EduMind mobile API

EduMind is a school management system. A company owns its schools and runs on its own database, so two things decide what a call can see: who the token belongs to, and which company the call is aimed at.

Base URL: https://edumind.school. Everything below sits under /api/v1. Machine-readable spec: https://edumind.school/openapi.json.

Before you start

There is no self-registration and no password. Accounts are created by the school. If the email you hold was never provisioned, every sign-in call will refuse it, and that is the intended answer — do not retry it as if it were a transient failure.

Signing in

Every auth call carries a type of parent or teacher, because one email can hold both roles and they see different things.

Email code:

POST /api/v1/auth/email/request   {"email": "...", "type": "parent"}
POST /api/v1/auth/email/verify    {"email": "...", "code": "......", "type": "parent"}

Google or Apple, with a Firebase ID token the client already obtained:

POST /api/v1/auth/social          {"id_token": "...", "provider": "google|apple", "type": "parent"}

Either verify call returns a bearer token. It is opaque — not a JWT, so there is nothing to decode and no JWKS to fetch. Send it as Authorization: Bearer <token>.

Reaching one company

The token works across every company the person belongs to. Which one you are reading is a header:

X-Tenant: <company slug>

Without it, a tenant-scoped route does not resolve. With a slug the person has no membership in, it answers 404 rather than telling you the company exists.

/api/v1/auth/*, /api/v1/devices, and /api/v1/notifications* are central and need no tenant.

Other headers worth sending

• Accept-Language: ar or en — decides the language of messages and content.
• X-App-Version, X-Platform, X-Device-Id — the device registry, and the force-update directive when a client is below the minimum supported version.

What each role may read

• A parent reads only the children linked to them: /api/v1/parent/children and everything under /api/v1/parent/children/{student}/….
• Behavior notes a teacher kept staff only never reach a parent; asking for one answers 404, the same as a note that does not exist.
• A portfolio item shared by several children reaches each child's parents without the other children's names; asking for an item that is not on your child answers 404.
• A teacher reads only the sections, Quran groups and students assigned to them, under /api/v1/teacher/….
• Fees, invoices, scholarships and staff pay are parent and office data. No teacher endpoint returns them. Do not go looking for one.

Failure modes that mean something

• 401 — the token was revoked, by logout, by account deletion, or by the school. Clear it and sign in again; retrying will not help.
• 403 — authenticated, but outside this person's own children or assigned sections.
• 404 on a tenant route — either no such record, or one this person may not see. The two are answered the same on purpose.
• 503 — maintenance. Wait and retry.

Ending a session

POST   /api/v1/auth/logout      revokes the token and the device registration
DELETE /api/v1/auth/account     deletes the account and revokes everything

DELETE /api/v1/auth/account is not reversible. Never call it to clear a failed sign-in.

Every endpoint

Generated from the route table this application dispatches, so it cannot describe a route that is not there. Machine-readable: https://edumind.school/openapi.json.