# Institflow Developer Docs

> Institflow is a multi-tenant SaaS API for running schools and training institutes — students, academics, attendance, assessment, billing, notifications, and administration — plus webhooks, an embeddable registration widget, and a Model Context Protocol server for AI agents. This file follows the llms.txt convention (https://llmstxt.org/): a curated set of links for an LLM/agent to fetch as plain text/Markdown instead of crawling rendered HTML.

## Start here

- [Introduction](https://developers.institflow.com/en/guides/introduction): what the API covers, base URL, versioning.
- [Authentication](https://developers.institflow.com/en/guides/authentication): JWT vs. API keys, idempotency, rate limits.
- [Quickstart](https://developers.institflow.com/en/guides/quickstart): create a student, enroll, mark attendance, invoice — four calls.
- [Build with AI agents](https://developers.institflow.com/en/guides/ai-agents): the Institflow Agent Skill (installable in Claude Code/Cursor/others) and the MCP server.

## For an AI agent specifically

- [llms-full.txt](https://developers.institflow.com/llms-full.txt): every page below as text, in one fetch — the whole API reference, the error table, the event catalogue, the MCP tool table and each guide's prose. Start here if you can hold it.
- [institflow-api-skill.zip](https://developers.institflow.com/downloads/institflow-api-skill.zip) · [institflow-api-skill.tar.gz](https://developers.institflow.com/downloads/institflow-api-skill.tar.gz): a self-contained Agent Skill folder (SKILL.md + generated reference + runnable TypeScript/Python examples) — unzip into `~/.claude/skills/institflow-api` or `.claude/skills/institflow-api` and it loads itself when relevant.
- [openapi.json](https://developers.institflow.com/openapi.json): the full machine-readable OpenAPI 3.0 spec (269 operations) this entire reference is generated from. Every operation carries `x-institflow-permission` (the exact permission strings `POST /api/v1/api-keys` accepts) and documents the shared `ErrorEnvelope` on every failure status.
- [MCP & OAuth 2.1](https://developers.institflow.com/en/mcp): connect URL, discovery flow, tool/resource/prompt catalogue for agent clients that speak MCP instead of REST.

## Guides

- [Introduction](https://developers.institflow.com/en/guides/introduction)
- [Authentication](https://developers.institflow.com/en/guides/authentication)
- [Conventions](https://developers.institflow.com/en/guides/conventions)
- [Versioning & deprecation](https://developers.institflow.com/en/guides/versioning)
- [Quickstart](https://developers.institflow.com/en/guides/quickstart)
- [Self-hosting & licensing](https://developers.institflow.com/en/guides/self-hosting)
- [Build with AI agents](https://developers.institflow.com/en/guides/ai-agents)
- [Webhooks](https://developers.institflow.com/en/webhooks)
- [Registration widget](https://developers.institflow.com/en/widget)
- [Recipes](https://developers.institflow.com/en/recipes)
- [MCP & OAuth 2.1](https://developers.institflow.com/en/mcp)

## API reference (269 operations, generated from openapi.json, one page per tag)

Each page has a Markdown twin at `https://developers.institflow.com/md/en/reference/<slug>.md` — same content, no HTML.

- [Academics](https://developers.institflow.com/en/reference/academics) (28 operations, [.md](https://developers.institflow.com/md/en/reference/academics.md)): Course categories, courses, teaching groups, weekly schedules, generated sessions, and enrollments.
- [API Keys & Webhooks](https://developers.institflow.com/en/reference/public-api) (23 operations, [.md](https://developers.institflow.com/md/en/reference/public-api.md)): Manage secret/publishable API keys, webhook endpoints and deliveries, and the public (publishable-key-authenticated) registration endpoint used by the embeddable widget.
- [Assessment](https://developers.institflow.com/en/reference/assessment) (15 operations, [.md](https://developers.institflow.com/md/en/reference/assessment.md)): Exams, recorded results, and progress reports.
- [Attendance](https://developers.institflow.com/en/reference/attendance) (5 operations, [.md](https://developers.institflow.com/md/en/reference/attendance.md)): Per-session attendance rosters and marks.
- [Audit Log](https://developers.institflow.com/en/reference/audit) (1 operations, [.md](https://developers.institflow.com/md/en/reference/audit.md)): Search the tenant's append-only audit log.
- [Authentication](https://developers.institflow.com/en/reference/auth) (11 operations, [.md](https://developers.institflow.com/md/en/reference/auth.md)): Login, refresh, tenant selection, password reset, and email verification for first-party (JWT) callers.
- [Billing](https://developers.institflow.com/en/reference/billing) (22 operations, [.md](https://developers.institflow.com/md/en/reference/billing.md)): Fee schedules, invoices, invoice lines, payments, and statements.
- [Curriculum & Video](https://developers.institflow.com/en/reference/curriculum) (28 operations, [.md](https://developers.institflow.com/md/en/reference/curriculum.md)): Course sections and lessons, lesson video links and their playback tokens, per-student course access grants, and progress tracking.
- [Files](https://developers.institflow.com/en/reference/files) (4 operations, [.md](https://developers.institflow.com/md/en/reference/files.md)): Signed upload/download URLs for object storage.
- [First-run Setup](https://developers.institflow.com/en/reference/setup) (2 operations, [.md](https://developers.institflow.com/md/en/reference/setup.md)): Unauthenticated first-run bootstrap of a self-hosted install: whether this deployment still needs setup, and the one call that creates its institute and owner account. Both answer 404 on the cloud platform and once an institute exists.
- [Health](https://developers.institflow.com/en/reference/health) (2 operations, [.md](https://developers.institflow.com/md/en/reference/health.md)): Liveness/readiness probes.
- [Members & Roles](https://developers.institflow.com/en/reference/iam) (15 operations, [.md](https://developers.institflow.com/md/en/reference/iam.md)): Tenant members, invitations, roles, and the permission registry.
- [Notifications](https://developers.institflow.com/en/reference/notifications) (23 operations, [.md](https://developers.institflow.com/md/en/reference/notifications.md)): Templates, preferences, send/retry, provider credentials, push device registration, and usage.
- [OAuth (MCP)](https://developers.institflow.com/en/reference/oauth) (2 operations, [.md](https://developers.institflow.com/md/en/reference/oauth.md)): The Nest-routed, bearer-authed half of the OAuth 2.1 authorization flow (consent context + decision) — see the MCP & OAuth guide for the full flow including the raw RFC endpoints.
- [People](https://developers.institflow.com/en/reference/people) (34 operations, [.md](https://developers.institflow.com/md/en/reference/people.md)): Students, guardians, staff, and the authenticated caller’s own profile.
- [Platform Admin](https://developers.institflow.com/en/reference/platform) (37 operations, [.md](https://developers.institflow.com/md/en/reference/platform.md)): Cross-tenant platform administration: tenants, plans, licenses, custom domains, subscriptions, platform users, and job queues. Requires a platform-admin account, not a tenant membership.
- [Platform Audit](https://developers.institflow.com/en/reference/platform-audit) (1 operations, [.md](https://developers.institflow.com/md/en/reference/platform-audit.md)): Platform-level audit search (distinct from the per-tenant audit log above).
- [Reports](https://developers.institflow.com/en/reference/reports) (1 operations, [.md](https://developers.institflow.com/md/en/reference/reports.md)): Cross-module reporting endpoints — today the consolidated manager dashboard (roster, attendance rate, outstanding balance, overdue invoices, today’s sessions).
- [Search](https://developers.institflow.com/en/reference/search) (1 operations, [.md](https://developers.institflow.com/md/en/reference/search.md)): One cross-module lookup endpoint backing the app’s global search box — students, guardians, staff, groups, courses and invoice numbers, filtered to the entity types the caller may read.
- [Settings & Branches](https://developers.institflow.com/en/reference/tenancy) (14 operations, [.md](https://developers.institflow.com/md/en/reference/tenancy.md)): Branches, tenant settings, feature flags, license status, and subscription status.

## Generated data tables

- [error-codes.md](https://developers.institflow.com/md/en/error-codes.md): every `error.code`, its HTTP status and meaning.
- [events.md](https://developers.institflow.com/md/en/events.md): every webhook-subscribable domain event and its payload fields.
- [mcp-tools.md](https://developers.institflow.com/md/en/mcp-tools.md): every MCP tool, its permission and whether it is destructive.