Error codes
Every error response is JSON: { "success": false, "error": "..." }.
Code | Meaning | What to do |
400 | The request is wrong (missing or invalid fields) | Fix the request. The message says what |
401 | Missing, wrong or expired key, or the key belongs to another workspace | Check the key, its expiry and the workspace ID. Make a new key if needed |
404 | Unknown user (for example not a member of the workspace) or no active session to end | Often safe to ignore |
405 | Wrong HTTP method | Use the method in the reference |
409 | A conflict, such as a session already active, or no Discord webhook set up for | Often safe to ignore (start) or set it up (webhook) |
429 | Rate limited | Wait for |
502 | Discord refused a forwarded log message | Check the webhook |
Rate limits
Two limits apply per 5-minute window:
Limit | Value | Counted by |
Per client address | 1,000 requests | The caller's address and the workspace |
Per API key | 200 requests | The key and the workspace |
When you go over, you receive 429 with a Retry-After header and RateLimit-* headers showing your budget. The address limit exists so that bogus keys cannot be used to probe the API for free.
Roblox adds its own limit: 500 HttpService requests per minute per server.
How to stay within them
Only track staff ranks. Do not send activity for everyone.
Batch. For
/logs, send up to 25 entries in one request, every few seconds, instead of one request per chat line.Back off on 429. Wait for the
Retry-Aftertime, and do not retry in a tight loop.Cache reads. Member lists and workspace info change slowly.
The older activity endpoints
The downloadable loader uses older /api/activity/* endpoints with a separate activity key and a much higher limit (6,000 requests per 5 minutes per address and per key), because every join and leave from every server calls them. If you write your own integration, use the public API above.
Quick checks when something fails
Is the key correct, not expired and made by this workspace?
Is the workspace ID the Roblox group ID?
Did you send
Authorization: Bearer rosterr_...?Are you calling from a server script with HTTP requests enabled?
Are you being rate limited (429)?
Related articles
The Rosterr game API: what it is, how to make an API key and keep it safe
Rosterr game API: endpoints reference
Track staff time with the game API (Luau example)