Roxy Proxy

There are examples below this section if you want to skip the yap.

Roxy is a free proxy for Roblox web APIs. The code for Roxy is planned to be made open source in the future. Right now the code may not be 100% secure, so I am afraid to release it publicly and someone uses it and runs into issues, or a bad actor uses it and exploits the server with a vulnerability I did not foresee (not to mention the code is pretty hideous because this is my first project like this). I am still learning web development, so if you find any security issues or just general issues, please let me know! If you're a White Hat, refer to the bottom of the page for more info on vulnerability reporting and rewards.

The person who made Roproxy has a GitHub available to make your own proxy. So if you are looking for this option, it exists and is your safest option for using a proxy.

Why did I make Roxy? Because Roproxy throttles about 60 seconds per request. Thus I wanted something a bit faster for my own projects. Specifically my Bundle and Character/Outfit Inserter (shameful plug(in)) plugin as of right now. I figured if I'm going to make the proxy anyway, I may as well share it. My general rule of thumb for most things I make really, haha.

Roxy is for public, unauthenticated Roblox web API calls only; it does not support requests that need you to be logged in, and it will reject any request that resembles anything that looks like a Roblox .ROBLOSECURITY cookie. Never send your ROBLOSECURITY token to Roxy (or to any third-party proxy). More info below for why.

If you use RequestAsync, Roblox gives you the response headers. These are the custom headers that Roxy adds:

• Roxy-Requests-Left: How many more requests you have until you get throttled.
• Roxy-Throttle-Reset: How many seconds until your request pool resets.
• Roxy-Throttled: Whether or not you have been throttled.
• Roxy-Paused: Only present when the proxy is temporarily paused for maintenance.
• Roxy-Blocked: Only present when the endpoint you requested has been blocked by the admin.
• Roxy-Endpoint-Limited: Only present when a per-endpoint rate limit rejected your request.

You get around 10 requests every 50 seconds. However, for every request you make your throttle reset timer increases by 1 second. So if you quickly make 10 requests, you will have to wait an extra 10 seconds on top of whatever time your throttle reset timer is at.

It is highly encouraged to have caching on your end to make less requests, and also have instant responses.

Note: Roxy supports GET, POST, PATCH, PUT, and DELETE requests.

You can use Roxy exactly like the Roblox API, just prefix your Roblox endpoint with https://roxytheproxy.com/. For example:

https://roxytheproxy.com/avatar.roblox.com/v2/avatar/users/29371917/outfits?outfitType=Avatar&page=1&itemsPerPage=100&isEditable=true

In the case of that user ID, you will get something that looks like this:

{"data":[{"id":152266819767,"name":"X","isEditable":true,"outfitType":"Avatar"},{"id":26926749690,"name":"I","isEditable":true,"outfitType":"Avatar"},{"id":11706768233,"name":"H","isEditable":true,"outfitType":"Avatar"},{"id":7277992048,"name":"A","isEditable":true,"outfitType":"Avatar"},{"id":3977261404,"name":"B","isEditable":true,"outfitType":"Avatar"},{"id":87611659,"name":"F","isEditable":true,"outfitType":"Avatar"},{"id":87610579,"name":"G","isEditable":true,"outfitType":"Avatar"}],"paginationToken":""}

That will work if you put it in the browser's URL, but you can also do this from Roblox using HttpService (which is probably what you're here for)

local URL = "https://roxytheproxy.com/avatar.roblox.com/v2/avatar/users/29371917/outfits?outfitType=Avatar&page=1&itemsPerPage=100&isEditable=true"
print(HttpService:GetAsync(URL))

Adding &prettyprint=true makes the JSON easier to read (this is specific to Roxy, and also works for all request types).

Pretty-printed GET

https://roxytheproxy.com/avatar.roblox.com/v2/avatar/users/29371917/outfits?outfitType=Avatar&page=1&itemsPerPage=100&isEditable=true&prettyprint=true

{
    "data": [
        { "id": 152266819767, "name": "X", "isEditable": true, "outfitType": "Avatar" },
        { "id": 26926749690,  "name": "I", "isEditable": true, "outfitType": "Avatar" },
        { "id": 11706768233,  "name": "H", "isEditable": true, "outfitType": "Avatar" },
        { "id": 7277992048,   "name": "A", "isEditable": true, "outfitType": "Avatar" },
        { "id": 3977261404,   "name": "B", "isEditable": true, "outfitType": "Avatar" },
        { "id": 87611659,     "name": "F", "isEditable": true, "outfitType": "Avatar" },
        { "id": 87610579,     "name": "G", "isEditable": true, "outfitType": "Avatar" }
    ],
    "paginationToken": ""
}

Most (if not all) POST/PATCH/PUT/DELETE endpoints on Roblox's API require you to be logged in. Roxy does not support authenticated requests, so these methods only work against the small number of public, unauthenticated write endpoints Roblox exposes (again, if any). If you need to write data as a specific account, you'll need to call Roblox directly with your own authenticated client, and unfortunately that isn't something Roxy can do for you.

The calling convention is the same as GET, just with a different Method:

HttpService:RequestAsync({
	Url = "https://roxytheproxy.com/" .. endpointPath,
	Method = "POST", -- or "PATCH", "PUT", "DELETE"
	Headers = { ["Content-Type"] = "application/json" },
	Body = HttpService:JSONEncode({ --[[ your payload ]] }),
})