A REST API for learning content — with the infra around it.
Packages, dispatch, sessions, quotas, and xAPI — all behind clean REST endpoints with scoped keys. Add signed webhooks with retries and a dead-letter UI, an OpenAPI explorer, a SCORM validator, and a GPT Actions schema for a focused integration path. The MCP server is not yet available, pending publication of @allureconnect/mcp to npm.
$ curl -X POST https://app.allureconnect.com/api/v1/dispatches \ -H "Authorization: Bearer ac_live_…" \ -d '{ "package_id": "pkg_01HX", "seat_cap": 500 }' HTTP 201 Created { "id": "dsp_4KXQ", "status": "live", "shell_url": "…/dsp_4KXQ/scorm.zip" } # webhook fires → dispatch.launched signed · retried · dead-letter on fail
Build a product on top of Connect.
The Developer API is for EdTech platforms, internal tools teams, and integrators who want learning infrastructure as a dependency — not another LMS to operate. Everything the dashboard does, you can do programmatically: upload and process packages, create dispatches, open sessions, read xAPI, and check quotas.
The platform around the endpoint.
Versioned REST API
Packages, upload, process, launch, sessions, dispatch, quota, and xAPI endpoints — consistent, paginated, and documented.
API keys & scopes
Public, internal-integration, and admin-automation scopes, each key active / revoked / expired — least privilege by default.
Signed webhooks
HMAC-signed events with automatic retries, a delivery history, and a dead-letter state you can inspect and replay.
OpenAPI explorer
A live OpenAPI/Swagger UI plus a downloadable spec for generating a client in your language.
SCORM validator & emulator
Validate a package and dry-run it in a runtime emulator before you ship — catch manifest and tracking issues early.
GPT Actions & agent APIs
A hosted GPT Actions schema so agents can dispatch, query xAPI, and read quotas natively — with a Model Context Protocol server in development.
Trustworthy by construction.
Bearer-auth requests against versioned endpoints, idempotent writes, and webhooks signed with a per-endpoint secret. Delivery is retried with backoff and parked in a dead-letter queue you can inspect — so a downstream outage never loses an event. A health endpoint and request logs round out the operability story.
- Bearer API keys with public / internal / admin scopes
- HMAC-signed webhooks, retries, dead-letter replay
- Idempotent writes + request logs for every call
- Health endpoint & API contract summaries
POST your-endpoint X-Allure-Signature: sha256=… { "event": "session.completed", "dispatch": "dsp_4KXQ", "actor": "mailto:lee@acme.com", "score": 0.88, "completed_at": "2026-06-06T…" }Open the API docs →
Build with the rest of the platform.
Test the API surface, then validate it for production.
Sandbox-first: get a key, exercise the endpoints, and validate a signed webhook against your integration.