lua api

All API calls are made from inside the executor (Roblox client). Use syn.request, http_request, request, or equivalent depending on the executor.

Base URL: https://dev.syntrx.xyz

---

GET /api/challenge

Fetch a one-time challenge token required for every execute request.

Query params:

Param	Type	Required
scriptId	string (ObjectId)	Yes

Response:

{
  "challenge": "abc123...",
  "expiresIn": 120,
  "fp": "..."
}

Challenges expire after 120 seconds. Always fetch a fresh one immediately before your execute call.

Challenges expire after 120 seconds. Fetch a new challenge immediately before calling /api/execute.

---

POST /api/execute

Validate a key and receive the script payload.

Headers:

Content-Type: application/json
X-Syntrix-ScriptId: <scriptId>

Body:

{
  "key":       "SNTX-XXXX-XXXX-XXXX",
  "scriptId":  "64abc123...",
  "hwid":      "roblox-client-id",
  "challenge": "abc123...",
  "executor":  "Synapse X 2.x",
  "placeId":   "123456",
  "jobId":     "uuid"
}

Success response:

{
  "success": true,
  "payload": "-- obfuscated lua code...",
  "hash": 123456,
  "encoded": false,
  "meta": {
    "scriptName": "MyScript",
    "version": "1.0.0",
    "expiresAt": "2024-01-01T00:00:00.000Z",
    "usesRemaining": null
  }
}

Failure response:

{
  "success": false,
  "error": "Invalid license key"
}

If encoded: true, the payload is base64-encoded. Decode before passing to loadstring.

---

POST /api/execute/keyless

Execute without a key. Only works if keyless mode is active for the current day on the provider or service.

Body:

{
  "scriptId":  "64abc123...",
  "hwid":      "roblox-client-id",
  "challenge": "abc123..."
}

Response: Same shape as /api/execute.

Returns { "success": false, "error": "Key required" } if keyless is not active.

---

GET /api/getkey/:scriptId

Returns provider info for the get key page. Used to render the get key UI and check if keyless is active before starting a session.

Response:

{
  "script": { "id": "...", "name": "MyScript" },
  "provider": {
    "id": "...",
    "name": "Free",
    "keylessMode": false,
    "steps": [
      { "order": 0, "integrationName": "My Linkvertise", "integrationType": "linkvertise", "waitTime": 60 }
    ]
  },
  "preChecks": [],
  "stepDelay": 3
}

If provider.keylessMode is true, skip the step flow and call /api/execute/keyless directly.

---

HWID Detection

Syntrix uses the Roblox Analytics client ID as the HWID:

local hwid = game:GetService("RbxAnalyticsService"):GetClientId()

Fallback if that fails:

local Player = game:GetService("Players").LocalPlayer
hwid = tostring(Player.UserId) .. "_" .. tostring(game.PlaceId)

---

Rate Limits

Endpoint	Limit
/api/execute	30 req / 60s per IP
/api/execute (per script)	10 req / 60s per script
/api/challenge	60 req / 60s
/api/getkey/:id/start	30 req / 60s
/api/getkey/:id/step/:n	60 req / 60s
/api/getkey/:id/verify (POST)	30 req / 60s

Exceeding limits returns HTTP 429.