Developer FAQ

Short answers to the questions that most often arise from those who write programs for VISH. Checked with stands d1 and production on October 23, 2026.

Access

Do I need a key to read the schedule? No. Schedules, groups, teachers, classrooms, class notes, and calendar feeds are open to everyone. You need a key to act on your own behalf, see Authentication: API and OAuth keys.

Where can I get the key? In the app, on the “Developer” page, see the details on the API and Access keys page.

The key is lit up — what should I do? Immediately “re”-release it on the “developer” page: the old line stops working at the same second, the rights and the deadline remain the same.

Why does the key get 403 FORBIDDEN, even though I have this right? The key is allowed only what was marked at the time of release. Release the key with the required permission — see Access Rights (RBAC).

Can I read students' personal notes or my own? No. Personal notes are open only to the person in the app; neither the key nor the OAuth token receive them.

Requests from the browser

Is it possible to call the API from your site page? The browser on someone else's site allows you to read VISH responses (CORS) only in two cases: the request carries a key (X-Api-Key) or it is the protocol “Login address via VISH” (/oauth/token, /oauth/userinfo, /oauth/revoke, /oauth/introspect, the settings document and the signing keys). Public methods without a key and methods with an OAuth token (/schedule and others) If you can't read them from another site's page, call them from your server. You can't keep the key in the page code: any user will see it.

And from a mobile or desktop application? There is no CORS, but the key in the application is still visible to the one who disassembles it. For applications where people enter, “Login via VISH”: in mobile, the https return address (App Links, Universal Links), in desktop — http://127.0.0.1:<порт>/….

Data

Why is the couple's time 08:30:00.000Z at 8:30? Class time is Moscow time, written in the fields with the suffix Z. Take the hours and minutes as they are. In the calendar feed, the time is already with the time zone.

How do I find out the current week and its parity? GET /app-config → currentWeek.number and currentWeek.parity (1 or 2). There is also a call grid and semester dates — an example below.

How do I find a group? GET /groups?search=шад — for the part of the code. The code (ШАД-111) is also valid for GET /schedule?group=….

Are id on d1 and production the same? No. The group codes, teacher names, and classroom designations match. Keep them if you work with both booths.

Where does the data come from and how recent is it? From schedule RUT (MIIT) to miit.ru ; the institute's edits are immediately visible, field isOverridden marks the classes changed at the institute.

Notifications

Are there any webhooks? Not yet. Subscribe to the calendar feed or poll the change feed — see Notifications and calendars.

I got 429 — what should I do? Wait as long as it says in the message and repeat; if there are repeated refusals, double the pause. The limits are on the Developers: Getting Started page.

“Log in via VISH”

Does he work for production? As of October 23, 2026 — no, only on d1. It will appear with one of the upcoming releases; keep an eye on the API Changes page.

Можно ли запросить часть разрешений? Приложение запрашивает нужные scope, а человек разрешает весь запрос или отказывает целиком.

Why is the sub of one person different in my two apps? This is how it is intended: sub is permanent for a couple of “people — an application”, and different applications cannot match their users.

Other

Is there an SDK? No. The client can be generated from the OpenAPI booth (/documentation/json) using any OpenAPI 3 generator, or you can write queries manually, as in the examples in this section.

How do I report an API error? Through the “Requests” in the application — see Appeals. Name the method, address, and requestId from the response (it's also in header X-Request-Id). About vulnerability — by contact from /.well-known/security.txt.

Example: what is the current week and couple

// The current week and parity, and which pair is on now, from /app-config.
const API = process.env.VISH_API ?? 'https://d1.vish-app.ru/api/v1'

const response = await fetch(`${API}/app-config`)
if (!response.ok) throw new Error(`HTTP ${response.status}`)
const { semester, currentWeek, schedule } = await response.json()
if (![1, 2].includes(currentWeek?.parity) || !schedule?.lessonSlots?.length) throw new Error('unexpected /app-config')

// Wall-clock Moscow time, the same convention as the timetable.
const now = new Date(Date.now() + 3 * 60 * 60 * 1000).toISOString().slice(11, 16)
const pair = schedule.lessonSlots.find((slot) => slot.startTime <= now && now < slot.endTime)

console.log(`${semester.name}: week ${currentWeek.number}, ${currentWeek.parity === 1 ? 'odd' : 'even'}`)
console.log(pair ? `now (${now} MSK): pair ${pair.number}, ${pair.startTime}–${pair.endTime}` : `now (${now} MSK): no pair`)

Verified: 2026-10, PWA aa337c45, platform bff65fce._