Developers

One signed endpoint, any game

Presence, doors, moderation, clock-ins and records over plain HTTPS. There is a Roblox SDK because Roblox is where most of you are; everything else calls the same API directly.

Why bother

What integrating actually gives you

The org chart, the rulebook and the schedule already live in GROUPSPACE. Integrating is what makes the running game read from them instead of from a second copy.

Live presence and sessions

Each heartbeat opens and closes sessions for the users in the server. That single stream feeds the live server view, concurrency history, session length and playtime per position.

Doors and access points

Write the policy once against positions, units, organizations or named users. The game asks on join, caches the answer, and stops asking.

Moderation that reaches the player

Kick, mute, unmute, freeze, teleport, message, shutdown and door state changes arrive as commands on the heartbeat response and are not done until the game acks them.

Clock-ins from presence

In-game time can open a clock session automatically. If a server dies, the session closes at its last heartbeat rather than at discovery, so nobody is paid for downtime.

Records and positions in-game

Read the position a user holds and gate access on their record history without standing up a second database beside ours.

The surface

/api/v1/game/*

POST /api/v1/game/heartbeat        every 15-60s per server
POST /api/v1/game/doors/check      one door, one user
POST /api/v1/game/doors/bulk       every door, on join
GET  /api/v1/game/doors/manifest   definitions and states, on boot
POST /api/v1/game/bans/check       platforms with no ban API

That is the whole game surface. Commands and acks do not have endpoints of their own — they ride the heartbeat. If you can make five kinds of HTTPS request, you can integrate.

Two ways in

Take the SDK, or take the API

The HTTP API is the contract. The SDK is a client for it, not a privileged path — nothing it can do is unavailable to a raw integration.

Roblox — the Luau SDK

A versioned Roblox model and Wally package, with a one-file drop-in mode for people who do not use a package manager.

Batching, backoff and a capped local event queue

Command dispatch and acking without you writing a loop

Door and position caches, prefetched on join

BindToClose flush so a shutting-down server keeps its last events

Fails closed on restricted doors and open on public ones

Everything else — raw HTTPS

Steam, FiveM, a Unity or Source server, a Discord bot, a script on a box somewhere. No field in the game surface is Roblox-shaped.

externalServerId is a Roblox job id, a Steam server id, or a UUID you invent at boot

externalId identifies a user however your platform identifies users

Doors, sessions, analytics, timeclock and quotas behave identically

Where the platform has no ban API, call /bans/check on connect and disconnect the user yourself

There is no second SDK at launch, and we would rather say so than ship a bad one

Reference

Start here

REST API reference

Authentication and signing, idempotency, rate limits, the heartbeat envelope, commands and acks, doors, and the bans fallback.

Roblox Luau SDK

Install the module, call Init with a server key, and the batching, backoff, caches, acks and shutdown flush are handled for you.

Webhooks

Outbound events to Discord or a signed endpoint of your own, plus the Roblox right-to-erasure handler you have to keep available.

Design constraint

Five hundred requests a minute, and that is the whole design

Roblox allows a game server 500 outbound HttpService requests per minute. A fifty-player server produces far more interesting events than that, so one request per event was never on the table.

Telemetry batches into one heartbeat

Default interval is 20 seconds, configurable between 15 and 60. At 20 seconds the entire telemetry stream costs three requests a minute, which leaves the rest of the budget for synchronous door checks.

Commands ride the response

There is no polling loop and no command endpoint. Worst-case latency for a kick equals your heartbeat interval.

Urgent means a nudge, never a payload

For a ban that has to land now, Roblox MessagingService carries a one-kilobyte wake-up on a single per-game topic and the server fires an off-cycle heartbeat. The receive budget is 40 plus 80 per server per topic per minute, so it is one topic per game — never per server, never per command type.

Bans are queued and debounced

Open Cloud user restrictions allow 10 writes per second overall but only 2 per minute for a single user. Rapid toggling of one user has to be smoothed out, and it is.

The number-one setup failure. HttpService.HttpEnabled cannot be turned on from a script. It is a manual toggle in Experience Settings. The SDK detects the failure and logs an actionable error instead of a bare HTTP 403, but nothing can flip it for you.

Non-Roblox platforms have no such ceiling. The limits above are Roblox’s. A Steam or custom server can heartbeat as often as the configured interval allows, but the envelope stays the same shape so the ingest path, the caches and the analytics do not fork per platform.

Authentication

Server keys, signed requests

Keys belong to a game, not a person. They are shown once, hashed at rest, scoped to what the integration actually needs, and revocable without touching the rest of the workspace.

Every request HTTP

POST /api/v1/game/heartbeat
Authorization: Bearer gsk_live_<prefix>.<secret>
X-GS-Timestamp: 1786310400
X-GS-Signature: <hmac-sha256(secret, timestamp + rawBody)>
Content-Type: application/json

Key format is gsk_live_<prefix>.<secret> — the prefix is what shows up in logs and the audit trail

The secret is hashed with argon2id and never stored, so a lost key is regenerated, not recovered

HMAC-SHA256 over the timestamp concatenated with the raw request body

A 300-second acceptance window, plus a replay cache keyed on the key id and signature

Unsigned requests are rejected outright — there is no unsigned mode to fall into

heartbeat

events

Ingest player events inside the heartbeat

doors

Check, bulk-check and read the door manifest

commands

Receive remote commands and post acks

records:read

Read a user's records for in-game gating

chat

Forward filtered chat, where the workspace has opted in

Scope down. A door reader that only needs doors should not carry commands. Keys are cheap; issue one per integration and revoke it on its own.

Stop duct-taping your community together.

GROUPSPACE is in invite-only early access. Talk to us and we will get your community on the list.