Using the Connect API
The guides in this section cover the mechanics that apply across every LTIAAS Connect endpoint: how requests are authenticated in both directions, and how failures are reported.
For the endpoints themselves, see the Connect API Reference.
Conventions
Base URL. Every endpoint lives on your account's subdomain:
https://your.ltiaas.com
Two prefixes. Launch and ID Token endpoints sit under /api; tool management sits under /admin. Both use the same API key.
Successful writes return 201. This includes endpoints that feel like reads, such as Create Launch Form — it creates a launch, so it returns 201 Created. Deletes return 204.
Everything is JSON. Requests and responses are application/json, except the two places a browser is involved: the deep linking return endpoint and the DEEP_LINKING_RESPONSE service request, which are form-encoded.
Forms come back as strings. The /form endpoints return { "form": "<html>" } — a JSON envelope containing HTML, not an HTML response. Render the string; it submits itself.
Two Directions of Traffic
A Connect integration has requests going both ways, and they authenticate differently:
| Direction | Authentication |
|---|---|
| You → LTIAAS | Authorization: Bearer <API_KEY> |
| LTIAAS → You | A signed JWT you verify with your consumer public key |
Authenticating API requests covers both.
Section Summary
📄️ Authenticating API Requests
Authenticate your calls to LTIAAS, and verify the requests LTIAAS makes to you.
📄️ Error Handling
The shape of LTIAAS Connect errors and what the common codes mean.
