Posting on behalf of my friend who is a software developer: Alright, I recognize roll20 is sandboxed, and I can see the concern that if AJAX were available, it could use roll20 as some kind of AJAX spam box. However, there are some ways to prevent this scenario, such as requiring a "Yes, I accept roll20 AJAX call" web resource implemented at the target. (Actionscript VM uses a similar concept). I'm obviously not aware of all your technical or business concerns, but as a User/Developer, I would really like to use roll20 as the View and partly a Controller in my Model/View/Controller. A scenario I would be interested in: Character Database Proxy Configure a rest API in a campaign for saving, loading, and modifying characters. In order to maintain the sandbox, the API could expose a method to send messages to configured hosts. Configured hosts would have an attribute that defined a path to a resource/file which validated it as an authorized target for roll20. On boot-up of a campaign or on the registering of a host, the API could handle the AJAX call in the background to validate the host using the described mechanism. Once the host is validated, its available through a global collection to be retrieved and could then be used to send Requests with event handlers to handle Responses. This can be accomplished without exposing the actual AJAX api. With this mechanism, its impossible for the sandbox to send messages to unapproved hosts which I think would address most security concerns. Having the ability to issue requests and receive responses opens up a lot of use cases: 1. Large Shared Object Databases NPCs, Items, etc. 2. Localized Weather It might sound silly, but National Weather Service is available through online web services. Its not huge development effort to build a simple server which retrieves NWS data and makes it available to Rest APIs in JSON format. So if I wanted my Zombie Campaign to model real life, I could take triggers off NWS and adjust things like visibility in my roll20 Campaign. 3. External Engines Economies, Calendars, etc. Its not really possible to list all the possibilities here. As previously stated, I'm not aware of all the inner workings and concerns of roll20, but when I saw 'No AJAX' my hopes sunk quite a bit.
