Reseller API guide

HTTP API for authorized partners who resell Roblox resolve capacity. Calls hit the same upstream resolve pipeline as Discord /resolve, authenticated with your personal SSW-* key.

Interactive reference (Swagger): API docs — served live from your Sinister host.

What this API is

Yes	No
Automate username, game, VIP, reserved resolves from your backend	Replace SinisterClient or cookie linking for end users
Integrate resolves into your own panel or bot	Grant Sinister Script or in-game UI access
Yuni-compatible GET paths plus legacy POST aliases	Obfuscate Lua (`OBF-*` is a separate product)

Reseller keys meter resolve calls only. They do not include subscriber features (desktop app, script builds, Discord sub perks) unless you also sell those separately.

Base URL

All paths are on your Sinister host — the same HTTPS domain as the public app and help site:

https://YOUR_SINISTER_HOST

Examples below use placeholders. Replace YOUR_SINISTER_HOST and SSW-YOUR_KEY.

Discovery:

URL	Purpose
`/api/docs`	Swagger UI (try requests in browser)
`/api/openapi.json`	Machine-readable OpenAPI 3 spec

Authentication

Send your reseller key on every resolve request.

Header (recommended)

http

X-API-Key: SSW-YOUR_KEY

Alternate header (legacy)

http

X-Proxy-API-Key: SSW-YOUR_KEY

Query string (avoid in production logs)

http

GET /api/roblox?username=RobloxUser&api_key=SSW-YOUR_KEY

Bearer SSW-… in X-API-Key is also accepted.

Staff keys (not for resellers)

/staff/* routes use a separate X-Staff-API-Key configured on the server. That key manages reseller keys; it is not your SSW-* resolve key. Never embed staff keys in client apps.

Getting a reseller key

SSW-* keys are issued by Sinister Softworks to approved partners. You receive:

Field	Meaning
`SSW-…`	API key value
Expiry	Optional expiration timestamp
Daily limit	Optional max resolves per UTC day (`0` = unlimited)
Label	Internal note for support

Contact support or your account rep to request a key, rotation, or limit change.

Response format

Success

json

{
  "success": true,
  "response": "Command sent",
  "ip": "203.0.113.10",
  "port": "53640"
}

ip / port — join target returned by the resolver (string port is normal).
response — human-readable status from upstream.

Failure

json

{
  "success": false,
  "error": "User is not in a game"
}

HTTP status is usually 200 with success: false for resolve failures. Auth and limit errors use 403 / 429 / 503 as listed below.

Shared query parameters

Most GET resolve endpoints accept:

Parameter	Type	Default	Purpose
`cookie`	string	—	Optional `.ROBLOSECURITY` for upstream (use carefully; prefer server-side storage)
`hub`	bool	`false`	Hub-mode teleport resolves (username / userid paths)
`power`	number	`3`	Resolve power passed upstream
`seconds`	integer	`0`	Duration / timeout hint upstream

Resolve endpoints (GET)

Preferred paths use the /api/resolve/… prefix. Legacy yuni names (/api/roblox, etc.) call the same handlers.

Username snipe

http

GET /api/resolve/username?username=DisplayName
GET /api/roblox?username=DisplayName

Param	Required
`username`	Yes

User ID

http

GET /api/resolve/userid?userid=123456789
GET /api/roblox-id?userid=123456789

In-game (place + job)

http

GET /api/resolve/game?placeid=920587237&gameid=aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee
GET /api/roblox-game?placeid=920587237&gameid=aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee

Param	Required
`placeid`	Yes (integer)
`gameid`	Yes (job UUID string)

Reserved server

http

GET /api/resolve/reserved?placeid=920587237&accesscode=YOUR_ACCESS_CODE
GET /api/roblox-reserved?placeid=920587237&accesscode=YOUR_ACCESS_CODE

Private server — link ID

http

GET /api/resolve/private/linkid?linkid=1234567890123456789
GET /api/roblox-private-linkid?linkid=1234567890123456789

Private server — link code

http

GET /api/resolve/private/linkcode?placeid=920587237&linkcode=AbCdEfGh
GET /api/roblox-private-linkcode?placeid=920587237&linkcode=AbCdEfGh

Private server — access code

http

GET /api/resolve/private/accesscode?placeid=920587237&accesscode=YOUR_CODE
GET /api/roblox-private-accesscode?placeid=920587237&accesscode=YOUR_CODE

Friend private server

http

GET /api/resolve/private/friends?friend=FriendUsername&placeid=920587237
GET /api/roblox-private-friends?friend=FriendUsername&placeid=920587237

Legacy POST endpoints

Older integrations may use JSON POST bodies. Same auth headers apply.

Snipe (username)

http

POST /api/snipe
Content-Type: application/json
X-API-Key: SSW-YOUR_KEY

json

{
  "username": "DisplayName",
  "hub": false,
  "power": 3,
  "seconds": 0,
  "cookie": null
}

Game (place + job)

http

POST /api/game

json

{
  "placeid": 920587237,
  "jobid": "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee",
  "hub": false,
  "power": 3,
  "seconds": 0
}

VIP (private link id)

http

POST /api/vip

json

{
  "code": "1234567890123456789",
  "power": 7,
  "seconds": 300
}

code is the private server link id (same as linkid on GET routes).

Example: curl

bash

curl -sS -G "https://YOUR_SINISTER_HOST/api/resolve/username" \
  -H "X-API-Key: SSW-YOUR_KEY" \
  --data-urlencode "username=TargetUser" \
  --data-urlencode "power=5"

Example: Python

python

import requests

HOST = "https://YOUR_SINISTER_HOST"
KEY = "SSW-YOUR_KEY"

def resolve_username(username: str, *, power: float = 3.0) -> dict:
    r = requests.get(
        f"{HOST}/api/resolve/username",
        headers={"X-API-Key": KEY},
        params={"username": username, "power": power},
        timeout=60,
    )
    r.raise_for_status()
    data = r.json()
    if not data.get("success"):
        raise RuntimeError(data.get("error") or "resolve failed")
    return data

print(resolve_username("SomeRobloxUser"))

Rate limits and quotas

Limit type	Behavior
Per-key daily cap	If your key has `daily_resolves` set, exceeding it returns 403 with a daily-limit message until UTC reset
Upstream cooldown	Resolver may return `error: "Rate limited"` → HTTP 429; back off exponentially
Abuse	Keys may be suspended without notice if traffic is abusive

Do not hammer the API on 429. Wait at least a few seconds and retry with jitter.

Each successful resolve increments your key’s counters server-side for billing and support.

HTTP status codes

Code	Meaning
200	Request processed (check `success` in JSON)
400	Missing or invalid query/body parameter
403	Missing key, invalid key, expired key, suspended key, or daily limit
429	Upstream rate limited (`Rate limited` in body)
500	Unexpected server error
503	Reseller API disabled, key service down, or upstream resolver unavailable

Security practices

Server-side only — never ship SSW-* keys in browser JavaScript, mobile apps, or public Git repos.
Rotate on leak — contact support immediately; old key will be suspended.
Log safely — redact keys in application logs; in support tickets share only the last four characters of the key plus UTC timestamp and path.
Cookies — if you pass cookie query/body params, treat them as secrets at rest.
HTTPS only — do not call the API over plain HTTP in production.

Product comparison

Product	Key prefix	Purpose
Reseller API	`SSW-*`	HTTP resolves for partners
Obfuscator API	`OBF-*`	`/api/v1/obfuscate/*`
Client build	`SCB-*`	SinisterClient desktop
Script build	`SSB-*`	Sinister Script in-game

See Obfuscator API quickstart for OBF-*.

Vs retail Sinister subscription

Reseller API	Normal subscription
You integrate HTTP into your product	End users use Discord + optional SinisterClient
Per-key metering	Per-user plan flags and daily limits
No cookie portal for your customers unless you build it	`/auto-link` and client proxy built-in

Many partners sell both: retail subs for consumers and API keys for automation.

Support checklist

When opening a ticket, include:

UTC timestamp of the failure
Full request path without the key value
HTTP status code and error field from JSON body
Last four characters of SSW-* key
Resolve type (username, game, VIP, etc.)

Reseller API guide ​

What this API is ​

Base URL ​

Authentication ​

Header (recommended) ​

Alternate header (legacy) ​

Query string (avoid in production logs) ​

Staff keys (not for resellers) ​

Getting a reseller key ​

Response format ​

Success ​

Failure ​

Shared query parameters ​

Resolve endpoints (GET) ​

Username snipe ​

User ID ​

In-game (place + job) ​

Reserved server ​

Private server — link ID ​

Private server — link code ​

Private server — access code ​

Friend private server ​

Legacy POST endpoints ​

Snipe (username) ​

Game (place + job) ​

VIP (private link id) ​

Example: curl ​

Example: Python ​

Rate limits and quotas ​

HTTP status codes ​

Security practices ​

Product comparison ​

Vs retail Sinister subscription ​

Support checklist ​

Related ​

Reseller API guide

What this API is

Base URL

Authentication

Header (recommended)

Alternate header (legacy)

Query string (avoid in production logs)

Staff keys (not for resellers)

Getting a reseller key

Response format

Success

Failure

Shared query parameters

Resolve endpoints (GET)

Username snipe

User ID

In-game (place + job)

Reserved server

Private server — link ID

Private server — link code

Private server — access code

Friend private server

Legacy POST endpoints

Snipe (username)

Game (place + job)

VIP (private link id)

Example: curl

Example: Python

Rate limits and quotas

HTTP status codes

Security practices

Product comparison

Vs retail Sinister subscription

Support checklist

Related