LTIAAS Connect
The LTIAAS Connect API lets a learning management system consume LTI® 1.3 Advantage tools. LTIAAS acts as the LTI® platform on your behalf: you make plain REST calls, and LTIAAS performs the protocol work of launching, authenticating and servicing third-party tools.
This is the API reference for LTIAAS Connect. If you are building a tool that receives launches from an LMS, you want the LTIAAS Launch API reference instead.
The three surfaces
Connect has three distinct groups of endpoints, and it helps to know which is which before you start:
- Endpoints you call. Launch, ID Token and Tools are ordinary REST endpoints on your LTIAAS subdomain, authenticated with your API key. These are the ones you write code against.
- Endpoints the tool calls. Platform Endpoints are the LTI® protocol endpoints that LTIAAS exposes to the registered tool. You never call them — you hand their URLs to the tool vendor during registration. They are documented here so you can see exactly what the tool will do.
- Requests LTIAAS makes to you. Service Requests are callbacks. When a tool asks for a roster or writes a grade, LTIAAS forwards that request to the single Service URL you configure in the portal. Your server answers them.
Getting started
Start with Introduction to LTIAAS Connect for the concepts, then Your first launch for a worked end-to-end example.
Authenticating
Every endpoint you call takes your account API key as a bearer token:
Authorization: Bearer <API_KEY>
See Authenticating API requests for details, and for how to verify the JWT that LTIAAS sends you.
These endpoints must only be called from your back-end. Requests include your API key, so calling them from a browser would leak your credentials.
Authentication
An http Header whose value is of the format: Bearer <API_KEY>. Where <API_KEY> should be replaced with your static API Key, available in the LTIAAS Portal. Learn more in the Authenticating API requests guide.
| Security Scheme Type: | apiKey |
|---|---|
| Header parameter name: | Authorization |
An http Header whose value is of the format: Bearer <ACCESS_TOKEN>, where <ACCESS_TOKEN> was issued by the access token endpoint. This is presented by the registered tool, not by you.
| Security Scheme Type: | apiKey |
|---|---|
| Header parameter name: | Authorization |
