Vai al contenuto

Documentazione API

Smrt English Client API

Un’API in sola lettura che trasmette i dati di studenti e classi ai sistemi del vostro istituto. Ogni chiave API (API key) accede solo ai dati del proprio istituto.

Apri l’area di test

Come funziona

Come funziona una richiesta.

Il vostro sistema richiede i dati di uno studente o di una classe con la propria chiave API, e l’API li restituisce in sola lettura.

Il vostro sistemaIl gestionale degli studenti o lo strumento di reportistica.
La vostra chiave APIInviata con ogni richiesta e associata alla vostra scuola.
API di Smrt EnglishEndpoint in sola lettura per studenti e classi.
I vostri datiVoti, presenze ed elenchi delle classi in formato JSON.
keyboard_arrow_up

Smrt English API

security Security & Permissions

Institutional Data Isolation

The API enforces strict institutional-level security:

  • Single Institution Access: Your API key only accesses data for students enrolled at your institution
  • Automatic Filtering: All database queries automatically filter by institution
  • Cross-Institution Protection: Attempts to access other institutions' data return 404 (Not Found)
  • Privacy Guarantee: Complete data separation between institutions

Data Access Rules

  1. Student Lookup: Only students enrolled at your institution can be retrieved
  2. Class Lookup: Only classes from your institution can be retrieved
  3. Email Matching: Email lookups are restricted to your institution's students and teachers
  4. Course Data: Only shows courses/classes where your students are enrolled
  5. Assignment Data: Only completed assignments are included in responses
  6. Assessment Data: Only assessments the student has taken are returned

Best Security Practices

1. Protect Your API Key

  • Never commit API keys to version control or share in public forums
  • Don't expose keys in client-side JavaScript or mobile apps
  • Use environment variables or secure configuration management
  • Store keys securely with appropriate access controls
  • If you believe your key has been compromised, contact Smrt English immediately

2. Use HTTPS

  • Always use HTTPS in production environments
  • Never send API keys over unencrypted connections
  • Verify SSL certificates to prevent man-in-the-middle attacks

3. Rate Limiting

  • Be respectful of API resources
  • Implement caching on your side when appropriate
  • Avoid unnecessary repeated requests for the same data
  • Contact Smrt English if you need high-volume access

4. Error Handling

  • Don't expose API keys in error messages or logs
  • Log errors securely on your server
  • Handle authentication failures gracefully
  • Implement appropriate retry logic with exponential backoff

5. Access Control Within Your Institution

  • Limit which systems and personnel can use the API key
  • Monitor API usage for suspicious activity
  • Implement appropriate logging and auditing on your side
  • Report any security concerns to Smrt English immediately