POST Auth /api/v1/safety

/safety returns a single safety verdict for a Roblox user. You send a username; the server resolves it to a Roblox ID itself, then runs a TASE check and a Rotector check against that ID and returns whether the player is safe, dangerous, or needs review.

The username is converted to a Roblox ID server-side on purpose. Never send a Roblox ID directly — resolving it here prevents a renamed or spoofed account from slipping past the check.

Authentication

This endpoint is protected. Send a managed API key (see /api in Discord):

Authorization: Bearer YOUR_API_KEY

Request

POST https://api.kiba-is-a.top/api/v1/safety
Content-Type: application/json
Authorization: Bearer YOUR_API_KEY

{
  "username": "SomeRobloxUser"
}

Field	Type	Notes
`username`	string	Roblox username (3-20 chars). Resolved to an ID server-side.

Response

{
  "username": "SomeRobloxUser",
  "roblox_user_id": 123456789,
  "verdict": "unsafe",
  "safe": false,
  "rotector": {
    "flag_type": 2,
    "flag_name": "Confirmed",
    "category": "Condo",
    "actionable": true,
    "review": false,
    "error": null
  },
  "tase": {
    "flagged": true,
    "group_count": 4,
    "error": null
  }
}

Verdicts

verdict	safe	When	Suggested game action
`unsafe`	`false`	Rotector Flagged or Confirmed, or TASE flagged.	Block / kick. Also alerts staff.
`review`	`true`	Rotector Queued, Provisional, or Mixed.	Allow, but staff are alerted to review.
`safe`	`true`	No actionable flag and no review flag.	Allow.

Both unsafe and review are recorded in the in-game log as a Threat Detection (falling back to the moderation log if the in-game log isn't set up), flagging the user as dangerous (review = pending review).

Rotector Flag Types

The rotector.flag_type field follows Rotector's classification. Only types 1 and 2 are auto-actioned here.

Type	Name	Actionable
`0`	Unflagged	No
`1`	Flagged	Yes → unsafe
`2`	Confirmed	Yes → unsafe
`3`	Queued	No → review
`4`	Provisional Flag	No → review
`5`	Mixed	No → review
`6`	Past Offender	No
`8`	Redacted	No

Roblox Server Example

local HttpService = game:GetService("HttpService")

local function checkSafety(username)
    local ok, body = pcall(function()
        return HttpService:RequestAsync({
            Url = "https://api.kiba-is-a.top/api/v1/safety",
            Method = "POST",
            Headers = {
                ["Content-Type"] = "application/json",
                ["Authorization"] = "Bearer YOUR_API_KEY",
            },
            Body = HttpService:JSONEncode({ username = username }),
        })
    end)
    if not ok or not body.Success then return nil end
    return HttpService:JSONDecode(body.Body)
end

game.Players.PlayerAdded:Connect(function(player)
    local result = checkSafety(player.Name)
    if result and result.verdict == "unsafe" then
        player:Kick("Flagged by safety check. Appeal at rotector.com")
    end
end)

Out-of-Game Test

curl -X POST "https://api.kiba-is-a.top/api/v1/safety" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"username":"SomeRobloxUser"}'

Rate Limit

POST /safety is limited to 50 requests per 10 seconds per IP. This matches Rotector's upstream standard-tier limit (50 req/10s per IP); each safety call makes one Rotector lookup. The limit can be raised once a Rotector API key is configured.

Status Codes

HTTP	Meaning
`200`	Verdict returned.
`400`	Invalid Roblox username.
`401`	Missing or invalid API key.
`404`	Username could not be resolved to a Roblox ID.
`429`	Too many requests.

Attribution

Safety data is provided by Rotector. Per their terms, flagged users may appeal at rotector.com, and flag results must not be cached longer than 24 hours.