API and access keys

The platform has its own API: the same thing that the application uses. The usual login is a user session, and an access key is issued for a script, integration, or dashboard that works on its own.

How to get a key

The key is received on the “Developer” page (address /developers): on the computer — the side menu item in the “Applications” section, on the phone — the same item in menu “☰” or “Settings” → “For developers” → “API key and documentation”. The page is visible after logging in. There is also an “API Documentation” link (opens in a new tab). The key is not related to the teacher's or employee's role: the role is requested on the “My Role” page, but the key is not there.

There are two ways. If your role has the right to “Issue an API key to itself without an application” (or “Issue and revoke API keys”), the key is issued immediately, without an application - see “Release the key to yourself”. The rest have an application that is reviewed by a person with the right to “Issue and revoke API keys”.

Release the key to yourself

For those who can do this, a form with a “Release key” button is shown on the page instead of the application. No one is considering it, so everything that is usually decided by the person considering it, you decide for yourself.:

• It is not necessary to whom or for what; how the key is signed in the list. If left blank, the caption will be the beginning of the goal.
• What is allowed to the key — marks from the rights of your role, and only from them; “Select all” and “Uncheck all” marks at once. Mark only what the script needs. Without tags, the key reads only what is available to any user, but with its own request limit.
• Valid until required. By default, after one year, no longer than 730 days. When the deadline expires, the key will stop working — release a new one.
• The goal is mandatory: what will be called and how often. It is saved on the account as the reason for the issue.

What is “allowed by the key” is “valid before” and the button has hints: on the computer — by pointing, on the phone — by long pressing.

After “releasing the key”, the old key, if there was one, immediately stops working, and the new one appears on the card in its entirety. Copy it with the “Copy” button. The issue is recorded in the audit log in the same way as the approved application (“API key is released”), with a note that the key was issued by the owner himself. You can release the key to yourself no more than five times an hour. While the key is valid, instead of the form on the page, the key itself should be “reissued”.

Request for a key

There are two required fields in the application:

• To whom or for what — what will go by the key: “schedule export in the dean”'s office, “department bot”, “dashboard in Grafana”. This line is then visible in the list of issued keys.
• The goal is what exactly will be called and how often. One word is enough, but the application is being considered according to this text: if it does not understand why the key is needed, the application will be rejected with a comment.

The “Request Key” button sends a request. The application is seen by everyone who has the right to “Issue and revoke API keys”. The solution comes as a notification — in the bell, in the push and in the bot, if it is connected. One application is pending at a time.

What does the reviewer decide

The application is approved not with “yes” or “no”, but with the settings:

• What is allowed to the key is a set of rights. The key cannot be bigger than its owner: everything that the applicant role does not have is discarded.
• Valid until the date after which the key stops working. You can leave it empty — then the key is indefinite.
• The name is how the key is signed in the list; by default, this is the To “or for what” string.
• A comment is what the applicant will read.

The reason for the “issue is saved on the account: a key icon appears in the list of users next to the name, and the Why” line appears on the user's page.

How to use the key

The key is shown to its owner in its entirety on the same “developer” page where it was received: “Show the key”, “Copy” it. It starts with vish_; in lists, the key is visible only by the first characters.

The key is passed in the header X-Api-Key:

curl -H "X-Api-Key: vish_..." https://api.<стенд>/api/v1/schedule/lessons

The header is separate from Authorization so that the key and the session cannot be confused. A key request is a request on behalf of the owner, but only within the limits of the granted rights: what is not in the set, the key will be refused, even if the person himself has this right.

A description of all methods is available on the OpenAPI page, with a link to it in the “API Documentation” menu. Where to start, how to log in, how to read schedules and reference books, with examples in JavaScript, Python and Go, are in the “developer” guides section, starting from the Developers: Getting Started page; there is a list of these pages on “the Developers” page.

Reissue and review

The owner can reissue the key himself by clicking “Reissue” on the “developer” page. The old line stops working at the same moment — this is what needs to be done if the key is lit up somewhere. The rights and the term remain the same.

The key can be revoked by anyone who has the right to “Issue and revoke API keys”, on the “Application” page, the “Issued Keys” tab. A review requires a reason: it comes to the owner as a notification and remains marked on his account. The revoked key cannot be restored — a new application is needed (or a new issue, if you can issue the key yourself).

The issue, reissue, and recall are recorded in the audit log.

Log in via VISH

As long as the key is valid, you can register your website or application on the same “developer page to” log in with account VISH: “Log in with VISH — your applications” section. People log in via Telegram or MAX, and the app only gets what they have allowed. How it works for readers, developers, and administrators is on the Login through VISH page.

Verified: 2026-10, PWA fbb681a8, platform 3474bfa8._