Connect your other software to Scoliom Scolarité — in read-only mode
Your accounting software, your reporting tool or a dashboard can read the school's students, classes, levels, instalments, payments and absences through a REST API (JSON over HTTPS) — without being able to change anything. The API stays closed until your management creates a key.
Six rules the API follows
Read-only, by design
The API answers GET requests only (and HEAD): it cannot create, change or delete anything in the platform, and any other method is refused. Data is always changed in Scoliom Scolarité itself, by authorised users.
Seven resources
The school, levels, classes, students, instalments, payments and absences (late arrivals included). Lists are paginated, up to 200 items per page, and students can be synchronised incrementally from a given date.
One key per software, decided by the school
The school's management creates a key in Settings › API, named after the software it connects: up to five active keys per school. The key is shown only once: Scoliom keeps only a fingerprint of it. Each key can be revoked at any time without touching the others.
Closed by default, sealed per school
Without a key, the API answers nothing. A key only ever sees its own school. HTTPS only; the key travels in a header (Authorization: Bearer or X-Api-Key), never in the address.
A clear limit, and a log of every call
60 calls per minute per key. Every call is logged (date, resource, number of items, IP address) and kept for 90 days; the management sees each key's last use and number of calls.
Only the data that is needed
Following the minimisation principle of Moroccan law 09-08 and of the GDPR, the API does not return addresses, photos, places of birth, internal notes, the reason for an absence or its supporting document, comments entered on payments, nor the parents' contact details.
In plain terms: version 1 reads, it does not write. Fields may be added to it, but none will be renamed or removed without a new version, announced in advance. The school remains the data controller: it decides which software receives a key.
One call, one header, JSON in return
The API address is shown in Settings › API. A call listing the enrolled students looks like this:
curl -H "Authorization: Bearer sco_…" \
"https://app.scoliom.com/api/v1.php?resource=students&status=inscrit&per_page=100"school— the school the key belongs to, and its current school yearlevels— levels (grades), with the level a student moves up toclasses— the classes of a school year, with their number of enrolled studentsstudents— students: number, national student number (Massar code in Morocco), names in Latin and Arabic script, status, class and levelinstallments— instalments (amounts due): amount, amount paid, balance, due date, statuspayments— payments received: amount, date, method, receipt number, cheque statusabsences— absences and late arrivals, with their justification status
Every resource, field, parameter and error code is described in the developer documentation, also available in French.
The API: what school leaders and their IT providers ask
No. Version 1 is read-only: it answers GET and HEAD requests only and refuses any other method. Data is changed in the platform itself, by authorised users.
The school's management. It creates one key per software in Settings › API, up to five active keys, and can revoke any of them at any time. Without a key, the API stays closed.
Addresses, photos, places of birth, internal notes, the reason for an absence or its supporting document, comments entered on payments, and the parents' contact details. The API follows the minimisation principle of Moroccan law 09-08 and of the GDPR.
Yes: 60 calls per minute per key. Beyond that, the API asks the software to wait a minute before calling again. Lists return up to 200 items per page.
Online, in English (app.scoliom.com/api-en.html) and in French (app.scoliom.com/api.html). It describes every resource, field, parameter and error code.
Tell us what you want to connect
We answer technical questions in writing: a resource, a field, the right way to synchronise.
A written reply · No commitment