatch, {
body: { /* ... */ }
});
FieldTypeDescription
credentialNicknamesstring[]

Type: unknown

StatusDescription
4010: Authorization has been denied for this request.
0: An unknown error occurred with the request.
4030: Token Validation Failed
5032: Feature disabled.

POST /v1/passkey/finish-ar-preauth-registration

Finishes account recovery pre-auth passkey registration by validating the recovery session,

Usage
import { fetchApi } from 'rozod';
import { postPasskeyFinishArPreauthRegistration } from 'rozod/lib/endpoints/authv1';
const data = await fetchApi(postPasskeyFinishArPreauthRegistration, {
body: { /* ... */ }
});
FieldTypeDescription
recoverySessionstring
passkeySessionIdstring
passkeyRegistrationResponsestring
userIdnumber
isPostRecoveryboolean

Type: unknown

StatusDescription
4000: An unknown error occurred with the request.
4010: An unknown error occurred with the request.
4030: Token Validation Failed
1: Reached limit of pass keys registered.
5000: An unknown error occurred with the request.
5032: Feature disabled.

POST /v1/passkey/finish-preauth-registration

Usage
import { fetchApi } from 'rozod';
import { postPasskeyFinishPreauthRegistration } from 'rozod/lib/endpoints/authv1';
const data = await fetchApi(postPasskeyFinishPreauthRegistration, {
body: { /* ... */ }
});
FieldTypeDescription
sessionIdstring
registrationResponsestring

Type: unknown

StatusDescription
4000: An unknown error occurred with the request.
4010: Authorization has been denied for this request.
0: An unknown error occurred with the request.
4030: Token Validation Failed
1: Reached limit of pass keys registered.
5000: An unknown error occurred with the request.
5032: Feature disabled.

POST /v1/passkey/FinishRegistration

Complete Passkey registration by providing credential creation options.

Usage
import { fetchApi } from 'rozod';
import { postPasskeyFinishregistration } from 'rozod/lib/endpoints/authv1';
const data = await fetchApi(postPasskeyFinishregistration, {
body: { /* ... */ }
});
FieldTypeDescription
sessionIdstring
credentialNicknamestring
attestationResponsestring

Type: unknown

StatusDescription
4000: An unknown error occurred with the request.
3: Invalid security key nickname.
4010: Authorization has been denied for this request.
0: An unknown error occurred with the request.
4030: Token Validation Failed
3: Invalid security key nickname.
5032: Feature disabled.

POST /v1/passkey/ListCredentials

List a user’s registered passkeys.

Usage
import { fetchApi } from 'rozod';
import { postPasskeyListcredentials } from 'rozod/lib/endpoints/authv1';
const data = await fetchApi(postPasskeyListcredentials, {
body: { /* ... */ }
});
FieldTypeDescription
allboolean
FieldTypeDescription
credentialsobject[]See below

credentials[] item fields:

FieldTypeDescription
nicknamestring
StatusDescription
4010: Authorization has been denied for this request.
0: An unknown error occurred with the request.
4030: Token Validation Failed
5032: Feature disabled.

POST /v1/passkey/start-authentication-by-user

Initializes passkey authentication for the user(s) corresponding to the identifier provided.

Usage
import { fetchApi } from 'rozod';
import { postPasskeyStartAuthenticationByUser } from 'rozod/lib/endpoints/authv1';
const data = await fetchApi(postPasskeyStartAuthenticationByUser, {
body: { /* ... */ }
});
FieldTypeDescription
ctype`01
cvaluestring
FieldTypeDescription
authenticationOptionsstring
sessionIdstring
StatusDescription
4005: User identifier and type are required.
6: Multi-user passkey authentication is not supported for this credential type.
4030: Token Validation Failed
4: No passkeys registered for any users found.
5032: Feature disabled.

POST /v1/passkey/start-preauth-registration

Initiates Passkey preauthenticated registration by providing credential creation options.

Usage
import { fetchApi } from 'rozod';
import { postPasskeyStartPreauthRegistration } from 'rozod/lib/endpoints/authv1';
const data = await fetchApi(postPasskeyStartPreauthRegistration, {
body: { /* ... */ }
});
FieldTypeDescription
usernamestring
FieldTypeDescription
creationOptionsstring
sessionIdstring
StatusDescription
4030: Token Validation Failed
5032: Feature disabled.

POST /v1/passkey/StartAuthentication

Provides a challenge for the Passkey to authenticate.

Usage
import { fetchApi } from 'rozod';
import { postPasskeyStartauthentication } from 'rozod/lib/endpoints/authv1';
const data = await fetchApi(postPasskeyStartauthentication, undefined);
FieldTypeDescription
authenticationOptionsstring
sessionIdstring
StatusDescription
4030: Token Validation Failed
5032: Feature disabled.

POST /v1/passkey/StartRegistration

Initiates Passkey registration by providing credential creation options.

Usage
import { fetchApi } from 'rozod';
import { postPasskeyStartregistration } from 'rozod/lib/endpoints/authv1';
const data = await fetchApi(postPasskeyStartregistration, {
flow: /* string? */,
body: { /* ... */ }
});
NameTypeRequiredDescription
flowstring?No
FieldTypeDescription
isSilentUpgradeboolean
FieldTypeDescription
creationOptionsstring
sessionIdstring
StatusDescription
4010: Authorization has been denied for this request.
0: An unknown error occurred with the request.
4030: Token Validation Failed
1: Reached limit of pass keys registered.
5032: Feature disabled.

GET /v1/passwords/validate

Endpoint for checking if a password is valid.

Usage
import { fetchApi } from 'rozod';
import { getPasswordsValidate } from 'rozod/lib/endpoints/authv1';
const data = await fetchApi(getPasswordsValidate, {
Username: /* string */,
Password: /* string */
});
NameTypeRequiredDescription
UsernamestringYes
PasswordstringYes
FieldTypeDescription
code`“ValidPassword""WeakPasswordError"
messagestring
StatusDescription
4001: Valid Username and Password are required. Please try again.

POST /v1/passwords/validate

Endpoint for checking if a password is valid.

Usage
import { fetchApi } from 'rozod';
import { postPasswordsValidate } from 'rozod/lib/endpoints/authv1';
const data = await fetchApi(postPasswordsValidate, {
body: { /* ... */ }
});
FieldTypeDescription
usernamestring
passwordstring
FieldTypeDescription
code`“ValidPassword""WeakPasswordError"
messagestring
StatusDescription
4001: Valid Username and Password are required. Please try again.
4030: Token Validation Failed

GET /v1/recovery/metadata

Get metadata for forgot endpoints

Usage
import { fetchApi } from 'rozod';
import { getRecoveryMetadata } from 'rozod/lib/endpoints/authv1';
const data = await fetchApi(getRecoveryMetadata, undefined);
FieldTypeDescription
isOnPhoneboolean
codeLengthnumber
isPhoneFeatureEnabledForUsernameboolean
isPhoneFeatureEnabledForPasswordboolean
isBedev2CaptchaEnabledForPasswordResetboolean
isUsernameRecoveryDeprecatedboolean
StatusDescription
5037: The Roblox WeChat API is currently unavailable.

GET /v1/revert/account

Get Revert Account ticket info

Usage
import { fetchApi } from 'rozod';
import { getRevertAccount } from 'rozod/lib/endpoints/authv1';
const data = await fetchApi(getRevertAccount, {
ticket: /* string */
});
NameTypeRequiredDescription
ticketstringYesTicket Guid to revert account.
FieldTypeDescription
isTwoStepVerificationEnabledboolean
isEmailVerifiedboolean
isEmailChangedboolean
isPhoneVerifiedboolean
userIdnumber
usernamestring
ticketstring
StatusDescription
4002: The account revert ticket is not valid
40313: Revert links are disabled for users in the Enhanced Protection Program.
5031: This feature is disabled

POST /v1/revert/account

Submit Revert Account Request

Usage
import { fetchApi } from 'rozod';
import { postRevertAccount } from 'rozod/lib/endpoints/authv1';
const data = await fetchApi(postRevertAccount, {
body: { /* ... */ }
});
FieldTypeDescription
UserIdnumber
NewPasswordstring
NewPasswordRepeatedstring
Ticketstring
TwoStepVerificationChallengeIdstring
TwoStepVerificationTokenstring
FieldTypeDescription
userobjectSee below
twoStepVerificationDataobjectSee below
identityVerificationLoginTicketstring
isBannedboolean
accountBlobstring
shouldUpdateEmailboolean
recoveryEmailstring
passkeyRegistrationSucceededboolean
shouldAutoLoginFromRecoveryboolean
shouldPrompt2svRemovalboolean
shouldPromptPasskeyAdditionboolean

user fields:

FieldTypeDescription
idnumber
namestring
displayNamestring

twoStepVerificationData fields:

FieldTypeDescription
mediaType`“Email""SMS"
ticketstring
StatusDescription
4002: The account revert ticket is not valid
3: Password is not valid
4: Passwords do not match
5: Password cannot be used
8: The account security ticket is expired.
4030: Token Validation Failed
5030: Unknown
1: This feature is disabled

POST /v1/revert/invalidate-tickets

Invalidates all account security tickets for the authenticated user.

Usage
import { fetchApi } from 'rozod';
import { postRevertInvalidateTickets } from 'rozod/lib/endpoints/authv1';
const data = await fetchApi(postRevertInvalidateTickets, undefined);

Type: unknown

StatusDescription
4010: Authorization has been denied for this request.
4030: Token Validation Failed
5031: This feature is disabled

POST /v1/session/refresh

Logs out user from the current session and create a new one.

Usage
import { fetchApi } from 'rozod';
import { postSessionRefresh } from 'rozod/lib/endpoints/authv1';
const data = await fetchApi(postSessionRefresh, undefined);

Type: unknown

StatusDescription
4010: Authorization has been denied for this request.
4030: Token Validation Failed

POST /v1/signup

Endpoint for signing up a new user

Usage
import { fetchApi } from 'rozod';
import { postSignup } from 'rozod/lib/endpoints/authv1';
const data = await fetchApi(postSignup, {
body: { /* ... */ }
});
FieldTypeDescription
usernamestring
passwordstring
gender`“Unknown""Male"
birthdaystring
displayNamestring
isTosAgreementBoxCheckedboolean
emailstring
localestring
assetIdsnumber[]
bodyColorIdnumber
bodyTypeScalenumber
headScalenumber
heightScalenumber
widthScalenumber
proportionScalenumber
referralDataobjectSee below
agreementIdsstring[]
identityVerificationResultTokenstring
secureAuthenticationIntentobjectSee below
otpSessionobjectSee below
dataTokenstring
accountBlobstring
passkeySessionIdstring
passkeyRegistrationResponsestring
accountLinkParametersobjectSee below
auditSystemContentobjectSee below
captchaIdstring
captchaTokenstring
captchaProviderstring
challengeIdstring

referralData fields:

FieldTypeDescription
acquisitionTimestring
acquisitionReferrerstring
mediumstring
sourcestring
campaignstring
adGroupstring
keywordstring
matchTypestring
sendInfoboolean
requestSessionIdstring
offerIdstring

secureAuthenticationIntent fields:

FieldTypeDescription
clientPublicKeystring
clientEpochTimestampnumber
saiSignaturestring
serverNoncestring

otpSession fields:

FieldTypeDescription
otpSessionTokenstring
otpContactType`“Unset""Email"

accountLinkParameters fields:

FieldTypeDescription
LinkingPlatform`“Invalid""Xbox"

auditSystemContent fields:

FieldTypeDescription
capturedAuditContentobjectSee below
additionalAuditContentstring

capturedAuditContent fields:

FieldTypeDescription
translationKeystring
translationNamespacestring
translatedSourceStringstring
parametersstring
FieldTypeDescription
userIdnumber
starterPlaceIdnumber
returnUrlstring
accountBlobstring
StatusDescription
400Bad request
16: User agreement ids are null.
21: Empty account switch blob required
4030: Token Validation Failed
2: Captcha Failed.
4: Invalid Birthday.
5: Invalid Username.
6: Username already taken.
7: Invalid Password.
8: Password and Username are same.
9: Password is too simple.
10: Email is invalid.
11: Asset is invalid.
12: Too many attempts. Please wait a bit.
17: One time Passcode session was not valid
22: Maximum logged in accounts limit reached.
4293: Too many attempts. Please wait a bit.
500Internal server error
15: Insert acceptances failed.
27: Pre-auth passkey registration failed
503Service unavailable

POST /v1/signup/linked

Endpoint for signing up a new user, specifically for linked

Usage
import { fetchApi } from 'rozod';
import { postSignupLinked } from 'rozod/lib/endpoints/authv1';
const data = await fetchApi(postSignupLinked, {
body: { /* ... */ }
});
FieldTypeDescription
usernamestring
passwordstring
gender`“Unknown""Male"
birthdaystring
displayNamestring
isTosAgreementBoxCheckedboolean
emailstring
localestring
assetIdsnumber[]
bodyColorIdnumber
bodyTypeScalenumber
headScalenumber
heightScalenumber
widthScalenumber
proportionScalenumber
referralDataobjectSee below
agreementIdsstring[]
identityVerificationResultTokenstring
secureAuthenticationIntentobjectSee below
otpSessionobjectSee below
dataTokenstring
accountBlobstring
passkeySessionIdstring
passkeyRegistrationResponsestring
accountLinkParametersobjectSee below
auditSystemContentobjectSee below
captchaIdstring
captchaTokenstring
captchaProviderstring
challengeIdstring

referralData fields:

FieldTypeDescription
acquisitionTimestring
acquisitionReferrerstring
mediumstring
sourcestring
campaignstring
adGroupstring
keywordstring
matchTypestring
sendInfoboolean
requestSessionIdstring
offerIdstring

secureAuthenticationIntent fields:

FieldTypeDescription
clientPublicKeystring
clientEpochTimestampnumber
saiSignaturestring
serverNoncestring

otpSession fields:

FieldTypeDescription
otpSessionTokenstring
otpContactType`“Unset""Email"

accountLinkParameters fields:

FieldTypeDescription
LinkingPlatform`“Invalid""Xbox"

auditSystemContent fields:

FieldTypeDescription
capturedAuditContentobjectSee below
additionalAuditContentstring

capturedAuditContent fields:

FieldTypeDescription
translationKeystring
translationNamespacestring
translatedSourceStringstring
parametersstring
FieldTypeDescription
userIdnumber
starterPlaceIdnumber
returnUrlstring
accountBlobstring
StatusDescription
400Bad request
16: User agreement ids are null.
21: Empty account switch blob required
4030: Token Validation Failed
2: Captcha Failed.
4: Invalid Birthday.
5: Invalid Username.
6: Username already taken.
7: Invalid Password.
8: Password and Username are same.
9: Password is too simple.
10: Email is invalid.
11: Asset is invalid.
12: Too many attempts. Please wait a bit.
17: One time Passcode session was not valid
22: Maximum logged in accounts limit reached.
4293: Too many attempts. Please wait a bit.
500Internal server error
15: Insert acceptances failed.
27: Pre-auth passkey registration failed

POST /v1/social/:provider/disconnect

Removes the given social authentication method from current Roblox user if it is connected.

Usage
import { fetchApi } from 'rozod';
import { postSocialProviderDisconnect } from 'rozod/lib/endpoints/authv1';
const data = await fetchApi(postSocialProviderDisconnect, {
provider: /* string */,
body: { /* ... */ }
});
NameTypeRequiredDescription
providerstringYesThe social authentication provider, e.g. Facebook
FieldTypeDescription
Passwordstring

Type: unknown

StatusDescription
400Bad request
2: Unsupported social provider type.
4010: Authorization has been denied for this request.
403Forbidden
0: Token Validation Failed
3: Cannot disconnect the only authentication method. Password on account is required.
4: The password provided is invalid.
500Internal server error

GET /v1/social/connected-providers

Get social network user information if the given social auth method is connected to current user.

Usage
import { fetchApi } from 'rozod';
import { getSocialConnectedProviders } from 'rozod/lib/endpoints/authv1';
const data = await fetchApi(getSocialConnectedProviders, undefined);
FieldTypeDescription
providersobject[]See below

providers[] item fields:

FieldTypeDescription
providerstring
identifierstring
StatusDescription
4010: Authorization has been denied for this request.

POST /v1/user/passwords/change

Changes the password for the authenticated user.

Usage
import { fetchApi } from 'rozod';
import { postUserPasswordsChange } from 'rozod/lib/endpoints/authv1';
const data = await fetchApi(postUserPasswordsChange, {
body: { /* ... */ }
});
FieldTypeDescription
currentPasswordstring
newPasswordstring
secureAuthenticationIntentobjectSee below

secureAuthenticationIntent fields:

FieldTypeDescription
clientPublicKeystring
clientEpochTimestampnumber
saiSignaturestring
serverNoncestring

Type: unknown

StatusDescription
400Roblox.Web.Authentication.Passwords.PasswordResponseCodes.InvalidCurrentPassword
OR
Roblox.Web.Authentication.Passwords.PasswordResponseCodes.InvalidPassword
4010: Authorization has been denied for this request.
403Roblox.Web.Authentication.Passwords.PasswordResponseCodes.PinLocked
0: Token Validation Failed
429Roblox.Web.Authentication.Passwords.PasswordResponseCodes.Flooded

POST /v1/username

Change the user’s username

Usage
import { fetchApi } from 'rozod';
import { postUsername } from 'rozod/lib/endpoints/authv1';
const data = await fetchApi(postUsername, {
body: { /* ... */ }
});
FieldTypeDescription
usernamestring
passwordstring

Type: unknown

StatusDescription
4005: You don’t have enough Robux to change your username.
10: This username is already in use
11: Username not appropriate for Roblox
12: Usernames can be 3 to 20 characters long
13: Usernames can’t start or end with _ and can have at most one _
14: Only a-z, A-Z, 0-9, and _ are allowed
15: Username is null
16: Username might contain private information
17: This username is not available
18: Username is same as current
4010: Authorization has been denied for this request.
4030: Token Validation Failed
1: PIN is locked.
2: A verified email is missing
3: Your password is incorrect.
100: Unknown birthday
5000: An unknown error occured.
5: You don’t have enough Robux to change your username.
5034: The feature is currently not available. Please try again later.

GET /v1/usernames

Gets a list of existing usernames on Roblox based on the query parameters

Usage
import { fetchApi } from 'rozod';
import { getUsernames } from 'rozod/lib/endpoints/authv1';
const data = await fetchApi(getUsernames, {
username: /* string? */
});
NameTypeRequiredDescription
usernamestring?NoThe username
FieldTypeDescription
usernamesstring[]

POST /v1/usernames/recover

Sends an email of all accounts belonging to an email

Usage
import { fetchApi } from 'rozod';
import { postUsernamesRecover } from 'rozod/lib/endpoints/authv1';
const data = await fetchApi(postUsernamesRecover, {
body: { /* ... */ }
});
FieldTypeDescription
targetType`“Email""PhoneNumber"
targetstring
FieldTypeDescription
transmissionType`01`
StatusDescription
40020: Invalid Email
21: Invalid Phone
23: No Account Found
4030: Token Validation Failed
11: Too many attempts. Please wait a bit.
5000: An unexpected error occurred.

GET /v1/usernames/validate

Checks if a username is valid.

Usage
import { fetchApi } from 'rozod';
import { getUsernamesValidate } from 'rozod/lib/endpoints/authv1';
const data = await fetchApi(getUsernamesValidate, {
Username: /* string */,
Birthday: /* string */
});
NameTypeRequiredDescription
UsernamestringYes
BirthdaystringYes
FieldTypeDescription
code`“ValidUsername""AlreadyInUseError"
messagestring
StatusDescription
4001: A valid username is required.
2: A valid birthday or authenticated user is required.

POST /v1/usernames/validate

Checks if a username is valid.

Usage
import { fetchApi } from 'rozod';
import { postUsernamesValidate } from 'rozod/lib/endpoints/authv1';
const data = await fetchApi(postUsernamesValidate, {
body: { /* ... */ }
});
FieldTypeDescription
usernamestring
birthdaystring
context`01
FieldTypeDescription
code`“ValidUsername""AlreadyInUseError"
messagestring
StatusDescription
4001: A valid username is required.
2: A valid birthday or authenticated user is required.
4030: Token Validation Failed

GET /v1/validators/email

Tries to check if an email is valid

Usage
import { fetchApi } from 'rozod';
import { getValidatorsEmail } from 'rozod/lib/endpoints/authv1';
const data = await fetchApi(getValidatorsEmail, {
Email: /* string */
});
NameTypeRequiredDescription
EmailstringYes
FieldTypeDescription
isEmailValidboolean

getValidatorsRecommendedusernamefromdisplayname

Section titled “getValidatorsRecommendedusernamefromdisplayname”

GET /v1/validators/recommendedUsernameFromDisplayName

Validates the given display name, and if valid, will convert it to a valid username and return suggested username(s) if available.

Usage
import { fetchApi } from 'rozod';
import { getValidatorsRecommendedusernamefromdisplayname } from 'rozod/lib/endpoints/authv1';
const data = await fetchApi(getValidatorsRecommendedusernamefromdisplayname, {
DisplayName: /* string */,
BirthDay: /* string */
});
NameTypeRequiredDescription
DisplayNamestringYes
BirthDaystringYes
FieldTypeDescription
didGenerateNewUsernameboolean
suggestedUsernamesstring[]

postValidatorsRecommendedusernamefromdisplayname

Section titled “postValidatorsRecommendedusernamefromdisplayname”

POST /v1/validators/recommendedUsernameFromDisplayName

Validates the given display name, and if valid, will convert it to a valid username and return suggested username(s) if available.

Usage
import { fetchApi } from 'rozod';
import { postValidatorsRecommendedusernamefromdisplayname } from 'rozod/lib/endpoints/authv1';
const data = await fetchApi(postValidatorsRecommendedusernamefromdisplayname, {
body: { /* ... */ }
});
FieldTypeDescription
displayNamestring
birthdaystring
FieldTypeDescription
didGenerateNewUsernameboolean
suggestedUsernamesstring[]
StatusDescription
4030: Token Validation Failed

GET /v1/validators/username

Tries to get a valid username if the current username is taken

Usage
import { fetchApi } from 'rozod';
import { getValidatorsUsername } from 'rozod/lib/endpoints/authv1';
const data = await fetchApi(getValidatorsUsername, {
Username: /* string */,
BirthDay: /* string */
});
NameTypeRequiredDescription
UsernamestringYes
BirthDaystringYes
FieldTypeDescription
didGenerateNewUsernameboolean
suggestedUsernamesstring[]

POST /v1/validators/username

Tries to get a valid username if the current username is taken

Usage
import { fetchApi } from 'rozod';
import { postValidatorsUsername } from 'rozod/lib/endpoints/authv1';
const data = await fetchApi(postValidatorsUsername, {
body: { /* ... */ }
});
FieldTypeDescription
usernamestring
birthdaystring
FieldTypeDescription
didGenerateNewUsernameboolean
suggestedUsernamesstring[]
StatusDescription
4030: Token Validation Failed

GET /v1/xbox/connection

Check if the current user has an Xbox connected.

Usage
import { fetchApi } from 'rozod';
import { getXboxConnection } from 'rozod/lib/endpoints/authv1';
const data = await fetchApi(getXboxConnection, undefined);
FieldTypeDescription
hasConnectedXboxAccountboolean
gamertagstring
StatusDescription
4010: Authorization has been denied for this request.

POST /v1/xbox/disconnect

Unlink the current ROBLOX account from the Xbox live account.

Usage
import { fetchApi } from 'rozod';
import { postXboxDisconnect } from 'rozod/lib/endpoints/authv1';
const data = await fetchApi(postXboxDisconnect, undefined);
FieldTypeDescription
successboolean
StatusDescription
4010: Authorization has been denied for this request.
403Forbidden
0: Token Validation Failed

GET /v1/xbox/get-login-consecutive-days

Get the consecutive days the xbox user has been logged in.

Usage
import { fetchApi } from 'rozod';
import { getXboxGetLoginConsecutiveDays } from 'rozod/lib/endpoints/authv1';
const data = await fetchApi(getXboxGetLoginConsecutiveDays, undefined);
FieldTypeDescription
countnumber
StatusDescription
40036: Invalid Xbox Live Account
4010: Authorization has been denied for this request.

POST /v1/xbox/translate

Translate the xbox user to roblox user.

Usage
import { fetchApi } from 'rozod';
import { postXboxTranslate } from 'rozod/lib/endpoints/authv1';
const data = await fetchApi(postXboxTranslate, {
body: { /* ... */ }
});
FieldTypeDescription
idsstring[]
FieldTypeDescription
Usersobject[]See below

Users[] item fields:

FieldTypeDescription
Idstring
UserIdnumber
Usernamestring
StatusDescription
4010: Authorization has been denied for this request.
4030: Token Validation Failed