跳至主要內容

API文件

Smrt English客戶API

這是一個唯讀API，將學生與班級紀錄回傳至您機構的系統。每個API金鑰（API key）只能存取其所屬機構的資料。

開啟測試中心

運作方式

請求的處理流程

您的系統以自己的API金鑰請求某位學生或某個班級的資料，API以唯讀方式回傳相應紀錄。

您的系統您的學生資訊管理系統或報表工具。
您的API金鑰隨每個請求一同傳送，並與您的學校綁定。
Smrt English API提供學生與班級資料的唯讀端點。
您的紀錄以JSON格式回傳的成績、出缺勤與班級學生名單。
keyboard_arrow_up

Smrt English API

security Security & Permissions

Institutional Data Isolation

The API enforces strict institutional-level security:

  • Single Institution Access: Your API key only accesses data for students enrolled at your institution
  • Automatic Filtering: All database queries automatically filter by institution
  • Cross-Institution Protection: Attempts to access other institutions' data return 404 (Not Found)
  • Privacy Guarantee: Complete data separation between institutions

Data Access Rules

  1. Student Lookup: Only students enrolled at your institution can be retrieved
  2. Class Lookup: Only classes from your institution can be retrieved
  3. Email Matching: Email lookups are restricted to your institution's students and teachers
  4. Course Data: Only shows courses/classes where your students are enrolled
  5. Assignment Data: Only completed assignments are included in responses
  6. Assessment Data: Only assessments the student has taken are returned

Best Security Practices

1. Protect Your API Key

  • Never commit API keys to version control or share in public forums
  • Don't expose keys in client-side JavaScript or mobile apps
  • Use environment variables or secure configuration management
  • Store keys securely with appropriate access controls
  • If you believe your key has been compromised, contact Smrt English immediately

2. Use HTTPS

  • Always use HTTPS in production environments
  • Never send API keys over unencrypted connections
  • Verify SSL certificates to prevent man-in-the-middle attacks

3. Rate Limiting

  • Be respectful of API resources
  • Implement caching on your side when appropriate
  • Avoid unnecessary repeated requests for the same data
  • Contact Smrt English if you need high-volume access

4. Error Handling

  • Don't expose API keys in error messages or logs
  • Log errors securely on your server
  • Handle authentication failures gracefully
  • Implement appropriate retry logic with exponential backoff

5. Access Control Within Your Institution

  • Limit which systems and personnel can use the API key
  • Monitor API usage for suspicious activity
  • Implement appropriate logging and auditing on your side
  • Report any security concerns to Smrt English immediately