Rone Arena API

Overview

The game publishes a great deal of data — hero win rates by rank and lane, counters and synergies, equipment and emblem tables, patch history, player profiles — but publishes it for its own clients, not for anyone building on top of it. Rone Arena API sits in between: it reads those public sources and re-serves them as a stable, documented HTTP contract.

Four groups divide the surface. Heroes covers analytics and relationships; academy covers reference data, builds and ratings; user covers authentication and player history; addon covers small utilities such as the win-rate calculator. The same data is available in seventeen languages through a single query parameter.

It is a community project. Mobile Legends: Bang Bang and its assets are trademarks of Shanghai Moonton Technology, and the API states that in its own description rather than in the small print.

One contract, whatever the caller

Every response uses the same envelope, hero endpoints accept either a numeric id or a name in the same path position, and errors are normalised into one payload shape by a handful of exception handlers rather than formatted per route.

The OpenAPI document gets two post-processing passes before it is served. Enum parameters carrying a default are inlined, because the framework otherwise emits a bare schema reference and the rendered documentation shows an opaque name where the caller needs the list of accepted values. Response examples are then reordered to match the property order of the schema they illustrate, so an example reads in the same sequence as the field table beside it.

Nothing is deleted outright. Thirteen operations are currently marked deprecated in the schema: they still answer, they receive no further work, and callers get a machine-readable signal to move rather than a broken integration.

Behaving under load

The service distinguishes two reasons it might be restricted, because they call for different client behaviour. Maintenance means the work is here and there is nowhere else to go. High traffic means this host is shedding load and a failover host exists, named in the response body so retry logic can read it instead of hardcoding a guess. One middleware enforces whichever state is active, while leaving the home page and the blog reachable so a caller can find out what is happening.

Hero identifier ranges are resolved by asking upstream for the highest valid id, which is a wasteful call to repeat, so the answer is cached in process for an hour per source and language. The caller’s own address is extracted once per request and forwarded upstream, so rate limiting applies to the person making the request rather than to the deployment.

Extracting that address is more finicky than it looks. The resolver reads x-forwarded-for, then the RFC 7239 Forwarded header, then x-real-ip, then the socket, stripping quoting, brackets and ports along the way, and it can be asked to skip anything not publicly routable — forwarding a private-range address upstream is worse than forwarding none.

Publishing the source without publishing the sources

The repository is public. The upstream paths it reads are not especially secret, but there is no reason to hand out a ready-made list of them either, and hardcoding them would do exactly that.

They are stored as Fernet ciphertext and decrypted at runtime with the deployment secret. Cloning the repository gets you the whole application; running it against real data needs a key. It is a deliberately modest measure — anyone determined can watch the traffic — but it keeps the source honest about what it is: an interface to public data, not a directory of endpoints to hammer.

Why it was renamed

The project spent most of its life called the MLBB Public Data API, on a matching hostname and package name. That put someone else’s trademark in the position that identifies who made the software, which is precisely the use trademark law restricts, and was never something this project was entitled to.

The rename to Rone Arena moved four public names — the API host, the Python package, and two companion sites — while changing no endpoint path, parameter, or response shape. What the data covers has not changed: it is still an API for Mobile Legends: Bang Bang data, and still says so. What moved is whose name is on it.