> ## Documentation Index > Fetch the complete documentation index at: https://faq.exode.biz/llms.txt > Use this file to discover all available pages before exploring further. # API > The school API for integrations: how to issue an API key, set up its permissions, authenticate and which limits apply. The full method reference is at docs.exode.biz. The school API lets external systems work with school data without staff involvement: create and find users, enroll them in courses, read progress, accesses and invoices, sync employees, start exports. The API follows REST principles and works over HTTPS. This article is an overview: how to get a key and which rules apply. The description of all methods, parameters and responses is in the developer documentation: [docs.exode.biz](https://docs.exode.biz). ## API keys API requests are made on behalf of a service user — an API key. Each key has its own token and its own set of permissions. Keys are in **Control panel → My school → For developers → API keys** (in a corporate school — **Control panel → Company → For developers → API keys**). * Only the school owner can view, issue and reissue keys. * A school can have no more than 5 keys. The key list shows, for each key, the service user's address, the start and end of the token, the number of permissions, the **Active** or **Inactive** state and the issue date. ### How to issue a key **1. Click “Create an API key”** The platform creates a service user and issues a token for it. **2. Save the token** In the **API key** window, copy the token and keep it in a safe place. The full token is shown only once. After that, the list shows only its start and end. **3. Copy the identifiers** Below the key list, in the **Integration data** block, click the **Identifiers** card. Both identifiers needed in every request are copied to the clipboard: Seller-Id and School-Id. **4. Check the permissions** In the key menu, choose **Edit**, select the permissions you need and click **Save**. ### Key permissions A new key immediately gets the permissions that API methods need: managing users, courses, students, forms and the task database. Commercial schools also get the **School sales** and **School refunds** permissions, corporate schools get the permissions to manage and view staff. Permissions are grouped by section: **School management**, **Course management**, **Form management** and others. Leave the key only the permissions the integration needs. If the key does not have the required permission, the method returns an access error. Which permissions each method needs is described in the [API documentation](https://docs.exode.biz/en/exode-api/permissions). ### Turning off and reissuing * To pause an integration, turn off the key with the switch in the list. Requests with its token stop working until the key is turned on again. * If the token is lost or may have fallen into the wrong hands, choose **Reissue the API key** in the key menu and confirm. The old token stops working immediately, and the new one is shown once. The token has no expiration date: it works until the key is reissued. > [!WARNING] > > The token gives access to school data within the key's permissions. Keep it only on your own server. Do not put the token into the school's custom code, mobile apps or code that runs in the browser. ## How to send requests The method address is built like this: `https://api.exode.biz/saas/v2/` plus the method path from the documentation. Pass three headers in every request: | Header | Value | | - | - | | `Authorization` | `Bearer` and the API key token, separated by a space | | `Seller-Id` | Seller-Id from the **Identifiers** block | | `School-Id` | School-Id from the **Identifiers** block | ```bash theme={null} curl 'https://api.exode.biz/saas/v2/user/find?extId=crm_12345' \ --header 'Authorization: Bearer YOUR_TOKEN' \ --header 'Seller-Id: 123' \ --header 'School-Id: 456' ``` The response comes in JSON. In a successful response, the `success` field is `true`, and the data is in the `payload` field. In an error response, `success` is `false`, and the reason is in the `cause` and `message` fields. For a Node.js server, there is a ready-made client — the `@exode-team/sdk` package. Learn more in the [Exode SDK](https://docs.exode.biz/en/exode-sdk/overview) section. ## What you can do through the API | Section | Capabilities | | - | - | | Users | Create, update, search, list, delete, service states, sign-in token | | Staff | Departments, positions, employees and absences — only for corporate learning, see [API and organization structure sync](https://faq.exode.biz/en/corporate/api.md) | | Groups | List of groups, adding and removing members | | Courses | List, get, create and change a course, course enrollment, student progress, certificates | | Accesses and sales | Product accesses and invoices (invoices — commercial schools only) | | Exports | Starting table exports and getting the ready file | | Forms | Form layouts and additional field values | Webhooks are not set up through the API — only in the control panel. See [Webhooks](https://faq.exode.biz/en/general/developers/webhooks.md). ## Limits | Limit | Value | | - | - | | API keys per school | No more than 5 | | Starting exports | No more than 100 per hour per key | | Page size in lists | Up to 1000 records, 100 by default | | Exceeding the request limit | A response with code 429 and the time when you can retry the request | Limits of individual methods are listed in the [API documentation](https://docs.exode.biz/en/exode-api/setup). ## Frequently asked questions > **I lost the token. How can I see it?** > > You cannot see the token again: the full token is shown only when it is issued. Reissue the key with **Reissue the API key** and update the token in your integration. > **Why can't a staff member create an API key?** > > Only the school owner can work with API keys — even a staff member with all permissions cannot issue or reissue a key. Ask the owner to issue a key and pass the token to the developer through a secure channel. > **Why do I see “API keys limit is 5” when creating a key?** > > The school already has 5 keys. Reissue one of the existing keys instead of creating a new one. If you really need more keys, write to support. > **A request returns an access error. What should I check?** > > Check that the key is turned on, the token is passed in the `Authorization` header after the word `Bearer`, and the `Seller-Id` and `School-Id` headers are taken from the **Identifiers** block of your school. Then check the key permissions: the key must have the permission the method needs. > **How long is the token valid?** > > The token does not expire. It stops working only if the key is reissued or turned off. > **Can I use the token in the browser or in a mobile app?** > > No. Anyone who gets the token can work with school data. Send API requests only from your own server. > **Do Seller-Id and School-Id change after the key is reissued?** > > No. The identifiers belong to the school and do not change when the token is reissued. > **How can I get notified about an event without constantly calling the API?** > > Use webhooks: the platform itself sends a request to your address when an event happens. See [Webhooks](https://faq.exode.biz/en/general/developers/webhooks.md). *** *Updated: 2026-10-15 18:08 UTC* This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.