API v2 overview

API v2 is the public integration surface for Clan Labs. It exposes 51 documented operations for members, ranks, medals, qualifications, blacklists, warnings, suspensions, events, and applications.

For form management, consent-based submissions, and response review, see Applications through the API.

Base URL: https://api.clanlabs.co

Every /v2 request requires a current API key and the community’s Clan ID. API access is a paid-plan feature; API-driven rank management specifically requires Pro.

Make your first requestCopy link to Make your first request

Create a read-only key in Settings → API Keys, then call the member list from a trusted server:

For a Roblox experience, put YOUR_API_KEY in the Creator Hub secrets store as CLAN_LABS_API_KEY, enable HTTP requests, and run the request from a server Script.

Never call API v2 from browser JavaScript or a Roblox LocalScript, and never hard-code the key in experience source code. Web integrations should use a server-side secret manager. Roblox integrations should use the Creator Hub secrets store through HttpService:GetSecret().

Endpoint groupsCopy link to Endpoint groups

Contract and conventionsCopy link to Contract and conventions

• Successful JSON responses wrap the result in data and can include meta for pagination.
• Errors use error.code, error.message, and optional error.details.
• Input is validated against the documented path, query, and JSON schemas.
• Each endpoint declares its required permission and community feature. Roblox operation status and cancellation use the original operation's saved permission on the same enabled API key.
• Limits are configurable. Honor Retry-After and reset details when a 429 response supplies them.
• There is no global idempotency-key contract. Asynchronous Roblox operations require one; reconcile other uncertain writes before retrying.

The endpoint pages are generated from the maintained API v2 schema. Download the exact contract at OpenAPI JSON.

Roblox player identifiersCopy link to Roblox player identifiers

Routes with {userId} accept a global Roblox user ID, or a Roblox username when ?by=username is present. Prefer usernames for calls originating from a Roblox experience: Roblox can present scoped user identifiers for players new to that experience, while Player.Name remains the actual username.

Continue with Authentication and API keys and scopes.