A school ERP your other systems can actually talk to
"Do you have an API?" is usually answered with a yes that means a spreadsheet export and an email address. The question behind it is harder: can our accounting package, our assessment platform or our own reporting pull what it needs, on a schedule, without somebody in the office copying columns between files?
SkoolBook publishes a documented integration API, issues keys that are scoped to what each integration is allowed to touch, and signs the webhooks it sends so the receiving system can prove a message came from us and has not been replayed. The documentation is generated from the same list of routes the keys are checked against — so the API that is documented and the API that works are one list, not two that drift.
What you get
Keys are scoped, and the scope is enforced
A key carries specific permissions — read students, write attendance, read fees — and the check is default-deny: an endpoint that is not on the list is refused whatever scopes the key holds. A new route is therefore never silently exposed to keys already issued.
Documentation generated from the running system
The published specification is produced by filtering the live application's own route list through the same permission map the keys are checked against. It cannot describe a version that is not deployed, and it cannot document an endpoint your key cannot reach.
Webhooks you can verify, not just receive
Each delivery is signed with a shared secret and carries a timestamp, and the signature is only valid inside a five-minute window. A captured message cannot be replayed at you later — and every attempt, successful or not, is recorded with its response.
A bulk import with a dry run that provably writes nothing
Validate mode performs the real write inside a transaction it then rolls back, so your file is checked against the actual constraints rather than a second, weaker copy of the rules. You get the row-level error report before anything lands, and a committed import is all-or-nothing.
Every call is on the record
Requests made with an API key are logged with the key, the route and the outcome, so "what did that integration do last Tuesday" is a query rather than a guess. Each key also carries its own rate limit.
How it works
- 1
Create a client and issue a key
Register the system that is connecting and generate a key for it, choosing only the scopes that system genuinely needs.
- 2
Read the published documentation
The specification lists every endpoint a key can reach and names the scope each one requires, so the integrator is never guessing at permissions.
- 3
Subscribe to the events you care about
Point a webhook endpoint at your system, verify the signature on each delivery, and check the delivery log when something looks missing.
- 4
Move existing data in
Run the import in validate mode until the error report is clean, then commit it in one transaction.
Frequently asked
How large is the API?
Fifteen documented endpoints covering students, guardians, staff, attendance, fees, finance demands and receipts, transport routes, branches and the report library — sixteen operations across nine permission scopes. It is a deliberate, curated surface rather than every internal route exposed by default, and the full internal specification is not published.
Which data can we bulk import?
Guardians, attendance and marks today. Students import through the enrolment upload instead, because that path also raises the fee demand for each child and a second importer would mean two different definitions of enrolling a student. Staff, fee structures and transport allocation are not built yet — the API says so explicitly rather than returning an empty list you have to interpret.
Is there a Postman collection or a developer portal?
Not yet. The specification is published in a browsable form and as a standard OpenAPI document your tools can import directly, but there is no separate developer subdomain and no ready-made collection today. We would rather say so than have you discover it mid-integration.
How do we know a webhook really came from SkoolBook?
Each delivery carries a signature computed with a secret only you and we hold, over a payload that includes a timestamp. Recompute it on your side and reject anything that does not match or that falls outside the five-minute validity window.
Which plan includes API access?
API access, webhooks and bulk import are part of the Enterprise tier. Data export is on every plan including the entry-level one, because getting your own data out is not something we think should be an upgrade.