Skip to content

API Reference

Overview

EduDesk provides a JSON API for integration with third-party systems such as LMS platforms, HR systems, and mobile apps.

All API endpoints require authentication.

Base URL

https://app.edudesk.africa/api/

For demo: 

https://demo.edudesk.africa/api/

Authentication

All requests must include a valid session cookie (obtained by logging in via /api/login.php) or a CSRF token header.

Login: 

POST /api/login.php
Content-Type: application/json

{
  "username": "admin",
  "password": "your_password"
}

Response: 

{
  "ok": true,
  "user": {
    "id": "abc123",
    "username": "admin",
    "role": "admin",
    "school_id": "school_1"
  }
}

Include the returned session cookie in all subsequent requests.

CSRF Protection

All mutating requests (POST, PUT, DELETE) require a CSRF token:

X-CSRF-Token: <token_from_meta_tag>

The token is available in the page source: 

<meta name="csrf-token" content="TOKEN_HERE">

Common Endpoints

Students

Method Endpoint Description
GET /api/students.php?action=list List all students
GET /api/students.php?action=get&id=X Get one student
POST /api/students.php action=add Add student
POST /api/students.php action=update Update student
POST /api/students.php action=delete Delete student

Attendance

Method Endpoint Description
GET /api/attendance.php?action=list List attendance records
POST /api/attendance.php action=mark Mark attendance

Fees

Method Endpoint Description
GET /api/fees.php?action=list List fee records
POST /api/fees.php action=record Record a payment

Push Notifications

Method Endpoint Description
POST /api/push.php action=subscribe Subscribe to push
POST /api/push.php action=unsubscribe Unsubscribe
POST /api/push.php action=send Send push (admin only)

Response Format

All endpoints return JSON:

{
  "ok": true,
  "data": { ... }
}

Errors: 

{
  "ok": false,
  "error": "Error message here"
}

Rate Limiting

API requests are rate-limited to 60 requests per minute per IP address. Exceeding this returns HTTP 429.

Webhooks

EduDesk can POST events to your system. Configure the webhook URL in Settings → Integrations → Webhook URL.

Events fired: - student.enrolled - fee.paid - result.published - notice.created - attendance.marked

Webhook payload: 

{
  "event": "fee.paid",
  "school_id": "school_1",
  "data": { ... },
  "timestamp": "2026-06-08T13:00:00Z"
}