A REST API for learning content — with the infra around it.
Packages, dispatch, sessions, quotas, and xAPI — all behind clean REST endpoints with scoped keys. Add signed webhooks with retries and a dead-letter UI, an OpenAPI explorer, a SCORM validator, and an MCP server + GPT Actions schema, and you integrate in a sprint instead of a quarter.
$ curl -X POST https://api.allureconnect.com/v1/dispatches \ -H "Authorization: Bearer ac_live_…" \ -d '{ "package_id": "pkg_01HX", "seat_cap": 500 }' HTTP 201 · 142ms { "id": "dsp_4KXQ", "status": "live", "shell_url": "…/dsp_4KXQ/scorm.zip" } # webhook fires → dispatch.launched signed · retried · dead-letter on fail
Build a product on top of Connect.
The Developer API is for EdTech platforms, internal tools teams, and integrators who want learning infrastructure as a dependency — not another LMS to operate. Everything the dashboard does, you can do programmatically: upload and process packages, create dispatches, open sessions, read xAPI, and check quotas.
The platform around the endpoint.
Versioned REST API
Packages, upload, process, launch, sessions, dispatch, quota, and xAPI endpoints — consistent, paginated, and documented.
API keys & scopes
Public, internal-integration, and admin-automation scopes, each key active / revoked / expired — least privilege by default.
Signed webhooks
HMAC-signed events with automatic retries, a delivery history, and a dead-letter state you can inspect and replay.
OpenAPI explorer
A live OpenAPI/Swagger UI plus a downloadable spec — generate a client in your language in minutes.
SCORM validator & emulator
Validate a package and dry-run it in a runtime emulator before you ship — catch manifest and tracking issues early.
MCP server & GPT Actions
A Model Context Protocol server and GPT Actions schema, so agents can dispatch, query xAPI, and read quotas natively.
Trustworthy by construction.
Bearer-auth requests against versioned endpoints, idempotent writes, and webhooks signed with a per-endpoint secret. Delivery is retried with backoff and parked in a dead-letter queue you can inspect — so a downstream outage never loses an event. A health endpoint and request logs round out the operability story.
- Bearer API keys with public / internal / admin scopes
- HMAC-signed webhooks, retries, dead-letter replay
- Idempotent writes + request logs for every call
- Health endpoint & API contract summaries
POST your-endpoint X-Allure-Signature: sha256=… { "event": "session.completed", "dispatch": "dsp_4KXQ", "actor": "mailto:lee@acme.com", "score": 0.88, "completed_at": "2026-06-06T…" }Open the API docs →
Build with the rest of the platform.
Integrate in a sprint, trust it in production.
Sandbox-first: get a key, hit real endpoints, and wire up your first signed webhook today.