Data
Caching and CORS
The keyless tier is held by the CDN for a window per endpoint; a keyed answer is yours alone and never cached.
Windows
Each keyless endpoint has a window the CDN holds its answer for, and a stale copy is served for twice that while a fresh one is fetched, so a slow read of Roblox never reaches you as a slow answer.
| Endpoint | Held for | Why |
|---|---|---|
GET /v1 | 1 hour | The index changes only with a release. |
GET /v1/live | 5 seconds | The counts Roblox refreshes most often. |
GET /v1/games | 5 minutes | The list behind the studio's own pages. |
GET /v1/games/{universeId} | 5 minutes | Read out of the same list. |
GET /v1/limits | 1 hour | A static list that changes only when the limits page does. |
GET /v1/limits/{id} | 1 hour | Read out of the same list. |
Every keyed endpoint | not cached | The answer is yours alone; cache-control: no-store. |
Headers
A keyless answer carries cache-control: public, s-maxage=N, stale-while-revalidate=2N and open CORS. A keyed answer carries cache-control: no-store and no CORS header at all: an answer to a request with an Authorization header is never cached at the edge, by the CDN's own rule, and a browser cannot call a keyed endpoint, on purpose. Errors are never cached.
From a browser
A page on any domain may fetch the keyless endpoints directly; preflights are answered for GET and OPTIONS. Keep keys out of pages: a keyed call from a browser fails its preflight, and a key in a script is a leaked key.