Introduction

exploit.today API

A free, public REST API that provides real-time Roblox version data and exploit status information. No authentication required.

Base URL

endpoint

https://exploit-today-api.igshvszkbxix.workers.dev

Endpoints at a glance

GET /api/windows Current Windows Roblox version

GET /api/macos Current macOS Roblox version

GET /api/exploit/{name} Exploit status by name

GET /versions All platform versions (combined)

GET /exploits All exploit statuses (combined)

About

Version data is sourced directly from clientsettingscdn.roblox.com. Future version hints are shown only when they differ from the current version. Exploit status data is powered by WhatExpsAre.Online and individual exploit providers.

All responses include Access-Control-Allow-Origin: * — safe to call directly from a browser or any client.

Getting Started

Quickstart

Make your first API call in under a minute. No API key, no setup.

JavaScript

javascript
const res = await fetch('https://exploit-today-api.igshvszkbxix.workers.dev/api/windows');
const data = await res.json();
console.log(data.version);

Python

python
import requests

res = requests.get("https://exploit-today-api.igshvszkbxix.workers.dev/api/windows")
data = res.json()
print(data["version"])

curl

bash

curl https://exploit-today-api.igshvszkbxix.workers.dev/api/windows

Reference

Rate Limits

The API is free and public. Please be reasonable with request frequency.

No hard rate limits are enforced. Polling more than once every 10 seconds is unnecessary — responses are cached at the edge for 10 seconds.

Responses include Cache-Control: public, max-age=10, stale-while-revalidate=20. Most HTTP clients will respect this automatically.

Roblox Versions

Windows Version

Returns the current Roblox client version for Windows, sourced directly from Roblox's client settings CDN.

GET /api/windows

No parameters required.

Response

json
{
  "platform": "Windows",
  "version": "version-abc123def456",
  "bootstrapper_version": "2.0.0.6812345",
  "future": null,
  "source": "https://clientsettingscdn.roblox.com/v2/client-version/WindowsPlayer",
  "fetched_at": "2026-06-10T12:00:00.000Z"
}

Fields

Field	Type	Description
platform	string	Always `"Windows"`
version	string \| null	Current client version hash
bootstrapper_version	string \| null	Bootstrapper build version
future	string \| null	Upcoming version if known and different from current, otherwise `null`
source	string	Upstream data source URL
fetched_at	string	ISO 8601 timestamp of when data was fetched

Roblox Versions

macOS Version

Returns the current Roblox client version for macOS, sourced directly from Roblox's client settings CDN.

GET /api/macos

No parameters required.

Response

json
{
  "platform": "macOS",
  "version": "version-abc123def456",
  "bootstrapper_version": "2.0.0.6812345",
  "future": null,
  "source": "https://clientsettingscdn.roblox.com/v2/client-version/MacPlayer",
  "fetched_at": "2026-06-10T12:00:00.000Z"
}

Fields

Field	Type	Description
platform	string	Always `"macOS"`
version	string \| null	Current client version hash
bootstrapper_version	string \| null	Bootstrapper build version
future	string \| null	Upcoming version if known and different from current, otherwise `null`
source	string	Upstream data source URL
fetched_at	string	ISO 8601 timestamp of when data was fetched

Exploits

Get Exploit

Returns current status, version, and metadata for a specific exploit by name.

GET /api/exploit/{name}

Path Parameters

Parameter	Type	Description
name	string	Exploit name (case-insensitive). See Exploit List for valid values.

Response

json
{
  "title": "Xeno",
  "version": "1.0.0",
  "rbxversion": "N/A",
  "platform": "Windows",
  "free": true,
  "detected": false,
  "updateStatus": true,
  "clientmods": false,
  "websitelink": "https://x3no.pages.dev/",
  "changelog": "...",
  "fetched_at": "2026-06-10T12:00:00.000Z"
}

Fields

Field	Type	Description
title	string	Display name of the exploit
version	string	Current exploit version, or `"N/A"`
rbxversion	string	Supported Roblox version, or `"N/A"`
platform	string	Target platform
free	boolean	Whether the exploit is free
detected	boolean	`true` if currently detected by Roblox
updateStatus	boolean	`true` if updated for the current Roblox version
clientmods	boolean	Whether client mods are supported
websitelink	string \| null	Official website URL
changelog	string \| null	Latest changelog text if available
fetched_at	string	ISO 8601 fetch timestamp

If the exploit name is not found, a 404 is returned with an available array listing valid names.

Exploits

Exploit List

All exploit names accepted by /api/exploit/{name}. Names are case-insensitive.

Name	Source	Free
xeno	x3no.pages.dev	free
rbxcli	rbxcli.dev	paid
madium	madium.net	free
cosmic	cosmic.best	paid
volt	WEAO	—
codex	WEAO	—
wave	WEAO	—
velocity	WEAO	—
solara	WEAO	—
potassium	WEAO	—

Reference

Error Codes

All errors return JSON with an error field describing what went wrong.

Status	Meaning
200	Success
404	Unknown route or unknown exploit name. Response includes `available` array for exploit lookups.
502	Upstream fetch failed — the data source did not respond or returned an error.
500	Internal worker error. Response includes a `message` field with details.

Error response shape

json
{
  "error": "Unknown exploit: foo",
  "available": ["xeno", "madium", "cosmic", "..."]
}

Reference

Changelog

A record of changes to the exploit.today API.

v1.0.0 Jun 10, 2026

Initial public release.

GET /api/windows — Windows Roblox version via clientsettingscdn
GET /api/macos — macOS Roblox version via clientsettingscdn
GET /api/exploit/{name} — Exploit status
Future version hints from WEAO (hidden/same suppressed)
CORS enabled on all routes

Combined

All Versions

Returns current and future Roblox version data for all platforms in a single request. Used by the exploit.today site's platform bar.

GET /versions

No parameters required.

Response

json
{
  "Windows": "version-abc123def456",
  "WindowsDate": "6/15/2026, 12:00:00 PM UTC",
  "Mac": "version-abc123def456",
  "MacDate": "6/15/2026, 12:00:00 PM UTC",
  "Android": "2.724.735",
  "AndroidDate": "6/5/2026, 8:52:11 PM UTC",
  "iOS": "2.724.735",
  "iOSDate": "6/5/2026, 10:04:02 AM UTC",
  "WindowsFuture": null,
  "MacFuture": null
}

Future fields are null when no future version is known or when it matches the current version.

Combined

All Exploits

Returns an array of all tracked exploits with their current status. Used by the exploit.today site's exploit cards.

GET /exploits

No parameters required. Returns an array of exploit objects.

Response

json
[
  {
    "_id": "...",
    "title": "Xeno",
    "version": "v.1.3.55",
    "platform": "Windows",
    "extype": "wexecutor",
    "free": true,
    "detected": false,
    "updateStatus": true,
    "index": 0
  },
  // ... more exploits
]

This endpoint combines data from WEAO and individual exploit providers. Some fields (e.g. uncPercentage, discordlink) are only present for certain exploits.

Exploits

RbxCli

Returns current status and version for RbxCli, sourced directly from rbxcli.dev.

GET /api/exploit/rbxcli

No parameters required.

Response

json
{
  "title": "RbxCli",
  "version": "1.9.6-beta",
  "rbxversion": "version-abc123def456",
  "platform": "Windows",
  "free": false,
  "detected": false,
  "updateStatus": true,
  "clientmods": false,
  "websitelink": "https://rbxcli.dev/",
  "discordlink": "https://discord.gg/RZgUP8UZQ3",
  "purchaselink": "https://bloxproducts.com/r/weao#RbxCli",
  "changelog": "...",
  "fetched_at": "2026-06-15T12:00:00.000Z"
}

Changelog lines beginning with you are ' are automatically stripped from the response.

Exploits

Madium

Returns current status and version for Madium, scraped from madium.net/changelog.html.

GET /api/exploit/madium

No parameters required.

Response

json
{
  "title": "Madium",
  "version": "v1.2.0",
  "rbxversion": "N/A",
  "platform": "Windows",
  "free": true,
  "detected": false,
  "updateStatus": true,
  "clientmods": false,
  "uncPercentage": 96,
  "suncPercentage": 100,
  "websitelink": "https://madium.net/",
  "discordlink": "https://discord.gg/QJvwQPf4eX",
  "fetched_at": "2026-06-15T12:00:00.000Z"
}

Exploits

Cosmic

Returns current status and version for Cosmic, sourced from auth.cosmic.best/info.

GET /api/exploit/cosmic

No parameters required.

Response

json
{
  "title": "Cosmic",
  "version": "3.2.1",
  "rbxversion": "version-abc123def456",
  "platform": "Windows",
  "free": false,
  "detected": false,
  "updateStatus": true,
  "clientmods": false,
  "websitelink": "https://cosmic.best/",
  "updatedDate": "2026-06-15",
  "changelog": "Bug fixes\nPerformance improvements",
  "fetched_at": "2026-06-15T12:00:00.000Z"
}