update rules

This commit is contained in:
Joe 2026-02-02 14:05:11 -06:00
parent 4c390fdd37
commit d5522b2fef
8549 changed files with 11783 additions and 1888 deletions

View file

@ -0,0 +1,219 @@
---
title: Errors
description: Defines the errors that are returned by Open Cloud APIs
---
The following sections describe the error handling for Open Cloud APIs. Due to implementation differences across endpoints and validation layers, error responses can vary significantly in format.
## Gateway errors
For authentication or routing issues, both Open Cloud v1 and v2 APIs may return errors in this format:
```json title="Example gateway error"
{
"errors": [
{
"code": 0,
"message": "Invalid API Key"
}
]
}
```
## Open Cloud v2
Open Cloud v2 APIs generally follow a consistent error format when the error occurs within the API endpoint itself.
### Standard v2 error format
Open Cloud v2 APIs return errors in this format:
- `code` - A string representing the error type (e.g. `INVALID_ARGUMENT`, `NOT_FOUND`).
- `message` - A human-readable message explaining the error.
- `details` - An optional array containing additional error-specific information.
```json title="Example v2 error"
{
"code": "INVALID_ARGUMENT",
"message": "Invalid User ID in the request."
}
```
```json title="Example v2 error with details"
{
"code": "INVALID_ARGUMENT",
"message": "The provided filter is invalid.",
"details": [
{
...
}
]
}
```
### v2 error codes
The following table describes possible values for `code` in v2 API responses.
<table>
<thead>
<tr>
<th>Code</th>
<th>HTTP Status</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>`INVALID_ARGUMENT`</td>
<td>400</td>
<td>You passed an invalid argument, such as an invalid `universeId`. You might also have missing or invalid headers, such as `Content-Length` and `Content-Type`.</td>
</tr>
<tr>
<td>`PERMISSION_DENIED`</td>
<td>403</td>
<td>Your request doesn't have sufficient permissions or scopes to perform the operation.</td>
</tr>
<tr>
<td>`NOT_FOUND`</td>
<td>404</td>
<td>The system can't find your specified resources, such as a data store entry.</td>
</tr>
<tr>
<td>`ABORTED`</td>
<td>409</td>
<td>The operation was aborted.</td>
</tr>
<tr>
<td>`RESOURCE_EXHAUSTED`</td>
<td>429</td>
<td>You don't have enough quota to perform the operation, typically due to sending too many requests.</td>
</tr>
<tr>
<td>`CANCELLED`</td>
<td>499</td>
<td>The system terminates the request, typically due to a client side timeout.</td>
</tr>
<tr>
<td>`INTERNAL`</td>
<td>500</td>
<td>Internal server error, typically due to a server bug.</td>
</tr>
<tr>
<td>`NOT_IMPLEMENTED`</td>
<td>501</td>
<td>The server doesn't implement the API method.</td>
</tr>
<tr>
<td>`UNAVAILABLE`</td>
<td>503</td>
<td>Service is unavailable, typically returned when the server is down.</td>
</tr>
</tbody>
</table>
## Open Cloud v1
Open Cloud v1 APIs have inconsistent error response formats. The format depends on the specific endpoint, the type of error, and where the error occurs in the request processing pipeline.
Most v1 endpoints return errors in one of these three formats:
```json title="Example v1 error with error field"
{
"error": "INVALID_ARGUMENT",
"message": "Invalid cursor.",
"errorDetails": [
{
"errorDetailType": "DatastoreErrorInfo",
"datastoreErrorCode": "InvalidCursor"
}
]
}
```
```json title="Example v1 error with code field"
{
"code": "INVALID_ARGUMENT",
"message": "Invalid cursor."
}
```
```json title="Example v1 detailed validation error"
{
"errors": {
"assetId": ["The value 'a' is not valid."]
},
"type": "https://tools.ietf.org/html/rfc9110#section-15.5.1",
"title": "One or more validation errors occurred.",
"status": 400,
"extensions": {
"traceId": "00-427917f0fc3b8375ee33e4603a7f0693-f3f6ad560ff1a122-00"
}
}
```
### v1 error codes
The following table describes possible values for `error` or `code` in v1 API responses:
<table>
<thead>
<tr>
<th>HTTP Status Code</th>
<th>Error</th>
<th>Descriptions</th>
</tr>
</thead>
<tbody>
<tr>
<td>400</td>
<td>INVALID_ARGUMENT</td>
<td>You passed an invalid argument, such as an invalid `universeId`. You might also have missing or invalid headers, such as `Content-Length` and `Content-Type`.</td>
</tr>
<tr>
<td>403</td>
<td>INSUFFICIENT_SCOPE</td>
<td>The request requires higher privileges than provided by the access token.</td>
</tr>
<tr>
<td>403</td>
<td>PERMISSION_DENIED</td>
<td>Your request doesn't have sufficient scope to perform the operation.</td>
</tr>
<tr>
<td>404</td>
<td>NOT_FOUND</td>
<td>The system can't find your specified resources, such as a data store.</td>
</tr>
<tr>
<td>409</td>
<td>ABORTED</td>
<td>The operation was aborted due to a conflict, such as publishing a place that is not part of the universe.</td>
</tr>
<tr>
<td>429</td>
<td>RESOURCE_EXHAUSTED</td>
<td>You don't have enough quota to perform the operation, typically due to sending too many requests.</td>
</tr>
<tr>
<td>499</td>
<td>CANCELLED</td>
<td>The system terminates the request, typically due to a client side timeout.</td>
</tr>
<tr>
<td>500</td>
<td>INTERNAL</td>
<td>Internal server error. Typically a server bug.</td>
</tr>
<tr>
<td>501</td>
<td>NOT_IMPLEMENTED</td>
<td>The server doesn't implement the API method.</td>
</tr>
<tr>
<td>503</td>
<td>UNAVAILABLE</td>
<td>Service unavailable. Typically the server is down.</td>
</tr>
</tbody>
</table>

View file

@ -0,0 +1,32 @@
---
title: OpenAPI document
description: Provides a link to a OpenAPI document for the Roblox Cloud APIs that is compliant to the OpenAPI specification.
---
Roblox publishes an [OpenAPI 3.0.4 document](https://spec.openapis.org/oas/v3.0.4) (formerly known as a Swagger file) that contains **all** of the Roblox Cloud APIs. You can find this file, `openapi.json`, in the open source [creator-docs](https://github.com/Roblox/creator-docs/tree/main/content/en-us/reference/cloud) repository.
You can use OpenAPI documents with tools like the [Swagger Editor](https://editor.swagger.io/) and [Postman](https://www.postman.com/) to test calls and help streamline development. Tools like [OpenAPI Generator](https://github.com/OpenAPITools/openapi-generator) can also generate client libraries for your preferred programming languages.
<Alert severity="warning">
This document is still under active development and may contain issues. Report a bug if you notice inaccurate information.
</Alert>
<a href="https://github.com/Roblox/creator-docs/blob/main/content/en-us/reference/cloud/">
<Button variant="contained">Download openapi.json here</Button>
</a><br />
### Vendor extensions
Roblox uses [specification extensions](https://spec.openapis.org/oas/v3.0.4#specification-extensions) to extend the OpenAPI specification. These extensions represent information that the specification doesn't capture by default. Extensions may appear throughout the file where allowed by the OpenAPI specification.
The majority of these specification extensions are experimental. The extensions used are subject to change without notice in favor of fields found within the official OpenAPI specification.
| Extension | Location | Description |
| ----------------------------- | ---------------- | -------------------------------------------------------------------------------------------------------------------------------------- |
| `x-roblox-extensions-version` | OpenAPI object | A version string, using semantic versioning, that represents the versions of the extensions specified here and other common structures |
| `x-roblox-stability` | Operation object | A string that represents an operation's stability level. |
| `x-roblox-deprecated` | Operation object | An object that provides additional information related to an endpoint's deprecation status. |
| `x-roblox-alternatives` | Operation object | An object that provides additional information related to an endpoint's alternatives. |
| `x-roblox-rate-limits` | Operation object | An object that provides rate limiting information for an endpoint. |
| `x-roblox-scopes` | Operation object | An object that provides the list of required, conditional, and optional scopes that are associated with an endpoint. |
| `x-roblox-engine-usability` | Operation object | An object indicating the endpoint's usability with the Roblox engine. |

View file

@ -0,0 +1,234 @@
---
title: Patterns
description: Explains considerations and guidelines for making proper requests to Open Cloud endpoints and interpreting responses.
---
This page covers common patterns with the Open Cloud APIs, particularly around making requests and handling responses.
## Paths
To make a request to the Open Cloud APIs, you must first form a URL. This URL is a combination of the base URL (e.g. `https://apis.roblox.com`), the Open Cloud API path (for example, `/cloud/v2/universes/{universe_id}/places/{place_id}/user-restrictions`), and any query parameters (for example, `?maxPageSize=25`). A full request URL might look like this:
```json
https://apis.roblox.com/cloud/v2/users/4687549151/inventory-items?maxPageSize=100
```
Many paths, including the example above, have **path parameters**, designated by curly brackets in the API reference. Path parameters are just variables that you insert before making the request and are almost always IDs: user IDs, group IDs, place IDs, etc. IDs are often numeric, but not necessarily; for example, data store and memory store IDs support a wider character set.
## Content length and type
Many API calls, particularly those that create or update, require a JSON request body. If your request has a body, be sure to include the `Content-Length` and `Content-Type` headers. Most HTTP clients add these headers automatically.
## Pagination
If you specify `maxPageSize` in your request, some methods return paginated
results—essentially partial responses:
```json
GET /cloud/v2/users/{user_id}/inventory-items?maxPageSize=25
{
"inventoryItems": [
...
],
"nextPageToken": "aaaBBB"
}
```
```json
GET /cloud/v2/universes/{universe_id}/data-stores?maxPageSize=25
{
"dataStores": [
...
],
"nextPageToken": "datastore1"
}
```
If a response includes a value for `nextPageToken`, use that value in the
`pageToken` parameter of the subsequent request to retrieve the next page. When
`nextPageToken` is empty or omitted entirely, you've reached the end of your results:
```json
GET /cloud/v2/users/{user_id}/inventory-items?maxPageSize=25&pageToken=aaaBBB
{
"inventoryItems": [
...
],
"nextPageToken": ""
}
```
```json
GET /cloud/v2/universes/{universe_id}/data-stores?maxPageSize=25&pageToken=datastore1
{
"dataStores": [
...
]
}
```
Aside from the `pageToken`, you must use the same query for pagination to work
properly. Altering any filter parameter results in a 400 error.
## Open Cloud v2
### Multiple paths
Some resources have multiple path patterns, visible under the **Resource Paths** header in the API reference. For example, the URL for [List User Restrictions](/cloud/reference/UserRestriction#Cloud_ListUserRestrictions__Using_Universes) can be either of the following:
- `https://apis.roblox.com/cloud/cloud/v2/universes/{universe_id}/user-restrictions`
- `https://apis.roblox.com/cloud/cloud/v2/universes/{universe_id}/places/{place_id}/user-restrictions`
You can probably infer the difference between the two: some user restrictions apply to an entire universe (experience), whereas others apply to specific places within a universe. Aside from the small addition to the path and extra path parameter, the calls are identical.
Many endpoints return a path as part of their response, which you can use to make further requests. If an API needs more than a few seconds to fulfill a request, it often returns an [operation](#long-running-operations) rather than the resource or response itself.
### Long running operations
Some methods return an `Operation` object that represents a long-running request
that returns an asynchronous response later. The object contains the following
fields:
- **path** - The endpoint path to call to poll for the request's completion.
Append the path to the original base URL of the resource method.
- **done** - A boolean value that represents whether or not the operation has completed.
- **response** - The response object. This field is empty until the `done` field has a value of `true`.
- **metadata** - Custom metadata specific to the request being made.
```json title="Example Operation Object"
{
"path": "v1/assets/12345/operation/xyz",
"done": true,
"response": {
"value1": "myValue",
"value2": 1234
},
"metadata": {
"metadata1": "string",
"metadata2": 5678
}
}
```
Use the `Operation` object's path to poll for when the resource is ready. A good strategy is to use exponential backoff. For example, you might poll immediately, then after one second, two seconds, four seconds, etc.
```python
def PollForResults(operationPath):
currentRetries = 0
maxRetries = 10
retryPollingDelay = 1
retryPollingMultiplier = 2
while (currentRetries < maxRetries):
# No delay on the first check
if (currentRetries == 0):
results = GetOperation(operationPath)
# Retry logic for subsequent checks
else:
time.sleep(retryPollingDelay)
results = GetOperation(operationPath)
# Exponential backoff
retryPollingDelay *= retryPollingMultiplier
# Check for results and return if they exist
if (results.status_code != 200 or results.json()[doneJSONKey]):
return results
# Otherwise, increment the retry count
else:
currentRetries += 1
```
For a more complete code sample that uses a fixed retry interval rather than exponential backoff, see [Poll for results](../guides/instance.md#poll-for-results).
### Filtering
Some methods let you filter the response by including a `filter` parameter in
the request. The following sections describe filter syntax and guidelines for
the specified endpoints.
#### List group memberships
The wildcard character `-` can be used in place of group ID in order to list
memberships across all groups: `groups/-/memberships`.
Filtering conforms to Common Expression Language (CEL). Only two operators
are supported:
- `==`
- `in [...]`
If you specify a group ID in the resource path, you can filter memberships by
either user or role in the following formats:
- **User filter**: `filter=user == 'users/9876543210'`
- **Role filter**: `filter=role == 'groups/123/roles/7920705'`
If you specify the wildcard character for the group ID, you must filter
memberships by user (up to 50) in the following format:
- **User filter**: `filter=user in ['users/1', 'users/156', 'users/9876543210', ...]`
#### List inventory items
You can filter by collectible status, inventory item type, and inventory
item ID. If you don't provide a filter, the user's entire inventory is returned.
The filter format is a semicolon-separated list:
`filter={field}={value};{field}={value},{value},...;{field}=...`
- `{field}` can be any of the predefined type fields or ID fields in the
following tables.
- `{value}` can be a string, boolean, or enum. Depending on the field type,
this can be a single value (boolean fields) or multiple values (list fields).
<Alert severity="info">
You can't combine type and ID fields in the same filter.
</Alert>
**Type fields**
| Filter | Type | Description |
| :------------------------ | :------------------------------------------------------ | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `badges` | boolean | Include badges in the response. Default is false. |
| `gamePasses` | boolean | Include game passes in the response. Default is false. |
| `inventoryItemAssetTypes` | See [assetDetails][1] for the full list of asset types. | Comma-separated list of asset types to include. Default is none. Specify `*` for all asset types. Must have Inventory read scope to filter by purchased places. |
| `onlyCollectibles` | boolean | Include **only** collectibles in the response. Default is false. This field must be used with the `inventoryItemAssetTypes` field in order to return items and only returns non-UGC limited items. |
| `privateServers` | boolean | Include private servers in the response. Default is false. Must have Inventory read scope to filter by this field. |
**ID Fields**
| Filter | Type | Description |
| :----------------- | :----- | :--------------------------------------------------------------------------------------------------------------------- |
| `assetIds` | string | Comma-separated list of numeric asset IDs to include. |
| `badgeIds` | string | Comma-separated list of numeric badge IDs to include. |
| `gamePassIds` | string | Comma-separated list of numeric game pass IDs to include. |
| `privateServerIds` | string | Comma-separated list of numeric private server IDs to include. Must have Inventory read scope to filter by this field. |
**Examples**
- Returns all collectible items that the user owns:
`filter=onlyCollectibles=true;inventoryItemAssetTypes=*`
- Returns all items of the specified types:
`filter=inventoryItemAssetTypes=HAT,CLASSIC_PANTS,TSHIRT_ACCESSORY`
- Returns all items of the listed types or any game passes. Excludes badges from
the results (the same behavior as if `badges` wasn't included in the filter):
`filter=inventoryItemAssetTypes=HAT,CLASSIC_PANTS,TSHIRT_ACCESSORY;gamePasses=true;badges=false`
- Returns assets that match the specified IDs:
`filter=assetIds=1,2,3,4`
- Returns assets, badges, game passes, and private servers that match the
specified IDs:
`filter=assetIds=1,2,3,4;badgeIds=1,2,3,4;gamePassIds=1,2,3,4;privateServerIds=1,2,3,4`
[1]: /cloud/reference/InventoryItem

View file

@ -0,0 +1,63 @@
---
title: Rate limits
description: Explains rate limiting on Open Cloud endpoints.
---
Rate limits control the number of requests you can make to endpoints within a specific time window. These limits help ensure service stability and protect Roblox resources from abuse.
## Discovery
There are two ways to determine rate limits: the reference documentation and response headers.
### Documentation pages
Public rate limits can be found under the **Limits** section for each endpoint on their documentation pages. View these sections to understand the rate limits that apply before making requests.
<Alert severity="info">
We strive to be as transparent as possible about rate limits, but additional, undocumented limits may apply, including for DDoS protection and service stability. Always ensure your application handles HTTP 429 rate limit responses. See [Handling rate limits](#handling-rate-limits) for guidance.
If you hit an undocumented rate limit that blocks your use case (or you would like higher limits for an endpoint), please leave feedback explaining your needs in the [Developer Forum](https://devforum.roblox.com/).
</Alert>
### Response headers
Many API responses include headers that provide information about your current rate limit status.
| Header | Description |
| ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------- |
| `x-ratelimit-limit` | The total number of requests allowed within the rate limit window. This may include multiple limit values for different time windows. |
| `x-ratelimit-remaining` | The number of requests you can still make with your current authentication. When this reaches 0, you receive HTTP 429 responses. |
| `x-ratelimit-reset` | The number of seconds remaining until your rate limit quota resets to the full limit. |
Here's an example of rate limit headers in an API response:
```text
x-ratelimit-limit: 1000, 1000;w=60, 1000;w=60
x-ratelimit-remaining: 998
x-ratelimit-reset: 20
```
In this example:
- You have 998 requests remaining out of your total limit.
- Your quota will reset in 20 seconds.
## Behavior
Rate limit behavior differs by authentication method and request origin, including whether you make requests from within a Roblox experience.
### API key
Rate limits for API keys are applied across all API keys per owner, which can be either a user or a group. These limits are enforced consistently regardless of where the requests originate—whether from `Class.HttpService`, web applications, or other sources.
#### In-experience with HttpService
When calling endpoints in-experience using `Class.HttpService`, requests also contribute to the fixed limit of 500 HTTP requests per minute per Roblox game server. See [In-experience HTTP requests](/cloud-services/http-service) for more details.
### OAuth 2.0
OAuth 2.0 rate limits are applied per access token. Since each access token represents a unique combination of user and application, every user using your app receives their own independent rate limit quota.
## Handling rate limits
Write your code to expect and handle HTTP 429 (Too Many Requests) responses due to documented limits, abuse prevention, or high-load scenarios. When rate limited, check the `retry-after` response header as a guideline for when to retry. If there is no `retry-after` response header present, implement an exponential backoff retry strategy.

View file

@ -0,0 +1,65 @@
---
title: Risk levels
description: Explains the risk level classifications for Open Cloud API endpoints and their behavior in the "try it out" feature.
---
Risk levels classify Open Cloud endpoints based on the potential impact of their operations. These classifications apply to the OAuth 2.0 authorization flow and the "try it out" feature here in the API documentation.
Risk levels help protect your data and account when testing API endpoints in the documentation. Always review an endpoint's functionality and potential impact before testing, particularly for medium and high risk operations that can modify your data.
## Try it out risk levels
The "try it out" feature uses four risk levels, which control the warnings and restrictions that you encounter when testing endpoints directly from the documentation.
<table>
<thead>
<tr>
<th>Risk level</th>
<th>"Try it out" allowed</th>
<th>Warning dialog</th>
<th>Warning banner</th>
<th>Cookie attachment</th>
</tr>
</thead>
<tbody>
<tr>
<td>Low</td>
<td>&#9989;</td>
<td>No</td>
<td>Yes</td>
<td>Yes</td>
</tr>
<tr>
<td>Medium</td>
<td>&#9989;</td>
<td>Yes (per endpoint, per session)</td>
<td>Yes</td>
<td>Yes</td>
</tr>
<tr>
<td>High</td>
<td>&#9989;</td>
<td>Yes (per endpoint, per session)</td>
<td>Yes</td>
<td>Yes (after accepting second warning dialog)</td>
</tr>
<tr>
<td>Critical</td>
<td>&#10060;</td>
<td>N/A</td>
<td>N/A</td>
<td>N/A</td>
</tr>
</tbody>
</table>
- **Low risk** endpoints primarily retrieve publicly available information and have minimal impact on your data or experiences. These endpoints show a simple informational banner when using "try it out."
- **Medium risk** endpoints can create, update, or access private information. Most changes you make from these endpoints can be reversed using other available endpoints. These endpoints have the following "try it out" safety measures:
- They display a confirmation dialog before you send a request. This dialog appears once per endpoint per browser session.
- They show a warning banner to remind you of the risk level.
- **High risk** endpoints can modify or delete private information in ways that may be difficult or impossible to reverse. This category includes most DELETE operations and other potentially destructive actions. In addition to the confirmation dialog and warning banner from medium risk endpoints, a second confirmation dialog is required to send the first request (enforced only per session, not per endpoint).
- **Critical risk** endpoints access or modify highly sensitive data that could compromise account security or privacy. "Try it out" is disabled for these endpoints.

View file

@ -0,0 +1,10 @@
---
title: Scopes
description: List of Roblox Cloud scopes and their corresponding endpoints.
---
This page lists all Open Cloud scopes and the API endpoints that they support. It also lists the target types that are supported for each scope.
import openapi from '../../reference/cloud/openapi.json'
<ScopeTable spec={openapi}/>

View file

@ -0,0 +1,119 @@
---
title: Types
description: Explains the different data types of Open Cloud web APIs.
---
Open Cloud represents request and response payloads as [standard
JSON](https://www.ecma-international.org/publications-and-standards/standards/ecma-404/).
The standards JSON types are text, values, objects, arrays, numbers, and
strings. Some types have special considerations for representing specific kinds
of data, which are described in the following sections.
## Timestamp
Uses RFC 3339, where generated output will always be Z-normalized and uses 0, 3,
6 or 9 fractional digits. Offsets other than "Z" are also accepted.
```json title="Example Timestamp"
{ "timestamp": "1972-01-01T10:00:20.021Z" }
```
## Duration
Generated output always contains 0, 3, 6, or 9 fractional digits, depending on
required precision, followed by the suffix "s". Accepted are any fractional
digits (also none) as long as they fit into nano-seconds precision and the
suffix "s" is required. The range must be from -315,576,000,000 to
315,576,000,000 seconds, inclusive.
```json title="Example Durations"
{
"duration-9": "1.000340012s",
"duration-0": "1s"
}
```
## Bytes
Byte data are encoded as a string using standard base64 encoding with paddings.
Either standard or URL-safe base64 encoding with or without paddings are
supported.
```json title="Example Bytes"
{
"bytes": "YWJjMTIzIT8kKiYoKSctRbLx+"
}
```
## FieldMask
A FieldMask is a string that describes the fields to act on when making a
request. To construct a field mask, you specify comma delimited JSON field names
in a string. For example, given the following:
```json title="Example JSON"
{
"foo": {
"a": "c",
"b": "d"
},
"bar": "x",
"baz": "y"
}
```
If you wanted to specify a field mask to update the values of only `foo.b` and
`bar`, the field mask would look like: `foo.b, bar`
In Open Cloud, update methods that support a field mask have a parameter named
`updateMask`, where you can specify a field mask as a value.
## Money
Generally used to define a price, the `Money` type has a three-letter currency code (as defined in ISO 4217) and a quantity, which uses the `Decimal` type. For example, you might represent a $17.99 price like this:
```json
"myPrice": {
"currencyCode": "USD",
"quantity": {
"significand": 1799,
"exponent": -2
}
}
```
Creator Store products require an `exponent` of -9, so the same price looks like this:
```json
"myPrice": {
"currencyCode": "USD",
"quantity": {
"significand": 17990000000,
"exponent": -9
}
}
```
## Decimal
Represents a decimal number in a form similar to scientific notation, with significant digits and an exponent.
Examples:
- 17
`{"significand": 17, "exponent": 0}` or just `{"significand": 17}`
- -0.005
`{"significand": -5, "exponent": -3}`
- 33.5 million (33,500,000)
`{"significand": 335, "exponent": 5}`
- 11/8 (1.375)
`{"significand": 1375, "exponent": -3}`
When `exponent` is greater than 0, it represents the number of trailing zeroes after the significant digits. When `exponent` is less than 0, it represents how many of the significant digits come after the decimal point. When `exponent` is 0, the value of the `Decimal` is the value of the `significand`.