Build on your school's data

A REST API and an MCP server, so your own tools — and AI assistants like Claude — can read and update school records with the same permissions your staff have.

Getting started

  1. Enable the API Access add-on from your school's marketplace.
  2. Create a client under Settings → API access, choosing the scopes it needs.
  3. Run the OAuth flow against your school's own subdomain and call the API with the token.

Everything is per-school. Your subdomain is the base URL, and a token issued for one school is refused on any other.

Endpoint reference

The full, always-current description is served as OpenAPI 3.1 from your school's subdomain: 

GET https://your-school.staging.managemysmartschool.co.in/api/v1/openapi.json

It is generated from the running application, so the scope listed against an operation is the scope that endpoint actually checks.

Authentication

OAuth 2.1. PKCE is required for the authorization code flow; there is no implicit grant and no password grant. 

# Discovery
GET /.well-known/oauth-protected-resource
GET /.well-known/oauth-authorization-server

# Authorization code + PKCE
GET  /oauth/authorize?client_id=…&redirect_uri=…&response_type=code
     &scope=students:read&code_challenge=…&code_challenge_method=S256
POST /oauth/token   grant_type=authorization_code&code=…&code_verifier=…

# Server-to-server
POST /oauth/token   grant_type=client_credentials&client_id=…&client_secret=…

# Calling the API
GET /api/v1/admin/students
Authorization: Bearer <access_token>

Scopes and permissions

Every resource has a :read and a :write scope. A token may do the intersection of its scopes and the permissions of the person who authorised it — granting a scope never grants the underlying permission, so a client can never do more than the staff member behind it.

  • academic_years:read
  • academic_years:write
  • admissions:read
  • admissions:write
  • ai_assistant:read
  • ai_assistant:write
  • api_clients:read
  • api_clients:write
  • attendance:read
  • attendance:write
  • cafeteria:read
  • cafeteria:write
  • calendar_events:read
  • calendar_events:write
  • certificates:read
  • certificates:write
  • class_progress:read
  • class_progress:write
  • class_rooms:read
  • class_rooms:write
  • communication:read
  • communication:write
  • contractor_dashboard:read
  • contractor_dashboard:write
  • contractor_settings:read
  • contractor_settings:write
  • contractor_storage:read
  • contractor_storage:write
  • course_materials:read
  • course_materials:write
  • custom_fields:read
  • custom_fields:write
  • day_schedules:read
  • day_schedules:write
  • divisions:read
  • divisions:write
  • drive:read
  • drive:write
  • exams:read
  • exams:write
  • fee_categories:read
  • fee_categories:write
  • fee_payments:read
  • fee_payments:write
  • fee_structures:read
  • fee_structures:write
  • fees:read
  • fees:write
  • gallery:read
  • gallery:write
  • gate_passes:read
  • gate_passes:write
  • guardians:read
  • guardians:write
  • holidays:read
  • holidays:write
  • homework:read
  • homework:write
  • hostel:read
  • hostel:write
  • hr_leave:read
  • hr_leave:write
  • hr_payroll:read
  • hr_payroll:write
  • identity_cards:read
  • identity_cards:write
  • import_export_jobs:read
  • import_export_jobs:write
  • inventory:read
  • inventory:write
  • invoices:read
  • invoices:write
  • labourers:read
  • labourers:write
  • library:read
  • library:write
  • marketplace:read
  • marketplace:write
  • notices:read
  • notices:write
  • online_classes:read
  • online_classes:write
  • periods:read
  • periods:write
  • progress_reports:read
  • progress_reports:write
  • quizzes:read
  • quizzes:write
  • school_setup:read
  • school_setup:write
  • settings:read
  • settings:write
  • signup_requests:read
  • signup_requests:write
  • staff_attendance:read
  • staff_attendance:write
  • standards:read
  • standards:write
  • storage:read
  • storage:write
  • student_fees:read
  • student_fees:write
  • student_leave_requests:read
  • student_leave_requests:write
  • students:read
  • students:write
  • sub_contractors:read
  • sub_contractors:write
  • subjects:read
  • subjects:write
  • substitutions:read
  • substitutions:write
  • task_templates:read
  • task_templates:write
  • teachers:read
  • teachers:write
  • timetables:read
  • timetables:write
  • transport:read
  • transport:write
  • udise:read
  • udise:write
  • users:read
  • users:write
  • work_orders:read
  • work_orders:write
  • work_shifts:read
  • work_shifts:write
  • work_sites:read
  • work_sites:write
  • work_tasks:read
  • work_tasks:write

MCP server

An MCP endpoint is served at /mcp over Streamable HTTP, using the same OAuth credentials. Point an MCP client at your school's subdomain and it will discover the authorization server, register itself, and ask you to sign in.

The MCP tool surface is being rolled out; the OAuth layer it depends on is live now.

Rate limits

  • 300 API requests per minute per token
  • 60 token requests per minute per IP
  • 10 dynamic client registrations per hour per IP

A throttled request returns 429 with a Retry-After header.