Skip to main content
The RoLearn API provides programmatic access to all platform data — trending games, forecasts, genre analytics, and more.

​
Base URL

​
Authentication

RoLearn supports three authentication paths. Which one you use depends on the client.
When you sign in through the web app, the server sets three cookies:Because the access token lives in an HttpOnly cookie, XSS cannot steal it. On every state-changing request (POST/PUT/DELETE) the client must echo the rolearn_csrf cookie value back in an X-CSRF-Token header — the server rejects the request otherwise. The browser sends the cookies automatically; you do not send an Authorization header from the web app.
Non-browser clients authenticate with the access token as a bearer credential:
The login endpoint returns the access token in the JSON body for these clients (browsers ignore it and use the cookie instead). Refresh via POST /api/auth/refresh.
Programmatic read access uses an API key sent in the X-API-Key header:
Only keys with the read scope authenticate the public read API. Ingest keys (sdk:ingest / ingest:telemetry) are rejected here — they authenticate only the SDK ingest endpoints. API-key access carries its own generous read limits but no write features (no tracking, no Dev Lens, no revenue sim).
Some read-only endpoints (trending, market overview) work without any authentication but return limited, free-tier data.

​
Token lifecycle

  • Refresh: POST /api/auth/refresh rotates the refresh token (single-use, replay-protected) and issues a fresh access token.
  • Logout: POST /api/auth/logout bumps the account’s token version, revoking all existing sessions durably (single-active-session model).
  • OAuth sign-in: Google, Roblox, Discord, and Twitter/X are supported via the standard authorization-code flow in addition to email + password.
The CSRF requirement and cookie model apply only to the first-party web app. Bearer and X-API-Key clients are not subject to CSRF (they carry no ambient cookie credential).

​
Rate Limits

Rate limits vary by plan and endpoint. The API returns standard HTTP 429 responses when limits are exceeded.

​
Response Format

All responses are JSON. Successful responses return the data directly. Errors return:

​
Plan-Based Access

Many endpoints gate their response based on your subscription plan:
  • Explorer (Free): Limited data (e.g., 20 trending games, score-only ML predictions)
  • Builder: Extended data (e.g., 100 trending games, detailed predictions)
  • Studio / Enterprise: Full access (unlimited results, AI features, confidence intervals)
Some fields are restricted based on your plan level. Upgrade to access additional data.

​
Endpoint surface

This reference documents the core market, game-intelligence, and account endpoints. The full API is much larger — additional groups include:
The complete, always-current spec is served as OpenAPI at /openapi.json. Filter by path prefix to find a specific group (e.g. everything under /api/sdk). The SDK endpoints are also documented on the dedicated SDK docs site.