Organisation API
Read only progress, assignments, live sessions and workspace courses for approved workspaces. Reflections and self check answers are never included.
Create and revoke tokens under Workspace → Settings → Integrations after db/org-integrations.sql is applied.
Authentication
Send the token shown once at create time:
Authorization: Bearer al_…
Revoked tokens return 401. Tokens are stored as SHA-256 hashes only.
GET /learn/api/org/v1/progress
One row for each active member that assignment reaches. A person or group assignment is not listed for the rest of the workspace. Workspace courses use the same person, group and everyone rules as the workspace report, including module counts. On the Learn host the path is /api/org/v1/progress.
curl -sS -H "Authorization: Bearer al_…" \ https://learn.aurum.org.au/learn/api/org/v1/progress
status is one of complete, unavailable, overdue, progress, new. Labels match My learning and reports: Not started, In progress, Complete, Overdue, Unavailable. Unavailable means an assigned item is missing or archived and that person has not finished it.
GET /learn/api/org/v1/assignments
Assignment list for the workspace, without person progress.
GET /learn/api/org/v1/live-sessions
Live sessions for this organisation, including cancelled ones. On the Learn host the path is /api/org/v1/live-sessions.
GET /learn/api/org/v1/workspace-courses
Workspace courses owned by this organisation only. Never lists another organisation’s courses.
Webhooks
Events: completed, overdue, invited, session_registered, waitlisted. Register https URLs under Integrations. Outbound delivery stays off until ORG_WEBHOOKS=on. Apply db/org-webhook-signing.sql so each new webhook can be signed. The signing secret is shown once. Hooks without a signing secret are not sent. Each delivery has a stable id, is tried at most 3 times, and is not sent again after success. Revoked webhooks stop. Failures are listed under Integrations.
Blocked destinations include localhost, private and link local addresses, cloud metadata hosts, and Aurum hosts.
When delivery is on, Learn POSTs JSON with header X-Aurum-Event and body { "event", "org_id", "at", "data" }.
Privacy
- Aurum manages your learning records.
- Organisations never receive reflections or self check answers.
- Reach profile answers are never available on this API.
