Game integration

Your game reads the org chart

Presence, doors, moderation, analytics and clock-ins over one plain HTTPS API, built around real platform limits.

Transport

The heartbeat is the spine

One request per server per interval carries the whole telemetry stream, and commands come back in the response.

Batched, because it has to be

Roblox allows 500 HttpService requests per minute per server. A busy server produces far more interesting events than that, so one request per event is not an option.

Commands ride the response

No second polling loop. Worst-case latency for a kick or a door update equals the heartbeat interval, which is twenty seconds by default.

Urgent means a nudge, not a payload

MessagingService carries a one-kilobyte wake-up on a single per-game topic, and the server fires an off-cycle heartbeat. The command itself never travels that way.

Signed and idempotent

HMAC over the timestamp and body with a five-minute window and a replay cache. Every event carries an id, so a retried heartbeat cannot double-count playtime.

The setup step nobody warns you about. HttpService cannot be enabled from a script. It is a manual toggle in Experience Settings, it will be your first support ticket, and the SDK says so explicitly instead of returning a bare 403.

Heartbeat · every 20 seconds HTTP

POST /api/v1/game/heartbeat
Authorization: Bearer gsk_live_<prefix>.<secret>
X-GS-Signature: <hmac-sha256 of timestamp + body>
X-GS-Timestamp: <unix>

{
  "externalServerId": "job-8f2a41",
  "externalScopeId": "606849621",
  "playerCount": 23, "maxPlayers": 50, "sdkVersion": "1.0.0",
  "players": [ { "externalUserId": "1234", "username": "ava", "team": "Police" } ],
  "events":  [ { "eventId": "e_91f", "type": "arrest_made", "externalUserId": "1234" } ],
  "acks":    [ "cmd_abc" ]
}

200 {
  "commands": [ { "id": "cmd_ghi", "type": "kick", "payload": { … } } ],
  "config":   { "heartbeatSeconds": 20, "doorCacheSeconds": 30 }
}

heartbeat events doors commands records:readserver key scopes — shown once, hashed at rest, revocable

Doors and presence

Access decided here, enforced there

Write the policy in GROUPSPACE; the game asks once per join and then stops asking.

Door validation HTTP

POST /api/v1/game/doors/check
{ "doorKey": "pd_armory", "externalUserId": "1234" }
{ "allowed": true, "reason": "position:sergeant", "ttl": 30 }

POST /api/v1/game/doors/bulk        one call per player join
{ "externalUserId": "1234" }
{ "doors": { "pd_armory": true, "pd_evidence": false }, "ttl": 30 }

GET  /api/v1/game/doors/manifest    definitions + states, on boot
POST /api/v1/game/bans/check        where the platform has no ban API

Subjects are positions, units, orgs, named users or everyone

Conditions: on shift, during an operation, minimum tenure, time window

No active negative record of a type you choose

Deny wins, then highest priority, then the door default

Lock, unlock, set auto or run a timed unlock as a remote command

Fail closed on restricted doors and open on public ones when we are unreachable

Access points, not just doors. The same model covers weapon lockers, vehicle spawners and zone access. A door is one kind of access point, which is why the bulk-on-join call is worth caching.

Access log

denials included, because that is how you find a bad policy

Player	Access point	Reason	Result
AM Ava Mercer	pd_armory	position:sergeant	Allowed
KD Kex Duval	pd_armory	policy:deny · rank below sergeant	Denied
RV Rio Vance	pd_evidence	condition:not clocked in	Denied
NO Nia Okafor	cityhall_council	unit:internal affairs	Allowed

Presence becomes hours. A game session can open a clock session automatically — in one of your games, optionally on a specific team, optionally only inside a rostered shift. If a server crashes, the session closes at the last heartbeat rather than at discovery, so nobody gets paid for eight hours of downtime.

Watch and act

See the game server, then do something

Live rosters, historical analytics and moderation that reaches the player, all from the same ingest.

Live servers

Los Santos RP · online within 2.5 intervals

Live

Server	Players	Uptime	SDK	Status
job-8f2a41 Los Santos · main	23 / 50	1h 12m	1.0.0	Online
job-c07b9e Los Santos · main	41 / 50	4h 38m	1.0.0	Online
job-2d55af Paleto Bay · training	6 / 30	22m	0.9.4	Stale

Live roster and quick actions

Open a server and see who is in it, when they joined, their team and the position they hold. Kick, message or teleport from the row.

Analytics and server records

Concurrent players, session length, playtime per member and per position, and an activity heatmap by hour and weekday for scheduling shifts.

The records people screenshot

All-time peak concurrent, longest uptime, busiest day. Rolled up nightly, never queried off the raw event table.

Moderation from either side

Issue a warn, kick, mute or ban from the live server view, from a record or from search. Staff in-game can do the same through the SDK.

Bans that survive a rejoin

Roblox Open Cloud user restrictions are officially supported and actually keep someone out. We queue and debounce them, because the limit is two writes per minute per user.

No silent failures

A command goes pending, dispatched, acked. If the game never acks before it expires, it is marked failed and the moderator is told.

Appeals with the context

The action, the evidence and the subject's record history on one screen, because warnings and notes live in the records engine, not a second history.

Chat history is opt-in. Off by default, enabled per workspace behind an explicit acknowledgement. Retention is capped at thirty days and configurable downward only, access sits behind a dedicated permission that is in no default position, every search is itself audited, and storage is encrypted and separate. Only platform-filtered text is stored — never a reconstruction of raw messages. Roblox gives no supported server-side chat hook, so fidelity is limited and we would rather say so than pretend.

Ban scope: this session, one game, or every registered game in the workspace

Evidence attaches as image links or clips on the action itself

The Roblox right-to-erasure webhook purges records, sessions and messages

No cross-workspace blocklist — tracking players across experiences is prohibited

Platform agnosticism

Any game, or no game at all

Platform differences are capability flags on a provider, never a branch inside a feature.

A game provider declares what its platform can do — an SDK, persistent bans, pushed commands, platform currency, an erasure webhook. Everything downstream reads the flags. The neutral provider was built first, deliberately, because that is the only way to prove no Roblox assumption leaked into the core.

Roblox

A Luau module you drop into ServerScriptService. Presence, doors, moderation, bans and shifts work the same afternoon.

Steam, FiveM, a custom server

One HTTPS endpoint. Send a heartbeat with whatever ids your platform uses and everything else follows.

No game at all

Clubs, esports orgs and student governments run the org chart, hiring, records, operations and economy unchanged.

Capability matrix

gameprovider.capabilities

Capability	Roblox	Steam · FiveM · custom	No game
Drop-in SDK	yes · Luau module	no · raw HTTPS API	not applicable
Live servers and sessions	yes	yes · same heartbeat	not applicable
Doors and access points	yes	yes	not applicable
Auto clock-in from presence	yes	yes	manual clock only
In-session moderation	yes	yes	not applicable
Persistent bans	yes · Open Cloud	no · blocklist checked on join	not applicable
Push command nudge	yes · MessagingService	no · next heartbeat	not applicable
Platform currency	yes · Robux	no	not applicable
Automated payouts	no · calculate and settle	no	not applicable
Erasure webhook	yes	no · manual request	not applicable
Orgs, hiring, records, ops, economy	yes	yes	yes

Degradations are graceful

A Steam game loses persistent bans and platform currency. It keeps live servers, sessions, analytics, doors, timeclock, quotas and in-session moderation.

The API is the contract

No field in the game surface is Roblox-shaped. An external server id is a Roblox job id, a Steam server id or a UUID your game invents at boot.

The SDK is a convenience

It handles batching, backoff, the local event queue, command acks, the door and position caches, and flushing on shutdown. You can skip it.

Stop duct-taping your community together.

GROUPSPACE is in invite-only early access. Talk to us and we will get your community on the list.