Roblox Cut Its API Rate Limits on October 19, 2026: What the Inventory and Users Endpoints Now Allow, and Why Trading Si
Posted: Wed Oct 21, 2026 12:20 am
Quick Summary
Roblox announced the change on September 30 in the Developer Forum. The affected services are badges-api, datastores-api, game-persistence-api, inventory-api, thumbnails-api, and users-api. These are the cookie-authenticated and unauthenticated endpoints that tools, browser extensions, and third party websites have leaned on for years.
Roblox framed it as a privacy and data stewardship move. The announcement says the new limits are "data-driven, based on observed request rates" and that "regular users/clients" should see minimal impact. Third party integrations are warned that "bursts above normal peak usage could trigger rate limiting."
The company is blunt about who these endpoints are for. Cookie-based APIs exist to support the Roblox website and app for humans, not for automation, and they "can incorporate breaking changes without notice, and have minimal stability guarantees." In other words, the door was always open on this.
[b]Endpoint[/b] | [b]Before[/b] | [b]After[/b]
/v1/users/{userId}/items/{itemType}/{itemTargetId} | 10,000 per minute | 730 per minute
/v1/users/{userId}/items/{itemType}/{itemTargetId}/is-owned | 10,000 per second | 220 per second
/v1/users/{userId}/categories | 10,000 per minute | 100 per minute
/v1/users/{userId}/categories/favorites | 10,000 per minute | 100 per minute
/v2/inventory/asset/{assetId} | 10,000 per minute | 100 per minute
/v1/packages/{packageId}/assets | 1,000 per minute | 140 per minute
/v1/collections/items/{itemType}/{itemTargetId} | 1,000 per minute | 100 per minute
/v1/users/{userId}/places/inventory | 10,000 per minute | 590 per minute
The is-owned endpoint is the one that hurts most. That is the call a trading site makes to answer "does this player own this item." At 220 requests per second it stops being a bulk operation. Scanning a few thousand inventories is now a long job instead of a short one.
Thumbnails took a similar hit: the 3D asset thumbnail endpoint went from 10,000 per minute to 100 per minute per cookie. Badge and user endpoints dropped from 1,000 to 100 per minute per unauthenticated IP.
Why this follows a year of privacy tightening
This did not come out of nowhere. It is the next step in a chain that started in January 2026.
On January 27, 2026, the game client began enforcing inventory privacy settings for PlayerOwnsAssetAsync. Before that date, a LocalScript could check whether another player owned an asset, and many tools used exactly that to dump someone's full limited list, including UAIDs. After that date, those client-side calls threw an error when the target player had a private inventory. Roblox asked developers to move the check to the server side.
In April 2026 the company published its Data Stewardship Principles. They define "platform-level user data" as usernames, user IDs, profile descriptions, social links, avatar information, activity history, badge ownership, friends, followers, community memberships, posts, messages, and votes. The principles say users control their own data, creators are responsible for what they collect, and Roblox is the steward of it all.
Two policy points matter most for anyone building on top of Roblox data. Creators are not allowed to use data for user tracking, and they are not allowed to mine and derive user profile data. That second rule is an extension of the Creator Third-Party App Policy.
The October rate limit cuts are that policy applied with a traffic shaper.
What it means for trading sites
Rolimon's, the largest Roblox limiteds data site, acknowledged the change the same day it was announced. Its account on X posted that Roblox was lowering cookie and unauthenticated IP rate limits for several web API services after October 19, including Inventory, Users, Thumbnails, Badges, and DataStore-related APIs, and noted that "third-party tools with higher request volumes may need to adjust."
Rolimon's runs on exactly that kind of volume. The site keeps item values, RAP history, player charts, trade ads, and leaderboards, all of which need inventory reads across a huge number of accounts. Cut the throughput and the whole refresh cycle stretches.
There is a second problem that is not about rate limits at all. Limited dynamic heads do not come back from the collectibles inventory endpoint. A bug report filed in March 2026, and still getting replies in April and May, describes buying a limited dynamic head and finding it absent from even after full pagination. The items show up on the website and can be worn, but third party apps such as Rolimon's and Trade Hangout cannot see them.
Two developers in that thread landed on different explanations. One said dynamic heads are bundles rather than assets, which is why the asset endpoint skips them. The other said the endpoint returns every other limited item they own, so the gap is specific to newly purchased dynamic heads. The thread has no Roblox staff answer either way. One reply points out that does return the head, but the bundle response carries no field marking it as a limited collectible, so tools have to stitch two endpoints together and guess.
That is the state of the data layer: slower where it works, missing where it does not.
The supported path forward
Roblox's answer is Open Cloud. The rate limit announcement lists Open Cloud alternatives for the two inventory endpoints that matter most: List Inventory Items replaces the is-owned check and the per-item lookup, and the 3D thumbnail endpoint has an Open Cloud version too.
The replacement is real and documented. List Inventory Items lives at, authenticates with an API key or OAuth 2.0, and returns asset details with instance IDs. It also takes filters, so you can ask for collectibles only, or narrow to specific asset types, which is how the new endpoint is meant to replace a pile of smaller calls.
But there are three catches worth knowing before you migrate a live tool.
called from a server Script respects the inventory privacy setting after January 27, 2026, which is the behaviour Roblox wants. If you only need to know whether one player owns one item, that is the right tool.
FAQ
Did the Roblox rate limit change break my inventory on the website?
No. The October 19 change covers cookie-authenticated and unauthenticated IP rate limits on web API services. Browsing your own inventory, opening catalog pages, and trading in-game are client features that Roblox says should see minimal impact. What changed is how fast an automated tool can read other people's inventories through the public endpoints.
Why does my limited not show up on trading sites anymore?
If it is a limited dynamic head, that is the separate API gap, not the rate limits. Heads bought through the dynamic head system do not appear in the collectibles inventory endpoint, so third party sites cannot see them. Other limiteds still come through, though sites may update them more slowly now because of the lower request caps.
Is Roblox banning third party inventory checkers?
No ban, but a squeeze. The company has not removed the endpoints. It cut the throughput and says unauthenticated access is being removed, rate limits are being set to human-usage levels, and unused endpoints are being sunset, with policy updates coming to make the rules explicit. The direction is clear: automation is being pushed onto Open Cloud.
Can I still check if someone owns a specific item?
Yes, two ways. In-game, call from a server Script. For an external tool, use Open Cloud List Inventory Items with an API key, which requires the target user to have public inventory visibility or to grant you access. The old per-item cookie endpoint still works at 220 requests per second.
What is the safest setting for my own inventory?
It depends on what you do. If you trade or resell limiteds, a public inventory keeps portfolio trackers and trade offers flowing. If you upload your own assets, many developers keep their inventory private because a public inventory exposes uploaded meshes and textures to anyone who wants to copy them. Roblox has a feature request for per-category privacy that has no staff reply, so the switch is still all or nothing.
Should I build a new tool against cookie APIs?
No. Roblox states plainly that cookie-based APIs can change without notice and carry minimal stability guarantees, and the October announcement is that warning made real. Build against Open Cloud with an API key, keep a cache, and design around the documented limits instead of hoping the old buckets stay put.
Sources
- After October 19, 2026, Roblox cut the cookie and unauthenticated IP rate limits on six web API services, including inventory-api, users-api, and thumbnails-api.
- Inventory endpoints dropped hard: the per-second ownership call went from 10,000 to 220 requests per second, and the per-minute one from 10,000 to 730 per minute.
- Open Cloud limits did not change. Roblox points tools at the Open Cloud Inventory API as the supported replacement, but several affected endpoints have no Open Cloud equivalent at all.
- Rolimon's confirmed on September 30 that the change touches its data pipeline. Charts and player scans that used to be quick now crawl, and items that never returned through the API in the first place stay invisible.
- For a normal player browsing their own catalog, nothing breaks. For anything that scans thousands of inventories a day, the whole scraping model just got far more expensive.
Roblox announced the change on September 30 in the Developer Forum. The affected services are badges-api, datastores-api, game-persistence-api, inventory-api, thumbnails-api, and users-api. These are the cookie-authenticated and unauthenticated endpoints that tools, browser extensions, and third party websites have leaned on for years.
Roblox framed it as a privacy and data stewardship move. The announcement says the new limits are "data-driven, based on observed request rates" and that "regular users/clients" should see minimal impact. Third party integrations are warned that "bursts above normal peak usage could trigger rate limiting."
The company is blunt about who these endpoints are for. Cookie-based APIs exist to support the Roblox website and app for humans, not for automation, and they "can incorporate breaking changes without notice, and have minimal stability guarantees." In other words, the door was always open on this.
Thumbnails took a similar hit: the 3D asset thumbnail endpoint went from 10,000 per minute to 100 per minute per cookie. Badge and user endpoints dropped from 1,000 to 100 per minute per unauthenticated IP.
Why this follows a year of privacy tightening
This did not come out of nowhere. It is the next step in a chain that started in January 2026.
On January 27, 2026, the game client began enforcing inventory privacy settings for PlayerOwnsAssetAsync. Before that date, a LocalScript could check whether another player owned an asset, and many tools used exactly that to dump someone's full limited list, including UAIDs. After that date, those client-side calls threw an error when the target player had a private inventory. Roblox asked developers to move the check to the server side.
In April 2026 the company published its Data Stewardship Principles. They define "platform-level user data" as usernames, user IDs, profile descriptions, social links, avatar information, activity history, badge ownership, friends, followers, community memberships, posts, messages, and votes. The principles say users control their own data, creators are responsible for what they collect, and Roblox is the steward of it all.
Two policy points matter most for anyone building on top of Roblox data. Creators are not allowed to use data for user tracking, and they are not allowed to mine and derive user profile data. That second rule is an extension of the Creator Third-Party App Policy.
The October rate limit cuts are that policy applied with a traffic shaper.
What it means for trading sites
Rolimon's, the largest Roblox limiteds data site, acknowledged the change the same day it was announced. Its account on X posted that Roblox was lowering cookie and unauthenticated IP rate limits for several web API services after October 19, including Inventory, Users, Thumbnails, Badges, and DataStore-related APIs, and noted that "third-party tools with higher request volumes may need to adjust."
Rolimon's runs on exactly that kind of volume. The site keeps item values, RAP history, player charts, trade ads, and leaderboards, all of which need inventory reads across a huge number of accounts. Cut the throughput and the whole refresh cycle stretches.
There is a second problem that is not about rate limits at all. Limited dynamic heads do not come back from the collectibles inventory endpoint. A bug report filed in March 2026, and still getting replies in April and May, describes buying a limited dynamic head and finding it absent from
Code: Select all
/v1/users/{userId}/assets/collectiblesTwo developers in that thread landed on different explanations. One said dynamic heads are bundles rather than assets, which is why the asset endpoint skips them. The other said the endpoint returns every other limited item they own, so the gap is specific to newly purchased dynamic heads. The thread has no Roblox staff answer either way. One reply points out that
Code: Select all
/v1/users/{user_id}/bundlesThat is the state of the data layer: slower where it works, missing where it does not.
The supported path forward
Roblox's answer is Open Cloud. The rate limit announcement lists Open Cloud alternatives for the two inventory endpoints that matter most: List Inventory Items replaces the is-owned check and the per-item lookup, and the 3D thumbnail endpoint has an Open Cloud version too.
The replacement is real and documented. List Inventory Items lives at
Code: Select all
/cloud/v2/users/{user_id}/inventory-itemsBut there are three catches worth knowing before you migrate a live tool.
- It is permission-gated, and it depends on the user's setting. The endpoint docs say that if a user has inventory visibility set to Everyone, any API key can read their inventory. If they have not, you need an API key created by that user with the Inventory: Read permission, or an OAuth2 token from the scope. Roblox still documents a Privacy & content restrictions setting for inventory visibility, so this is a live dependency, not a solved problem.
Code: Select all
user.inventory-item:read - Several endpoints have no Open Cloud equivalent. The rate limit table lists "None" in the alternative column for the categories, favorites, packages, places, and collections endpoints. If your tool depends on one of those, there is no official replacement on the roadmap in that table.
- [b>The limits are lower in places.[/b] API keys get 100 requests per minute across all API keys for a user or group, and OAuth 2.0 gets 20 requests per minute per app user. That is a different shape from the old cookie buckets, and it scales per app user rather than per cookie.
Code: Select all
PlayerOwnsAssetAsyncFAQ
Did the Roblox rate limit change break my inventory on the website?
No. The October 19 change covers cookie-authenticated and unauthenticated IP rate limits on web API services. Browsing your own inventory, opening catalog pages, and trading in-game are client features that Roblox says should see minimal impact. What changed is how fast an automated tool can read other people's inventories through the public endpoints.
Why does my limited not show up on trading sites anymore?
If it is a limited dynamic head, that is the separate API gap, not the rate limits. Heads bought through the dynamic head system do not appear in the collectibles inventory endpoint, so third party sites cannot see them. Other limiteds still come through, though sites may update them more slowly now because of the lower request caps.
Is Roblox banning third party inventory checkers?
No ban, but a squeeze. The company has not removed the endpoints. It cut the throughput and says unauthenticated access is being removed, rate limits are being set to human-usage levels, and unused endpoints are being sunset, with policy updates coming to make the rules explicit. The direction is clear: automation is being pushed onto Open Cloud.
Can I still check if someone owns a specific item?
Yes, two ways. In-game, call
Code: Select all
PlayerOwnsAssetAsyncWhat is the safest setting for my own inventory?
It depends on what you do. If you trade or resell limiteds, a public inventory keeps portfolio trackers and trade offers flowing. If you upload your own assets, many developers keep their inventory private because a public inventory exposes uploaded meshes and textures to anyone who wants to copy them. Roblox has a feature request for per-category privacy that has no staff reply, so the switch is still all or nothing.
Should I build a new tool against cookie APIs?
No. Roblox states plainly that cookie-based APIs can change without notice and carry minimal stability guarantees, and the October announcement is that warning made real. Build against Open Cloud with an API key, keep a cache, and design around the documented limits instead of hoping the old buckets stay put.
Sources
- Roblox Developer Forum: [API Update] API Rate Limit Tuning, with the full before and after limit tables
- Roblox Developer Forum: Data Stewardship Principles and the cookie-based API policy changes
- Roblox Developer Forum: the January 27, 2026 PlayerOwnsAssetAsync and inventory web API change
- Roblox Creator Hub: the Open Cloud user inventories guide, including filters and pagination
- Roblox Creator Hub: inventory endpoint reference, permission scopes, and rate limits
- Roblox Developer Forum: bug report on limited dynamic heads missing from the inventory API
- Rolimon's on X, September 30, 2026, acknowledging the rate limit changes affecting its data pipeline
- Roblox Support: official instructions for viewing or hiding your inventory
- Roblox Support: trading requirements, including the inventory visibility requirement
- Roblox Developer Forum: open feature request for per-category inventory privacy