API Acceptable Use Policy

Last updated: October 19, 2026

This policy covers the [x]Tracker API at api.xtracker.xyz and every API key made with /genkey. It sits alongside our Terms of Service and Privacy Policy. By using a key you agree to it.

The short version

• Ask the API when you need an answer. Don't build your own copy of our data.
• Don't store or cache what it returns. The only exception is holding a result in memory for up to 10 minutes.
• Don't scrape. No looping through ID ranges and no bulk downloads.
• Your key is yours alone. Never share it and never publish it.
• A listing is not a verdict. Don't use it to harass anyone.
• Break these rules and we will revoke your key.

1. Who can have a key

To generate a key your Discord account must be at least one year old, you must have been in our community server for at least two weeks, and you must be verified there. Each person can have one key. A key belongs to the person who generated it, and you are responsible for everything done with it.

2. What you can use it for

• Checking whether a specific Roblox account is listed, for example when someone joins your Discord server, your game or your group, or when someone is reported to you.
• Helping people who run a community decide how to protect it. The decision stays with a human.
• Showing a result to the person who asked for it, for example in a bot command.

You may not use the API to resell lookups, to build or feed a competing registry or lookup service, or to collect data to train models or build datasets.

3. Storing and caching

This is the rule we care most about. The registry is the work of our staff, and it changes: entries are corrected or removed after appeals. A stored copy keeps someone listed after we have cleared them, and keeps showing "not listed" for someone we have since added. So:

• Ask live. Each time you need an answer, ask the API.
• Memory only, up to 10 minutes. You may keep a response in memory for up to 10 minutes, so you don't ask twice for the same account in one burst. That includes "not found" answers, and a "not found" answer is not proof that someone is clean. Clear it when the time is up or the program restarts.
• Never write it down. Don't save responses in a database, file, spreadsheet, log, backup, message or paste site.
• Keep your own record of what you did, not our data. A note such as "banned user 123 on 19 October because they are listed on [x]Tracker" is fine. Our evidence, links, alt-account lists and the response itself are not.
• Don't republish or mirror. Don't re-serve our data through your own website, API or public bot, and don't copy evidence or vault media anywhere else.
• Delete on request. If we ask you to delete data you hold, do it within 7 days.

4. No scraping

Only check accounts that have a reason to be checked. Don't loop through ID ranges, build lists of accounts to harvest which ones are listed, or try to download the registry. If you need to check a whole Roblox group, use /gc in our Discord instead.

5. Rate limits

Right now each IP address can make about 30 requests every 10 seconds. If you go over you get an error (HTTP 429) and a short timeout. Repeated hits earn strikes, and repeated strikes get your key revoked and your IP address blocked. When you get a 429, slow down and wait before trying again. Don't retry in a tight loop, and don't switch IP addresses or keys to get around the limit. Limits can change, so build your code to cope with 429s.

6. Keeping your key safe

• Never share, sell, lend or trade a key.
• Keep it on a server you control. Never put it in code that people can see, such as a public repository, a website's front end or a Roblox client script.
• If it leaks, run /deletekey straight away and generate a new one.

7. Using the information fairly

• A registry entry reflects what our staff saw at the time. It is not a legal accusation and it can be wrong. See section 3 of the Terms.
• Don't use a listing to harass, threaten, expose or shame anyone.
• If you take action because of a listing, tell the person it came from [x]Tracker so they can appeal in our Discord community.
• If you show registry results to other people, say that they come from [x]Tracker.

8. What we log

To keep the API working and to spot abuse, we record each request: the time, your IP address, the endpoint, the Roblox ID you asked about and a shortened version of your key. We also look at usage patterns, for example a key that asks about thousands of unrelated accounts. See the Privacy Policy for more.

9. If you break these rules

Depending on how serious it is, we may warn you, revoke your key, block your IP address, or blacklist you from the bot. If you publish or sell our data we may also take further steps. If you think we got it wrong, open an appeal ticket.

10. Changes and questions

We may update this policy. The date at the top shows when it last changed, and we will announce big changes in our Discord community. If you keep using your key after a change, you accept the new version. Questions or removal requests: join our Discord community and open a ticket.