API tokens and webhooks

Manage issued API tokens

Administrators can view and manage all API tokens created within their school. Previously, an API token was only visible to the employee who created it. The Issued tokens overview now provides administrators with a central location to manage these tokens.

To view the issued API tokens, follow the steps below.

1. Click on your School name. 
2. Click settings Settings in the menu at the top.
3. Click API in the menu on the left.
4. Under API tokens, click Issued tokens. The number displayed indicates how many API tokens have been issued within your school.

The overview displays the following information for each token:

• Name – The name of the API token.
• Created by – The employee who created the token.
• IP restriction – The IP restriction configured for the token.
• Created at – When the token was created.
• Last used – When the token was last used.
• Status – The current status of the token.

You can use the filter to search for tokens by their name or by the name of the employee who created them. You can also filter the overview to display only Active or Inactive tokens.

To revoke an API token, follow the steps below.

1. Navigate to Issued tokens.
2. Find the API token you want to revoke.
3. Click the more_horiz -icon next to the token.
4. Click Revoke.

error_outline Revoking an API token immediately prevents it from being used. This action cannot be undone.

Configure API token creation

Schools with the Campus plan can control whether employees are allowed to create API tokens without approval. This setting determines whether a newly created token becomes active immediately or requires approval from an administrator.

To configure API token creation, follow the steps below.

1. Click on your School name. 
2. Click settings Settings in the menu at the top.
3. Click API in the menu on the left.
4. Next to API token creation, choose one of the following options:
   • Every employee
     Employees can create API tokens that become active immediately.
   • Only after approval
     Employees can create API tokens, but an administrator must approve them before they work.

When Only after approval is selected, newly created tokens remain inactive until they have been approved. Employees see the status Awaiting approval on their personal settings page.

Administrators can identify these tokens by the Requires approval status in the school's issued tokens overview. While at least one token is awaiting approval, a Requires approval status filter is also available.

To approve an API token, follow the steps below.

1. Navigate to your school settings.
2. Click API.
3. Click Issued tokens.
4. Find the token with the status Requires approval.
5. Click the more_horiz -icon next to the token.
6. Click Approve.

Once approved, the API token can be used.

For schools without the Campus plan, the API token creation setting displays a link to the pricing page. API tokens created by employees at these schools become active immediately and do not require approval.

Create school-wide webhooks

Administrators can create webhooks that belong to the school rather than to an individual employee. School-wide webhooks receive events from across the entire school, regardless of which employee triggered the event.

Unlike personal webhooks, school-wide webhooks do not depend on the access permissions of an individual employee. This means they continue to function even when an employee loses access to a course or leaves the school.

A school can create up to ten school-wide webhooks. This limit is separate from the personal webhooks created by individual employees.

To create a school-wide webhook, follow the steps below.

1. Click on your School name. 
2. Click settings Settings in the menu at the top.
3. Click API in the menu on the left.
4. Navigate to the school-wide webhooks section.
5. Click + New webhook.
6. Enter the Endpoint URL.
7. Select the Subscriptions for the events you want to receive.
8. Select the API version.
9. Click Create.

Each school-wide webhook has its own signing secret and event log. The signing secret can be used to verify the authenticity of webhook deliveries. The event log allows you to review individual events and redeliver them when necessary.

To redeliver an event, follow the steps below.

1. Navigate to your school settings.
2. Click on API in the menu on the left.
3. Click on the webhook.
4. Click the replay -icon next to the event event. 
5. Click Confirm.