Applications through the API

Trusted integrations can manage application forms, submit for verified Roblox accounts, and review responses. Use the normal Bearer API key and X-Clan-Id headers. Enable API access for the community and grant the required scopes explicitly; existing keys gain no new access automatically.

A community must not submit a response on a member's behalf without that member's explicit consent to the submission. Verification and API access do not imply consent. The trusted server must also authenticate the player and supply their global Roblox user ID, rather than trusting an arbitrary client claim. Keep API keys out of browsers and Roblox client scripts.

Choose scopesCopy link to Choose scopes

These scopes are independent. Form management does not grant response access, and submission access does not grant access to other applicants' answers or private notes. See API keys and scopes.

Available routesCopy link to Available routes

Each link opens the generated request/response schemas and cURL, TypeScript, and server-side Roblox Lua examples. Paths below are relative to /v2.

Create and update formsCopy link to Create and update forms

Templates and duplicationCopy link to Templates and duplication

These routes require applications.write because template definitions include answer keys:

• GET /applications/templates returns items and nextCursor. Community templates are tenant-private, with 20 per page; pass cursor unchanged for the next page.
• POST /applications/templates accepts a name and complete definition to save a reusable community template.
• DELETE /applications/templates/{templateId} removes a saved template without affecting applications created from it.
• POST /applications/{applicationId}/duplicate accepts {} or an optional name and creates an independent, closed version-1 application with a creation audit.

Use a returned template's definition with POST /applications to create a form. Copies preserve questions, options, answer keys and grading settings, but exclude passwords, responses and join requirements. They start closed. Creating a form with automatic grading still requires active Pro access. Templates are snapshots: to revise one, save a replacement and delete the old template.

Form configurationCopy link to Form configuration

Create accepts a complete definition and an optional password. Fetch /configuration to edit, then send the complete definition and current version to update. Omit password to retain it, use null to remove it, or supply a new value. Passwords and hashes are never returned. A stale version returns 409.

Question types are short, long, single, and multiple. The API uses stable question and option IDs; text answers are strings and choice answers are arrays of option IDs. The generated schemas describe all limits.

Automatic grading requires active Pro access and required choice questions with an answer key. API configuration uses grading.passPercentage; the dashboard presents the equivalent whole-question allowance as Leniency. Questions are equally weighted and multi-select answers must match the complete correct set. After a downgrade, new responses wait for staff review while the saved configuration and previous results remain intact.

Creation and updates write API-attributed audit entries compatible with eligible individual dashboard rollback for 30 days. Updates create new versions and preserve earlier responses and passes. Deletion requires the current version, closes the link, and preserves historical responses. Required forms cannot be closed or deleted; change their requirements in dashboard Pending Join settings first.

Open, submit, and check a resultCopy link to Open, submit, and check a result

1. Obtain the member's explicit consent and authenticate their Roblox identity on your trusted server.
2. Call /open with userId and the password when required. It checks verification, restrictions, blacklists, and password access before returning questions and the current version, without answer keys.
3. Submit to /responses with userId, version, password when required, and answers. Names, Discord ownership, and grading are resolved by Clan Labs.
4. Call /status with the same access body as /open to recheck access and retrieve the result. It returns data.response as null or a result without answers, scores, answer keys, or staff notes.

The applicant need not already belong to the community. Required answers must be complete, choice IDs valid, and the entire response nonempty. Questions, options, and answers use the same sensitive-information checks as the dashboard. Do not request or submit personal information.

Each Roblox account may submit once per application version. Duplicate submissions or stale versions return 409; invalid answers return 400; an incorrect password or ineligible account returns 403. Unavailable group eligibility checks fail closed with 503. Opening, submission, and status share a 20-attempt-per-minute bucket per API key when rate limiting is enabled, alongside normal API limits.

After an uncertain submission response, check status before retrying. See Requests and retries.

Read and review responsesCopy link to Read and review responses

Form and response lists return data.items and data.nextCursor. Pass an opaque cursor unchanged to request the next page. Response lists accept status, userId, and limit from 1–100, defaulting to 25.

Response detail includes submitted question snapshots, answers, score, and private review notes, but excludes answer keys, password hashes, and Discord IDs. Response reads remain available after the form is deleted. Protect this data within your integration.

Review accepts revision, status (Passed or Failed), a private note, and optional feedback for the applicant. Feedback is trimmed, limited to 2,000 characters, and checked for sensitive information. Result DTOs expose it as applicantFeedback; private notes are never substituted for it. Applicant access omits feedback after a Roblox account transfers to another Discord owner. It is a final decision attributed to the API key; the integration is responsible for authorising its own reviewers. Already graded, concurrently changed, or data-rights-protected responses cannot be changed. Neither submission nor review accepts a caller-supplied grade or score.

New final decisions create a dashboard notification and queue a Discord DM to the original submitting Discord account. The result notification includes any applicant feedback; the DM links to that result. Notifications exclude answers and private notes. Pending responses do not notify, and DM failure does not undo the decision. No extra notification scope is required.

Passing does not itself accept a Roblox join request. For manual response deletion, use Clear all responses or Delete selected in the dashboard; these API routes do not delete responses. See the applications guide.