Skip to main content
The school API lets external systems work with school data without staff involvement: create and find users, enroll them in courses, read progress, accesses and invoices, sync employees, start exports. The API follows REST principles and works over HTTPS. This article is an overview: how to get a key and which rules apply. The description of all methods, parameters and responses is in the developer documentation: docs.exode.biz.

​
API keys

API requests are made on behalf of a service user — an API key. Each key has its own token and its own set of permissions. Keys are in Control panel → My school → For developers → API keys (in a corporate school — Control panel → Company → For developers → API keys).
  • Only the school owner can view, issue and reissue keys.
  • A school can have no more than 5 keys.
The key list shows, for each key, the service user’s address, the start and end of the token, the number of permissions, the Active or Inactive state and the issue date.

​
How to issue a key

1

Click “Create an API key”

The platform creates a service user and issues a token for it.
2

Save the token

In the API key window, copy the token and keep it in a safe place. The full token is shown only once. After that, the list shows only its start and end.
3

Copy the identifiers

Below the key list, in the Integration data block, click the Identifiers card. Both identifiers needed in every request are copied to the clipboard: Seller-Id and School-Id.
4

Check the permissions

In the key menu, choose Edit, select the permissions you need and click Save.

​
Key permissions

A new key immediately gets the permissions that API methods need: managing users, courses, students, forms and the task database. Commercial schools also get the School sales and School refunds permissions, corporate schools get the permissions to manage and view staff. Permissions are grouped by section: School management, Course management, Form management and others. Leave the key only the permissions the integration needs. If the key does not have the required permission, the method returns an access error. Which permissions each method needs is described in the API documentation.

​
Turning off and reissuing

  • To pause an integration, turn off the key with the switch in the list. Requests with its token stop working until the key is turned on again.
  • If the token is lost or may have fallen into the wrong hands, choose Reissue the API key in the key menu and confirm. The old token stops working immediately, and the new one is shown once.
The token has no expiration date: it works until the key is reissued.
The token gives access to school data within the key’s permissions. Keep it only on your own server. Do not put the token into the school’s custom code, mobile apps or code that runs in the browser.

​
How to send requests

The method address is built like this: https://api.exode.biz/saas/v2/ plus the method path from the documentation. Pass three headers in every request:
The response comes in JSON. In a successful response, the success field is true, and the data is in the payload field. In an error response, success is false, and the reason is in the cause and message fields. For a Node.js server, there is a ready-made client — the @exode-team/sdk package. Learn more in the Exode SDK section.

​
What you can do through the API

Webhooks are not set up through the API — only in the control panel. See Webhooks.

​
Limits

Limits of individual methods are listed in the API documentation.

​
Frequently asked questions

You cannot see the token again: the full token is shown only when it is issued. Reissue the key with Reissue the API key and update the token in your integration.
Only the school owner can work with API keys — even a staff member with all permissions cannot issue or reissue a key. Ask the owner to issue a key and pass the token to the developer through a secure channel.
The school already has 5 keys. Reissue one of the existing keys instead of creating a new one. If you really need more keys, write to support.
Check that the key is turned on, the token is passed in the Authorization header after the word Bearer, and the Seller-Id and School-Id headers are taken from the Identifiers block of your school. Then check the key permissions: the key must have the permission the method needs.
The token does not expire. It stops working only if the key is reissued or turned off.
No. Anyone who gets the token can work with school data. Send API requests only from your own server.
No. The identifiers belong to the school and do not change when the token is reissued.
Use webhooks: the platform itself sends a request to your address when an event happens. See Webhooks.
Updated: 2026-10-15 18:08 UTC