Base URL: /api/v1
- Requests and responses use JSON unless an export endpoint returns CSV or Excel-compatible XML.
- Authenticated requests use
Authorization: Bearer <access-token>. - Refresh tokens are handled by secure cookies and the refresh endpoint.
- Validation failures return
400witherror.code = VALIDATION_ERROR. - Authorization failures return
403. - Idempotent payment retries use
Idempotency-Key.
| Method | Path | Purpose |
|---|---|---|
GET |
/health |
Liveness check. |
GET |
/readiness |
Readiness check including MongoDB. |
POST |
/auth/login |
Sign in. |
POST |
/auth/refresh |
Rotate refresh token and issue access token. |
| Module | Representative paths |
|---|---|
| Setup | /school, /academic-years, /terms, /class-levels, /streams, /subjects |
| People | /students, /students/admissions |
| Attendance | /attendance/bulk, /attendance/summary, /attendance/corrections |
| Finance | /finance/fee-structures, /finance/payments, /finance/receipts, /finance/reports |
| Assessments | /assessment-definitions, /marks, /marks/bulk, /marks/:id/corrections |
| Results | /results, /results/process, /report-cards, /progression |
| Platform | /platform/dashboard, /platform/reports/:type, /platform/health, /platform/backups |
Reporting endpoints support page, limit, sortBy, sortDirection, academicYearId, termId, classLevelId, streamId, subjectId and status where applicable.