GET /school/settings returns the authenticated school's complete safe settings in a data object.
The representation includes contact details, attendance-sheet presentation, permissions and automation preferences.
Credentials, billing controls, subscription entitlements and managed resources are outside this endpoint.
Authentication and permissions
Send a school-scoped API key or an OAuth access token as Authorization: Bearer YOUR_CREDENTIAL.
These are school-facing endpoints. Partners must use the school-scoped key created for that school; a partner credential alone is not accepted.
The credential determines the school. Never send a school identifier in the path, query, headers or JSON body.
| Credential | GET | PATCH |
|---|---|---|
| School API key | School read permission (ACL_SCHOOL read bit 1) | School update permission (ACL_SCHOOL update bit 2) |
| OAuth | edusign:api.read or edusign:api.write | edusign:api.write and an administrator or owner role that permits writes |
A school key with ACL_SCHOOL = 3 can use both methods. ACL_SCHOOL = 1 can only read; ACL_SCHOOL = 2 can only update.
A read-only OAuth user cannot PATCH, even with the write scope.
The school's existing subscription and API-access requirements also apply.
Reading stored values
Every supported field is returned. Existing unset or historical values can appear as null, an empty string or a legacy code.
The PATCH schema lists what can be written today; a readable value is not automatically a valid PATCH value.
This endpoint uses postalCode. The existing GET /school contract is unchanged.
Read-only settings and naming restrictions
The response includes four settings that PATCH cannot update:
- professorSignatureReminder
- automaticResendSignEmails
- reminderDelay
- sendExplanationEmailProfessor
Edit these reminder settings through the school UI. Including any of them in PATCH returns 400, even when the value is unchanged.
Do not send the whole GET response back as a PATCH body: remove read-only fields and the data envelope.
Schools with a branded app must also change their name through the school UI. An unchanged name is accepted; a changed name rejects the entire PATCH.
Other settings can still be updated for these schools.
Errors
| Status | Meaning and next step |
|---|---|
| 400 | Invalid or unknown field, empty body/nested object, caller-supplied school identifier, read-only field, unsupported header/footer HTML, or restricted name change. Correct the request before retrying. |
| 401 | Missing, invalid or expired authentication, or an inactive school subscription. Check the credential and school eligibility. |
| 403 | Authenticated but missing the required school permission, OAuth scope, write-capable role or school API access. |
| 404 | The authenticated school no longer exists. |
| 429 | Rate limit exceeded. Wait for the Retry-After header (seconds), then retry with backoff. |
| 500 | Unexpected server error. Error details and submitted values are not exposed. |
| 503 | Service temporarily unavailable. Retry later and respect Retry-After when present. |
429 can originate before authentication or inside the API; both JSON shapes are documented below.
Error messages are deliberately generic and do not echo rejected input.
| Time | Status | User Agent | |
|---|---|---|---|
Retrieving recent requests… | |||