School API

Overview

The School API lets your system (CRM, payment service, your own website) enroll students into your school's courses on Courstore and check their access. You collect payments yourself; the API only opens access to the course.

• Base URL: https://api.courstore.com/v1/school-api
• Format: JSON. Request bodies use Content-Type: application/json and are limited to 4 KB.
• Authentication: the school key in the X-School-Key header.
• Availability: Pro (annual), Lifetime and Enterprise plans. On other plans the API responds with 403 tariff_not_allowed; the plan is checked on every request.
• Errors are always JSON: {"error": "code", "message": "text"}.

Full machine-readable specification: Swagger.

Quick start

1. Check your plan. The API is available on Pro (annual), Lifetime and Enterprise.
2. Get a key. In your school dashboard open “Integrations” → “School API” → “Generate key”. A key like cs_live_… is shown only once, so store it somewhere safe right away. You can have up to 3 active keys and revoke any of them.
3. Send your first request. List the school's courses; the response contains course id values you need for enrollment.

export KEY="cs_live_..."
export BASE="https://api.courstore.com/v1/school-api"

curl -s "$BASE/courses" \
  -H "X-School-Key: $KEY"

[
  {
    "id": 1234,
    "title": "Основы маркетинга",
    "slug": "osnovy-marketinga",
    "status": "publish",
    "access": {
      "mode": "months",
      "amount": 3
    }
  },
  {
    "id": 1301,
    "title": "Мастер-класс",
    "slug": "master-klass",
    "status": "publish",
    "access": {
      "mode": "unlimited",
      "amount": null
    }
  }
]

Then enroll a student into a course. Details are in “Enroll in a course”:

curl -s -X POST "$BASE/enrollments" \
  -H "X-School-Key: $KEY" \
  -H "Idempotency-Key: order-0042" \
  -H "Content-Type: application/json" \
  -d '{"phone":"+77001234567","courseId":1234,"access":{"mode":"days","amount":30},"notify":true,"orderRef":"CRM-0042"}'

{
  "requestId": "req_882",
  "status": "queued",
  "studentId": 118350,
  "enrollmentId": null,
  "expireDate": null,
  "lastDay": null
}

A 202 response with status: queued means the enrollment was accepted into the queue. Get the result from “Enrollment status” (usually ready within seconds).

Authentication

Every request must include the X-School-Key header with the school key:

curl -s "https://api.courstore.com/v1/school-api/courses" \
  -H "X-School-Key: cs_live_..."

• The key is created in the dashboard: “Integrations” → “School API”. The format is cs_live_…; it is shown once.
• A school can have up to 3 active keys. Any key can be revoked in the same card; integrations using it will stop working.
• Keep the key on your server. Do not put it in mobile apps, browser code or public repositories.
• An expiry date is optional: when issuing a key you may set a "valid until" date (inclusive). After it, the key answers 401 key_expired — issue a new one.
• When the school's plan ends, all its keys are revoked automatically and permanently; after renewing the plan, issue a new key. A revoked key gets 401 bad_key.
• If the key is missing, wrong or revoked, the response is 401:

{
  "error": "bad_key",
  "message": "Неверный ключ API"
}

If the key is valid but the school's plan does not include the API, you get 403 tariff_not_allowed. The “School API” card shows today's key usage and the latest errors.

Endpoints

The examples below use the $BASE and $KEY variables from “Quick start”. Paths are relative to the base URL https://api.courstore.com/v1/school-api.

curl -s "$BASE/courses" \
  -H "X-School-Key: $KEY"

[
  {
    "id": 1234,
    "title": "Основы маркетинга",
    "slug": "osnovy-marketinga",
    "status": "publish",
    "access": {
      "mode": "months",
      "amount": 3
    }
  },
  {
    "id": 1301,
    "title": "Мастер-класс",
    "slug": "master-klass",
    "status": "publish",
    "access": {
      "mode": "unlimited",
      "amount": null
    }
  }
]

curl -s -X POST "$BASE/students" \
  -H "X-School-Key: $KEY" \
  -H "Content-Type: application/json" \
  -d '{"phone":"+7 (700) 123-45-67","name":"Анна","email":"anna@example.com","lang":"ru"}'

{
  "studentId": 118350,
  "created": true
}

{
  "studentId": 118347,
  "created": false
}

curl -s -X POST "$BASE/enrollments" \
  -H "X-School-Key: $KEY" \
  -H "Idempotency-Key: order-0042" \
  -H "Content-Type: application/json" \
  -d '{"phone":"+77001234567","name":"Анна","courseId":1234,"orderRef":"CRM-2026-0042"}'

{
  "requestId": "req_882",
  "status": "queued",
  "studentId": 118350,
  "enrollmentId": null,
  "expireDate": null,
  "lastDay": null
}

{
  "requestId": "req_881",
  "status": "done",
  "studentId": 118347,
  "enrollmentId": 902113,
  "expireDate": "2026-12-01",
  "lastDay": "2026-11-30"
}

curl -s "$BASE/enrollments/req_882" \
  -H "X-School-Key: $KEY"

{
  "requestId": "req_882",
  "status": "done",
  "studentId": 118350,
  "courseId": 1234,
  "expireDate": "2027-01-20",
  "lastDay": "2027-01-19",
  "notified": true,
  "error": null
}

curl -s "$BASE/enrollments?phone=%2B77001234567&courseId=1234" \
  -H "X-School-Key: $KEY"

{
  "active": true,
  "expireDate": "2026-12-01",
  "lastDay": "2026-11-30",
  "progress": 35
}

Student sign-in link

Your service can issue a student a one-time link that opens your school’s dashboard on Courstore without a password. The token in the link is 32 random bytes, only its hash is stored on our side, and the link stops working after first use.

curl -s -X POST "$BASE/students/login-link" \
  -H "X-School-Key: $KEY" \
  -H "Content-Type: application/json" \
  -d '{"phone":"+77001234567","redirect":1234,"ttlSeconds":120}'

{
  "url": "https://myschool.courstore.com/ru/login-via-token?token=csl_...&returnUrl=courses%2Fosnovy-marketinga",
  "expiresAt": "2026-10-16T10:02:00Z"
}

curl -s -X POST "$BASE/students/login-link" \
  -H "X-School-Key: $KEY" \
  -H "Content-Type: application/json" \
  -d '{"phone":"+77001234567","ttlSeconds":86400}'

app.get("/go-to-courstore", requireLogin, async (req, res) => {
  const r = await fetch(`${API}/students/login-link`, {
    method: "POST",
    headers: { "X-School-Key": KEY, "Content-Type": "application/json" },
    body: JSON.stringify({ phone: req.user.phone, redirect: 1234 }),
  });
  if (r.status !== 200) return res.redirect("https://myschool.courstore.com/ru/login");
  const { url } = await r.json();
  res.redirect(url);
});

Webhooks

Webhooks notify your system about enrollments and access changes right away, without polling the API: Courstore sends a POST to your URL.

{
  "id": "evt_8f3a1c0e2b7d4a91",
  "type": "enrollment.created",
  "createdAt": "2026-10-16T10:00:00Z",
  "schoolId": 7,
  "data": {
    "enrollmentId": 501,
    "student": {
      "id": 118347,
      "name": "Анна",
      "phone": "+77001234567",
      "email": null
    },
    "course": {
      "id": 1234,
      "title": "Основы маркетинга"
    },
    "accessUntil": "2026-12-31"
  }
}

{
  "id": "evt_1b9e44d07c2f8e30",
  "type": "access.revoked",
  "createdAt": "2026-10-20T08:15:00Z",
  "schoolId": 7,
  "data": {
    "enrollmentId": 501,
    "student": {
      "id": 118347,
      "name": "Анна",
      "phone": "+77001234567",
      "email": null
    },
    "course": {
      "id": 1234,
      "title": "Основы маркетинга"
    }
  }
}

POST /courstore/webhook HTTP/1.1
Content-Type: application/json
X-Courstore-Event: enrollment.created
X-Courstore-Delivery: evt_8f3a1c0e2b7d4a91
X-Courstore-Signature: t=1792144800,v1=5f0c2b…

const crypto = require("crypto");
const express = require("express");
const app = express();

app.post("/courstore/webhook", express.raw({ type: "application/json" }), (req, res) => {
  const sig = Object.fromEntries(
    String(req.get("X-Courstore-Signature") || "").split(",").map((p) => p.split("="))
  );
  const expected = crypto
    .createHmac("sha256", process.env.COURSTORE_WEBHOOK_SECRET)
    .update(sig.t + "." + req.body.toString("utf8"))
    .digest("hex");
  const fresh = Math.abs(Date.now() / 1000 - Number(sig.t)) < 300;
  const ok = fresh && typeof sig.v1 === "string" && sig.v1.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(sig.v1));
  if (!ok) return res.sendStatus(401);

  const event = JSON.parse(req.body.toString("utf8"));
  // event.id — idempotency key; event.type — enrollment.created | access.extended | ...
  res.sendStatus(200);
});

<?php
$body = file_get_contents('php://input');
parse_str(str_replace(',', '&', $_SERVER['HTTP_X_COURSTORE_SIGNATURE'] ?? ''), $sig);
$expected = hash_hmac('sha256', ($sig['t'] ?? '') . '.' . $body, getenv('COURSTORE_WEBHOOK_SECRET'));

if (abs(time() - (int)($sig['t'] ?? 0)) > 300 || !hash_equals($expected, (string)($sig['v1'] ?? ''))) {
    http_response_code(401);
    exit;
}
$event = json_decode($body, true);
// $event['id'] — idempotency key; $event['type'] — event type
http_response_code(200);

import hashlib, hmac, os, time
from flask import Flask, request

app = Flask(__name__)

@app.post("/courstore/webhook")
def courstore_webhook():
    body = request.get_data()
    header = request.headers.get("X-Courstore-Signature", "")
    sig = dict(p.split("=", 1) for p in header.split(",") if "=" in p)
    expected = hmac.new(os.environ["COURSTORE_WEBHOOK_SECRET"].encode(),
                        sig.get("t", "").encode() + b"." + body, hashlib.sha256).hexdigest()
    t = sig.get("t", "")
    fresh = t.isdigit() and abs(time.time() - int(t)) <= 300
    if not fresh or not hmac.compare_digest(expected, sig.get("v1", "")):
        return "", 401
    event = request.get_json()
    # event["id"] — idempotency key; event["type"] — event type
    return "", 200

Idempotency

POST /enrollments requires the Idempotency-Key header: a unique key for the operation, for example the order number in your CRM (up to 128 characters: letters, digits, . _ : -). It makes retries safe: if a response was lost to a timeout, repeat the request with the same key and the student will not be enrolled twice.

{
  "error": "idempotency_conflict",
  "message": "Этот Idempotency-Key уже использован с другим телом запроса"
}

Do not confuse this with a repeat purchase: if the student is already enrolled in the course and you send a new operation (a different Idempotency-Key), access is extended. See “Access period”.

Access period

The access period is determined as follows:

• If the request contains the access object, the period comes from it: mode = days (amount from 1 to 3650) or months (amount from 1 to 120).
• If access is omitted, the period comes from the course settings. They are visible in the access field of GET /courses: mode = days / months with amount, or unlimited (no expiry, amount = null).

{
  "phone": "+77001234567",
  "courseId": 1234,
  "access": {
    "mode": "months",
    "amount": 3
  }
}

In responses and in the enrollment status: lastDay is the last day of access, expireDate is the access cutoff; null means no expiry or a date that is not known yet.

Repeat purchase. If the student has already been enrolled in this course, access is extended immediately, counting from the later of two dates: today or the current end of access. The response is 200 with status: done (no queue).

Student notifications

Enrollment through the API goes through the same queue as manual enrollment from the dashboard. The student receives the same messages: WhatsApp / WABA / Telegram / email.

• The notify parameter (default true); false turns notifications off for this enrollment.
• On a repeat purchase (renewal) the student gets a Telegram notification, just like with “Extend access” in the dashboard.
• In the enrollment status, notified: true means the notification has been queued for sending. The service does not confirm delivery to WhatsApp/Telegram.

{
  "phone": "+77001234567",
  "courseId": 1234,
  "notify": false
}

Limits

Limits protect the platform and your students from accidental loops in an integration.

When the request limit is exceeded, the response includes a Retry-After header: the number of seconds until you can retry. Today's usage is shown in the “School API” card in the dashboard.

Errors

All errors are returned as JSON with a code and a description:

{
  "error": "validation_error",
  "message": "phone: некорректный номер телефона"
}

Rely on the HTTP status and the error field (machine code); the message text is meant for logs.

For an enrollment with status failed, the error field contains not_confirmed: the enrollment was not confirmed within 15 minutes.

Privacy

The API exposes only your school's data.

• created: true in the POST /students response means the student was not yet in your school, even if their account already exists on the platform in another school. A link is created for your school; other schools' data is not disclosed.
• created: false means the student already studies in your school. The name and email of an existing student are not overwritten.
• Checking access for a student with no link to your school answers the same way as for a non-existent one: active: false.
• GET /courses returns only the courses of the key owner's school; another school's course returns 404 course_not_found.