Aller au contenu

Documentation de l’API

API client Smrt English

Une API en lecture seule qui transmet les dossiers des apprenants et des classes aux systèmes de votre établissement. Chaque clé d’API (API key) n’a accès qu’aux données de son propre établissement.

Ouvrir l’espace de test

Fonctionnement

Le déroulement d’une requête.

Votre système demande un apprenant ou une classe avec sa propre clé d’API, et l’API renvoie les dossiers en lecture seule.

Votre systèmeVotre logiciel de gestion de la scolarité ou votre outil de rapports.
Votre clé d’APIEnvoyée avec chaque requête et rattachée à votre établissement.
API Smrt EnglishDes points de terminaison (endpoints) en lecture seule pour les apprenants et les classes.
Vos dossiersNotes, présences et listes de classe au format JSON.
keyboard_arrow_up

Smrt English API

security Security & Permissions

Institutional Data Isolation

The API enforces strict institutional-level security:

  • Single Institution Access: Your API key only accesses data for students enrolled at your institution
  • Automatic Filtering: All database queries automatically filter by institution
  • Cross-Institution Protection: Attempts to access other institutions' data return 404 (Not Found)
  • Privacy Guarantee: Complete data separation between institutions

Data Access Rules

  1. Student Lookup: Only students enrolled at your institution can be retrieved
  2. Class Lookup: Only classes from your institution can be retrieved
  3. Email Matching: Email lookups are restricted to your institution's students and teachers
  4. Course Data: Only shows courses/classes where your students are enrolled
  5. Assignment Data: Only completed assignments are included in responses
  6. Assessment Data: Only assessments the student has taken are returned

Best Security Practices

1. Protect Your API Key

  • Never commit API keys to version control or share in public forums
  • Don't expose keys in client-side JavaScript or mobile apps
  • Use environment variables or secure configuration management
  • Store keys securely with appropriate access controls
  • If you believe your key has been compromised, contact Smrt English immediately

2. Use HTTPS

  • Always use HTTPS in production environments
  • Never send API keys over unencrypted connections
  • Verify SSL certificates to prevent man-in-the-middle attacks

3. Rate Limiting

  • Be respectful of API resources
  • Implement caching on your side when appropriate
  • Avoid unnecessary repeated requests for the same data
  • Contact Smrt English if you need high-volume access

4. Error Handling

  • Don't expose API keys in error messages or logs
  • Log errors securely on your server
  • Handle authentication failures gracefully
  • Implement appropriate retry logic with exponential backoff

5. Access Control Within Your Institution

  • Limit which systems and personnel can use the API key
  • Monitor API usage for suspicious activity
  • Implement appropriate logging and auditing on your side
  • Report any security concerns to Smrt English immediately