HttpService¶
Allows sending HTTP requests and provides various web-related and JSON methods.
Note: GetAsync/PostAsync and JSON helpers work. HttpEnabled is LocalUserSecurity, so the host must enable it.
Description¶
HttpService allows HTTP requests to be sent from experience servers using
RequestAsync,
GetAsync and
PostAsync. This service allows experiences to
be integrated with third-party web services such as analytics, data storage,
remote server configuration, error reporting, advanced calculations, or
real-time communication. Additionally, it can call a subset of the Open Cloud
APIs.
For more information about these use cases, see In-experience HTTP requests.
HttpService also houses the JSONEncode and
JSONDecode methods, which are useful for
communicating with services that use the JSON format. In
addition, the GenerateGUID method provides
random 128‑bit labels which can be treated as probabilistically unique in a
variety of scenarios.
Within Studio, use CreateWebStreamClient() to process data in real time from servers that support streaming protocols such as SSE, chunked transfer encoding, and WebSockets. You can connect callback functions to stream events, allowing you to process data immediately as it arrives instead of waiting for the entire response to complete.
Only send HTTP requests to trusted third-party platforms to avoid introducing unnecessary security risks to your experience.
Inheritance¶
Object → Instance → HttpService
Nova inheritance: Instance → HttpService
Properties¶
HttpEnabled Supported Property Indicates whether HTTP requests can be sent to external websites.
Indicates whether HTTP requests can be sent to external websites.
When set to true, allows scripts to send requests to websites using
HttpService.GetAsync(), HttpService.PostAsync(), and
HttpService.RequestAsync().
This property must be toggled on for unpublished experiences by
setting this property to true using the
Command Bar:
game:GetService("HttpService").HttpEnabled = true
LocalUserSecurityMethods¶
GenerateGUID Supported Function Generates a UUID/GUID random string, optionally with curly braces.
Generates a UUID/GUID random string, optionally with curly braces.
This method generates a random universally unique identifier
(UUID)
string. The sixteen octets of a UUID are represented as 32 hexadecimal
(base 16) digits, displayed in five groups separated by hyphens in
the form 8-4-4-4-12 for a total of 36 characters, for example
123e4567-e89b-12d3-a456-426655440000.
The UUID specification used is Version 4 (random), variant 1 (DCE 1.1, ISO/IEC 11578:1996). UUIDs of this version are the most commonly used due to their simplicity, as they are entirely randomly generated. Note that this version does not have certain features that other UUID versions have, such as encoded timestamps, MAC addresses, or time-based sorting like UUIDv7 or ULID.
There are over 5.3×1036 unique v4 UUIDs, in which the probability of finding a duplicate within 103 trillion UUIDs is one in a billion.
The wrapInCurlyBraces argument determines whether the returned string is
wrapped in curly braces ({}). For instance:
true:{94b717b2-d54f-4340-a504-bd809ef5bf5c}false:db454790-7563-44ed-ab4b-397ff5df737b
This method can be used regardless of whether HTTP requests are enabled.
GetAsync Supported Function Sends an HTTP GET request.
This method sends an HTTP GET request. It functions similarly to
RequestAsync() except that it accepts
HTTP request parameters as method parameters instead of a single
dictionary and returns only the body of the HTTP response. Generally, this
method is useful only as a shorthand and
RequestAsync() should be used in most
cases.
When true, the nocache parameter prevents this method from caching
results from previous calls with the same url.
The url parameter also accepts a Secret value; use
GetSecret combined with
AddPrefix and
AddSuffix to safely embed secret credentials
(such as API keys) directly in the URL without exposing their values.
Roblox reference signature
JSONDecode Supported Function Decodes a JSON string into a Luau table.
Decodes a JSON string into a Luau table.
This method transforms a JSON object or array into a Luau table with the following characteristics:
- Keys of the table are strings or numbers but not both. If a JSON object contains both, string keys are ignored.
- An empty JSON object generates an empty Luau table (
{}). - If the
inputstring is not a valid JSON object, this method will throw an error.
To encode a Luau table into a JSON object, use the HttpService.JSONEncode() method.
This method can be used regardless of whether HTTP requests are enabled.
JSONEncode Supported Function Generate a JSON string from a Luau table.
Generate a JSON string from a Luau table.
This method transforms a Luau table into a JSON object or array based on the following guidelines:
- Keys of the table must be either strings or numbers. If a table contains both, an array takes priority (string keys are ignored).
- An empty Luau table (
{}) generates an empty JSON array (e.g.[]). - Whether passing a dictionary table or a numerically indexed table, avoid
nilvalues for any index. - Cyclic table references cause an error.
This method allows values such as inf and nan which are not valid
JSON. This may cause problems if you want to use the outputted JSON
elsewhere.
This method also accepts buffers up to 50 MiB, which it encodes to base64 (and often compresses) before converting to a JSON object.
To reverse the encoding process and decode a JSON object, use the HttpService.JSONDecode() method.
This method can be used regardless of whether HTTP requests are enabled.
PostAsync Supported Function Sends an HTTP POST request.
HttpService:PostAsync(string url, string data, HttpContentType content_type = ApplicationJson, bool compress = false): string
This method sends an HTTP POST request. It functions similarly to
RequestAsync() except that it accepts
HTTP request parameters as method parameters instead of a single
dictionary and returns only the body of the HTTP response. Generally, this
method is useful only as a shorthand and
RequestAsync() should be used in most
cases.
When true, the compress parameter controls whether a large request
body is compressed using gzip.
The url parameter also accepts a Secret value — use
GetSecret combined with
AddPrefix and
AddSuffixto safely embed secret credentials
(such as API keys) directly in the URL without exposing their values.
Roblox reference signature
UrlEncode Supported Function Replaces URL-unsafe characters with '%' and two hexadecimal characters.
Replaces URL-unsafe characters with '%' and two hexadecimal characters.
This method
percent-encodes a given
string so that reserved characters properly encoded with % and two
hexadecimal characters.
This is useful when formatting URLs for use with
HttpService.GetAsync()/HttpService.PostAsync(), or POST
data of the media type application/x-www-form-urlencoded
(Enum.HttpContentType.ApplicationUrlEncoded).
For instance, when you encode the URL https://www.roblox.com/discover#/,
this method returns https%3A%2F%2Fwww%2Eroblox%2Ecom%2Fdiscover%23%2F.
Inherited members¶
Inherited from Instance: 8 properties, 36 methods, 7 events. They are documented on the base class page.
11 modern Roblox member(s) are not implemented yet — expand to inspect
Members declared by Roblox's HttpService class (or by a missing base class) that Nova does not expose. Use this list to scope a migration; the compatibility guide has the recommended workaround.
Methods¶
| Member | Signature | Status | Notes | Flags |
|---|---|---|---|---|
CreateWebStreamClient |
HttpService:CreateWebStreamClient(streamClientType: WebStreamClientType, requestOptions: Dictionary): WebStreamClient |
Not yet | Creates a client that opens a persistent connection to stream data. | — |
CreateWebStreamClientInternal |
HttpService:CreateWebStreamClientInternal(streamClientType: WebStreamClientType, requestOptions: Dictionary): WebStreamClient |
Not yet | — | RobloxScriptSecurity |
GetHttpEnabled |
HttpService:GetHttpEnabled(): bool |
Not yet | — | RobloxScriptSecurity |
GetSecret |
HttpService:GetSecret(key: string): Secret |
Not yet | Returns a Secret from the secrets store. | — |
GetUserAgent |
HttpService:GetUserAgent(): string |
Not yet | — | RobloxScriptSecurity |
JSONDecodeAsync |
HttpService:JSONDecodeAsync(input: string): Variant |
Not yet | — | Yields, RobloxScriptSecurity |
JSONEncodeAsync |
HttpService:JSONEncodeAsync(obj: Variant): string |
Not yet | — | Yields, RobloxScriptSecurity |
RequestAccessTokenScopesAsync |
HttpService:RequestAccessTokenScopesAsync(requiredScopes: Array): Secret |
Not yet | — | Yields, LocalUserSecurity |
RequestAsync |
HttpService:RequestAsync(requestOptions: Dictionary): Dictionary |
Not yet | Sends an HTTP request using any HTTP method given a dictionary of information. | Yields |
RequestInternal |
HttpService:RequestInternal(options: Dictionary): Instance |
Not yet | — | RobloxScriptSecurity |
SetHttpEnabled |
HttpService:SetHttpEnabled(enabled: bool): null |
Not yet | — | RobloxScriptSecurity |
Roblox reference: HttpService
Generated from Nova's API dump and Roblox creator-docs. Nova-only members come from the engine's reflection metadata.