WHO IT’S FOR
Build a product on top of Connect.
The Developer API is for EdTech platforms, internal tools teams, and integrators who want learning infrastructure as a dependency — not another LMS to operate. Use the documented public endpoints to upload and process packages, create dispatches, open sessions, read xAPI, and check quotas. Available operations depend on credential scopes and the workspace plan.
- EdTech platforms & SaaS builders
- Internal tools & automation teams
- Systems integrators
What you control
The platform around the endpoint.
Versioned REST API
Packages, upload, process, launch, sessions, dispatch, quota, and xAPI endpoints — consistent, paginated, and documented.
API keys & scopes
Public, internal-integration, and admin-automation scopes, each key active / revoked / expired — least privilege by default.
Signed webhooks
HMAC-signed events with automatic retries, a delivery history, and a dead-letter state you can inspect and replay.
OpenAPI explorer
An interactive OpenAPI 3.1 reference plus a downloadable spec for generating a client in your language.
SCORM validator & emulator
Validate a package and dry-run it in a runtime emulator before you ship — catch manifest and tracking issues early.
GPT Actions & agent APIs
A hosted GPT Actions schema so agents can dispatch, query xAPI, and read quotas natively. A Model Context Protocol server is coming soon; the @allureconnect/mcp package is not yet published to npm.
FOR THE TECHNICAL BUYER
Trustworthy by construction.
Bearer-auth requests against versioned endpoints, idempotent writes, and webhooks signed with a per-endpoint secret. Delivery is retried with backoff and parked in a dead-letter queue you can inspect — so a downstream outage never loses an event. A health endpoint and request logs round out the operability story.
- Bearer API keys with public / internal / admin scopes
- HMAC-signed webhooks, retries, dead-letter replay
- Idempotent writes + request logs for every call
- Health endpoint & API contract summaries
POST your-endpoint
X-Connect-Signature: sha256=…
{ "event": "session.completed",
"dispatch": "dsp_4KXQ",
"actor": "mailto:lee@acme.com",
"score": 0.88,
"completed_at": "2026-06-06T…" }- Documented endpoints
- 40+
- Documented endpoints
- Auth scopes · least privilege
- 3
- Auth scopes · least privilege
- Webhooks + dead-letter
- Auto-retry
- Webhooks + dead-letter
- Spec + interactive explorer
- OpenAPI
- Spec + interactive explorer
Status, limits and plans
- Status
- Available
- Plans
- REST API and GPT Actions on every plan. The Free sandbox has Delivery API access with test keys; production keys start on Starter. See plans
- Limits
- OpenAPI 3.1 spec at /api/docs: more than 40 documented endpoints
- API keys:
ac_test_(sandbox) andac_live_(production), with three scopes - Documented rate limits per key
- Docs
- REST API overview
Questions about Developer API · webhooks · GPT Actions
Is there a SCORM hosting API?
How do I authenticate?
ac_test_ keys for the sandbox and ac_live_ keys for production. Each key has one of three scopes: public_api, internal_product or admin.How are webhooks signed?
X-Connect-Signature header of the form sha256=<hex>: an HMAC-SHA256 of the raw body with your endpoint secret. Verify it with a timing-safe comparison. Failed deliveries are retried and can be replayed.Can I use it from a custom GPT?
https://app.allureconnect.com/api/v1/openapi-actions into your GPT and authenticate with an API key.Is there an MCP server?
@allureconnect/mcp package is not published to npm. Use the REST API or GPT Actions today.PAIRS WITH
Works with
- Available
Customer API
Mint and manage isolated child workspaces from a parent key.
- Available
xAPI 2.0 LRS
Read and write statements against the integrated LRS with a published ADL conformance test result.
- Available
Rustici Engine comparison
Compare a hosted learning backend with embedded and managed engine operating models.