REST · JSONv1

API Reference

Scripts, search, trending, users, and games. AI vector search, real-time analytics, and risk-screened results, built on the same stack that powers rscripts.net.

https://api.rscripts.netOpen API

Get API key

Overview

The Rscripts API is a read-only REST interface. Every response is JSON with a consistent envelope. CORS is open for GET requests. API keys are required on all /v1 routes. Rate limits apply per IP. Only public, reviewed scripts are returned.

Format

JSON

Auth

API key

Safety

Filtered

Authentication

All /v1 endpoints require an API key. Every signed-in user can create one instantly from /dashboard/api.

Authorization: Bearer rsc_live_… (recommended)
X-Api-Key: rsc_live_… (alternative)

/health and the root metadata route are public.
Invalid or missing keys return 401 with code UNAUTHORIZED.
Regenerating your key in the dashboard revokes the previous one immediately.

Example requesturl

curl -H "Authorization: Bearer rsc_live_YOUR_KEY" "https://api.rscripts.net/v1/search?q=autofarm&limit=3"

Trust & safety

Every script in the API has passed automated risk screening. Scripts that score above our safety threshold are automatically removed from public results and queued for manual review. They never appear in search, list, or trending responses.

High-risk scripts are filtered before they reach the API.
Flagged uploads enter manual review and stay hidden until cleared.
Each result includes a risk score (1–10) and level so you can add your own UI guardrails.
Full findings (patterns, obfuscation, severity) are on the script detail endpoint.

A null risk field means the script has not been scanned yet, not that it is safe. Most indexed scripts include a score.

Responses

Success and error shapes are always predictable.

Successjson

{
  "success": true,
  "data": {},
  "meta": {
    "page": 1
  }
}

Errorjson

{
  "success": false,
  "error": {
    "code": "NOT_FOUND",
    "message": "Script not found"
  }
}

Rate limits

1,000 requests per 60 seconds per IP. Redis-backed, fail-open if Redis is down. Every response includes rate limit headers.

X-RateLimit-Limit
X-RateLimit-Remaining
X-RateLimit-Reset
Retry-After (429 only)

Shared parameters

Available on scripts, search, and trending endpoints.

`htmlDescription`	Return descriptions as raw HTML instead of stripped plain text.
`includeScript`	Inline raw Lua source in the response. Default off on list/search/trending. Use rawScript URL instead. Always on for script detail.

Boolean params accept true/false, 1/0, yes/no. The string "false" is correctly parsed as false.

GET/v1/analytics/ingame

In-game analytics

Your dashboard analytics, ready for Discord bots, server stats, and custom dashboards. Returns aggregate telemetry for the creator who owns the API key.

Parameter	Type	Description
`period`default: 30d	string	Rolling window: 7d, 30d, or 90d. Other parameters are rejected.

·Uses your API key owner automatically. You cannot request another creator’s analytics. Keep your key on your server, never in browser code or a public repository.
·Enable Script analytics on your scripts to collect data. No activity returns zero totals and empty breakdowns; hours always contains 24 values.
·Includes totals, previous-period runs and players, daily activity, top 8 executors, 24 UTC hours, top 12 scripts, and top 6 games. Days without activity are omitted.
·liveNow counts sessions seen in the last 3 minutes. Average session length is rounded to whole minutes, with a minimum of 1 for nonempty groups. Unique players exclude empty player hashes.
·Player hashes, session keys, and individual player records are never returned. Responses use Cache-Control: private, no-store. Poll about once per minute for a Discord integration.

Requesturl

curl -H "Authorization: Bearer rsc_live_YOUR_KEY" "https://api.rscripts.net/v1/analytics/ingame?period=30d"

Building an open-source integration? Submit it for the community showcase.

Responsejson

{
  "success": true,
  "data": {
    "optedInScripts": 1,
    "totals": {
      "runs": 120,
      "uniquePlayers": 84,
      "avgSessionMinutes": 12,
      "liveNow": 3,
      "prevRuns": 95,
      "prevUniquePlayers": 70
    },
    "daily": [
      {
        "date": "2026-09-10",
        "runs": 120,
        "players": 84
      }
    ],
    "executors": [
      {
        "name": "Unknown",
        "sessions": 120,
        "icon": null,
        "slug": null
      }
    ],
    "hours": [
      0,
      0,
      0,
      0,
      0,
      0,
      0,
      0,
      0,
      0,
      120,
      0,
      0,
      0,
      0,
      0,
      0,
      0,
      0,
      0,
      0,
      0,
      0,
      0
    ],
    "perScript": [
      {
        "scriptId": "example-script",
        "title": "My script",
        "slug": "my-script",
        "image": null,
        "gameThumbnail": null,
        "runs": 120,
        "uniquePlayers": 84,
        "avgSessionMinutes": 12,
        "liveNow": 3
      }
    ],
    "topGames": [
      {
        "placeId": "2753915549",
        "title": "Blox Fruits",
        "logo": null,
        "sessions": 120
      }
    ]
  },
  "meta": {
    "period": "30d",
    "generatedAt": "2026-09-10T10:30:00.000Z",
    "timezone": "UTC"
  }
}

GET/health

Health

Service health check. Returns database, cache, and search service status.

Requesturl

https://api.rscripts.net/health

Responsejson

{
  "status": "ok",
  "services": {
    "postgres": "ok",
    "redis": "ok",
    "vector-search": "ok"
  },
  "ts": "2026-10-01T04:20:00.786Z"
}

GET/v1/search

Search

Multi-index search across scripts, users, and games. Powered by the same AI vector search ranking used on rscripts.net.

Parameter	Type	Description
`q`	string	Search query (1–100 chars). Required.
`index`default: scripts,users,games	string	Comma-separated indexes: scripts, users, games.
`limit`default: 10	number	Results per index (1–20).
`page`default: 1	number	Page number (1–100).
`htmlDescription`default: false	boolean	Return descriptions as raw HTML instead of stripped plain text.
`includeScript`default: false	boolean	Inline raw Lua source in the response. Default off on list/search/trending. Use rawScript URL instead. Always on for script detail.

·Pagination lives in the top-level meta.pagination object (per index).
·Script hits include rawScript URL always; inline script requires includeScript=true.
·Risk summary on every script hit; full findings on the detail endpoint.
·High-risk scripts are filtered out before indexing. Results are safety-screened by default.

Requesturl

https://api.rscripts.net/v1/search?q=autofarm&index=scripts&limit=5

Responsejson

{
  "success": true,
  "data": {
    "query": "autofarm",
    "scripts": [
      {
        "id": "6a415d691f68eb0f1be7b582",
        "title": "Autofarm, Car Godmode, Infinite Stamina",
        "slug": "autofarm-car-godmode-example",
        "description": "Auto farm with vehicle modifiers…",
        "views": 12400,
        "likes": 42,
        "dislikes": 2,
        "rawScript": "https://rscripts.net/raw/example.txt",
        "script": null,
        "risk": {
          "score": 2,
          "level": "Safe",
          "isObfuscated": false,
          "obfuscatorDetected": null
        },
        "game": {
          "placeId": "2753915549",
          "title": "Blox Fruits",
          "thumbnailUrl": "https://tr.rbxcdn.com/…",
          "logoUrl": "https://tr.rbxcdn.com/…",
          "robloxUrl": "https://www.roblox.com/games/2753915549"
        },
        "creator": {
          "username": "dev",
          "isVerified": true,
          "subscriptionTier": "free",
          "isPro": false,
          "avatarUrl": null
        }
      }
    ],
    "users": [],
    "games": []
  },
  "meta": {
    "pagination": {
      "scripts": {
        "page": 1,
        "limit": 5,
        "total": 128,
        "totalPages": 26,
        "hasNextPage": true,
        "hasPrevPage": false
      }
    }
  }
}

GET/v1/scripts

List scripts

Browse or search scripts with sorting and filters. Pass placeId to list scripts for a specific Roblox game.

Parameter	Type	Description
`q`	string	Optional search query (uses AI vector search when set).
`placeId`	string	Roblox place ID. When set, returns only scripts for that game (same as game pages on rscripts.net). Combines with q and other filters.
`page`default: 1	number	Page (1–200).
`limit`default: 20	number	Items per page (1–48).
`sort`default: recommended	enum	recommended \| newest \| oldest \| most-views \| least-views \| most-likes \| trending
`noKeySystem`default: false	boolean	Exclude key-system scripts.
`mobileOnly`default: false	boolean	Mobile-ready scripts only.
`freeOnly`default: false	boolean	Free scripts only.
`verifiedOnly`default: false	boolean	Verified creators only.
`htmlDescription`default: false	boolean	Return descriptions as raw HTML instead of stripped plain text.
`includeScript`default: false	boolean	Inline raw Lua source in the response. Default off on list/search/trending. Use rawScript URL instead. Always on for script detail.

·Pagination is in the top-level meta object.
·When placeId is set, meta.game includes the resolved game title, thumbnails, and Roblox URL.
·Returns public scripts only. Patched, private, and under-review scripts are excluded.

Requesturl

https://api.rscripts.net/v1/scripts?placeId=2753915549&sort=most-likes&limit=12

Responsejson

{
  "success": true,
  "data": [
    {
      "id": "…",
      "title": "…",
      "slug": "…",
      "rawScript": "https://rscripts.net/raw/…",
      "script": null,
      "game": {
        "placeId": "2753915549",
        "title": "Blox Fruits"
      }
    }
  ],
  "meta": {
    "page": 1,
    "limit": 12,
    "total": 842,
    "totalPages": 71,
    "hasNextPage": true,
    "hasPrevPage": false,
    "game": {
      "placeId": "2753915549",
      "title": "Blox Fruits",
      "thumbnailUrl": "https://tr.rbxcdn.com/…",
      "logoUrl": "https://tr.rbxcdn.com/…",
      "robloxUrl": "https://www.roblox.com/games/2753915549"
    }
  }
}

GET/v1/scripts/:slug

Script detail

Full script object by slug, including executors, game, risk findings, and inline Lua source.

Parameter	Type	Description
`htmlDescription`default: false	boolean	Return description as raw HTML.

·Script content is always included on detail (no includeScript flag needed).

Requesturl

https://api.rscripts.net/v1/scripts/example-slug-abc123

Responsejson

{
  "success": true,
  "data": {
    "id": "69e11446c3822ebe4c6400f8",
    "title": "Example Script",
    "slug": "example-script-abc",
    "description": "Plain-text description…",
    "rawScript": "https://rscripts.net/raw/example.txt",
    "script": "loadstring(game:HttpGet(\"…\"))()",
    "risk": {
      "score": 3,
      "level": "Low Risk",
      "isObfuscated": false,
      "findings": [
        {
          "label": "HttpService",
          "severity": "info",
          "description": null
        }
      ]
    },
    "game": {
      "placeId": "123",
      "title": "Game",
      "robloxUrl": "https://www.roblox.com/games/123"
    },
    "creator": {
      "username": "creator",
      "isVerified": true,
      "subscriptionTier": "pro",
      "isPro": true,
      "avatarUrl": null
    },
    "executors": [
      {
        "id": "…",
        "name": "Solara",
        "platforms": [
          "Windows"
        ],
        "imageUrl": null
      }
    ]
  }
}

GET/v1/trending

Parameter	Type	Description
`htmlDescription`default: false	boolean	Return descriptions as raw HTML instead of stripped plain text.
`includeScript`default: false	boolean	Inline raw Lua source in the response. Default off on list/search/trending. Use rawScript URL instead. Always on for script detail.

{
  "success": true,
  "data": {
    "rising": [
      {
        "title": "Rising script",
        "slug": "rising-example",
        "rawScript": "https://rscripts.net/raw/…"
      }
    ],
    "trending": [
      {
        "title": "Hot script",
        "slug": "trending-example",
        "rawScript": "https://rscripts.net/raw/…"
      }
    ]
  }
}

Built by the community

Made something cool? Show us.

A Discord bot. A live server dashboard. Something we haven’t thought of yet. If it’s open source and uses our in-game analytics, we’d love to see it.

Email your public repository, license, a short description, and how you’d like to be credited. Add a demo or screenshots if you have them. We’ll review submissions and may feature selected projects here.

Submit your project

support@rscripts.net · Opens your email app

Error codes

UNAUTHORIZED401Missing or invalid API key

VALIDATION_ERROR400Invalid query parameters

NOT_FOUND404Route or resource not found

RATE_LIMITED429Too many requests

INTERNAL_ERROR500Unexpected server error

SERVICE_UNAVAILABLE503Search service unavailable

Objects

Key fields on script objects. High-risk scripts are excluded from the API by default.

Scriptjson

{
  id, title, slug, description,
  views, likes, dislikes,
  createdAt, lastUpdatedAt, lastBumpedAt,
  isPatched, isMobileReady, isKeySystem, keySystemUrl, isPaid,
  discordUrl, youtubeUrl,
  rawScript,    // URL to fetch Lua source
  script,       // inline Lua (opt-in or detail)
  imageUrl,
  game: { placeId, title, thumbnailUrl, logoUrl, robloxUrl },
  creator: { username, isVerified, isPro, avatarUrl },
  executors: [{ id, name, imageUrl, platforms, discordUrl, websiteUrl }],
  risk: {       // null = not yet scanned
    score,      // 1 (safest) – 10 (highest risk)
    level,      // Safe | Low Risk | Suspicious | Malicious
    isObfuscated, obfuscatorDetected,
    confidence, analyzedAt, matchedPatterns, findings
  }
}

API Reference

Overview

Authentication

Trust & safety

Responses

Rate limits

Shared parameters

In-game analytics

Health

Search

List scripts

Script detail

Trending

Made something cool? Show us.

Error codes

Objects