Roblox capabilities

The platform that matters most to Sway's core age band, and the one we cannot integrate with.

Verdict: do not build a Roblox API integration

This is not a scope-approval problem a good application will solve. Three things each defeat it independently: the data does not exist in Open Cloud; the endpoints that carry it are cookie-only; and Roblox prohibited this product category on 2026-06-02.

1. The data does not exist in Open Cloud

Across all 31 documented feature areas there are exactly four OAuth scopes that touch a consumer's own account:

user.advanced:read              → idVerified
user.social:read                → socialNetworkProfiles
user.inventory-item:read        → inventory items
legacy-universe.following:read  → followed universes

The other ~65 scopes are creator-side — universe.*, group*, asset*, creator-store*. They govern content the user made, never content they consumed. Confirmed

What a fully-authorised Sway could actually display

Username, display name, bio, avatar, account creation date, Premium status, ID-verified flag, locale, inventory, badges, followed experiences.

Not one minute of playtime. Not one chat message. Not one friend.

A trap for engineers

friends.roblox.com, presence.roblox.com, economy.roblox.com and similar are undocumented internal web endpoints, not Open Cloud. Roblox now lists them in its reference — which is new and genuinely misleading — but every one is marked Auth: Cookie (.ROBLOSECURITY) with "not recommended, do not use in production". Zero accept OAuth. Using them means holding the child's full session token, bypassing 2FA.

2. Roblox prohibited this product category

From an official Roblox staff post of 2 June 2026, re-fetched and verified verbatim for this document — devforum 4665118:

Exposing Data to Others

"Creators may not build or release tools that expose one user's individual data to another user."

Two further prohibitions, both primary text:

Creator Terms: Creators must not use user PII "to provide services to any third party", nor "to build… profiles… across the Services or any third party websites or platforms", nor build "tools that could expose one User's PII to another User"
Third Party App Policy: "Regardless of where the data or information is sourced, we do not allow the profiling of Roblox users in any way for any purpose"

The drafting forecloses the safety argument deliberately

"Regardless of where the data or information is sourced" appears twice. "In any way for any purpose" and "Regardless of intended purpose" remove the safety-purpose defence explicitly. A child-safety justification is not a carve-out — the clause is written to exclude exactly that argument.

There is a carve-out for "Private Account Data Sharing… features that serve an individual player" — but it is scoped to the player themselves, not a supervising second party. A narrow argument exists; it is not a strong one. The announcement thread drew ~30 replies asking for exactly this clarification and Roblox answered none of them.

3. Roblox is moving away from parental visibility

The strategy is platform-enforced age segregation, replacing parent-observes-child. A third-party monitoring integration is swimming against Roblox's product direction, not just its policy.

What Roblox's own dashboard shows — and why it doesn't help

Surface	What the parent gets	API?
Screen time	"a seven-day average" — no session log, no timestamps	None
Top experiences	"top 20 experiences from the last week… experience, content maturity and play time"	None
Spend	Monthly limit + threshold notifications. No browsable ledger	None
Connections	"view, block, and report your child's Roblox connections"	None
Chat	Settings only. A parent can never read a chat message	None

There is no partner programme, no safety API, and no parental-controls endpoint. Roblox's safety partners page lists NGOs and industry bodies, and zero consumer parental-monitoring vendors.

What is actually buildable — off the Roblox API entirely

Android Exact

UsageStatsManager.queryEvents() gives exact foreground milliseconds for com.roblox.client. Explicitly the sanctioned exception to Google's stalkerware ban — requires the IsMonitoringTool flag and a persistent notification whenever running.

iOS Banded

The report extension's "sandbox prevents your extension from making network requests or moving sensitive content outside the extension's address space". You get a staircase, not a number — only threshold event names cross. Full fidelity exists only on iOS 26.4 in the EU.

Console & PC Invisible

Not covered by any mobile approach. Roblox does not publish DAU by platform, so you cannot even estimate the undercount. The dashboard must say so.

Two blocking prerequisites

Apple Family Controls distribution entitlement for ~4 bundle IDs. Development is self-serve; distribution needs Apple approval, and it gates EAS dev clients, not just release builds. Request on day one.
apps/mobile is managed Expo 53. The on-device route needs prebuild/bare. That is a workflow migration, not a dependency addition.

The one door Roblox holds open

Roblox's Chief Safety Officer, August 2025: "Roblox has a Trusted Flagger program, where close and trusted partners can report serious criminal activity… We are always looking to expand this program and welcome outreach from interested entities."

This confers no API or data rights — it is a reporting channel. But it is the only sanctioned relationship path with Roblox for a child-safety organisation, and the right vehicle for asking whether a guardian dashboard falls under the "Private Account Data Sharing" carve-out.