The API supports two authorization methods. Both methods use the same base address and the same operation paths; they differ in the subject of the request and the scope of available data.
| FEATURE | API TOKEN | SIGN IN WITH QAIRU |
|---|---|---|
| Subject of the request | External information system | Student who has given consent |
| Granting of access | The university administration issues a token | The university administration registers the application; the student grants access on the consent screen |
Value of the Authorization header | Token of the form qos_… | Keycloak access token (JWT) |
| Scope of data | Data of the modules specified in the token | Data available to the student, within the granted modules |
| Validity | Set when the token is issued | Access token — 1 hour, session — up to 30 days |
| Revocation of access | University administration | The student in the student portal or the university administration |
3.1. Choosing a method
- An API token is used to integrate information systems: to obtain reference data, the schedule and the course catalog, and to access Alem models on behalf of the organization.
- “Sign in with QAIRU” is used when an external platform works with the data of a specific student: their schedule, assignments, grades and projects.
The authorization method is determined by the value of the Authorization: Bearer header: a value starting with qos_ is treated as an API token, any other value as a Keycloak access token. The x-api-key header accepts an API token only.
Both methods are intended for server applications. The API token, the client secret and student tokens are not placed in code executed in a browser or in a mobile application, nor in publicly accessible repositories.