API Keys & Webhooks

Owners and Admins: go to Settings → API and, under API Keys, click Create API Key. Organization keys start oc_live_. Give it a name you will recognize later (e.g., 'HR Integration'), choose its scopes, and optionally an expiry (30, 90 or 180 days, or 1 year). The secret is shown exactly once, so copy it straight into a password manager or secrets vault; if you lose it, revoke the key and create another.

A key carries only the scopes you give it, whoever created it: Read Courses (read:courses), Write Courses (write:courses), Read Analytics (read:analytics), Read Users (read:users) and Write Completions (write:completions). Grant the fewest a job needs. Revoke a key at any time from the same page; it stops working immediately.

Send the key in the X-API-Key header, against your Scormbusters address: curl -H "X-API-Key: <your-key>" https://<your-scormbusters-address>/api/analytics/events. The REST API covers creating courses, enrollments, analytics events and webhooks; the full reference, with request and response shapes, is at /docs/api.

To read and build course content programmatically, use the MCP server: it is the authoring API, for AI agents and scripts alike. Setup is at /docs/mcp.

Webhooks send an HTTP POST to your server when something happens, so you do not have to poll. In Settings → API, click Add Webhook, enter your endpoint URL and choose its events:

• course.published and course.unpublished
• enrollment.created: a learner enrolls themselves from the course catalog (enrollments made by an admin in the editor or through the REST API do not send it)
• enrollment.completed, lesson.completed, quiz.submitted and certificate.issued
• user.joined, user.removed and invite.accepted

Payloads for each event are in the webhooks reference.

Each request carries the event name in the X-OpenCourse-Event header, with a JSON body. Recent deliveries are listed under each webhook.

Every request has an X-OpenCourse-Signature header of the form sha256=<hex>: an HMAC-SHA256 of the raw request body, keyed with the webhook's signing secret (shown when you create it). Compute the same HMAC over the raw body you received, compare it to the header with a constant-time comparison, and reject the request with a 401 if they differ.