# FAQ

> Short answers to the questions integrators ask first.

Canonical: https://grout.app/developer/documentation/guides/faq/

## Access

**Is there a sandbox?** Not yet. Use a test institution or narrow scopes. Sandbox keys (`grt_sandbox_…`) are planned.

**Can a developer see student data in the portal?** No. The developer dashboard shows keys, webhooks and deliveries only. Data access goes through the API with whatever scopes the key holds.

**How do I get more than 600 requests per minute?** Edit the key's rate limit (up to 6 000) in the portal. Bulk endpoints reduce the need.

## People

**Why is a student `pending`?** They have not signed in yet. It flips to `active` on first successful login.

**Can I set a student's password?** There are no passwords. Students receive a one-time code at their personal email. Pre-map it with `personal_email` on `POST /students`.

**Can I change a login email?** No; it is generated and permanent. Suspend the account and provision a new one if needed.

## Exams

**Do I have to use groups?** Yes. Assignment is by group; a one-student group is fine.

**Where are the proctoring videos?** In the submission's `proctoring.recordings` as signed URLs, only for keys with `submissions:write`.

**Can students see hidden tests?** The encrypted zip is downloadable but useless without the key, which is released once per attempt and stamped on the attempt record.

## Webhooks

**How many times can I receive the same event?** At least once. Dedupe on `id`.

**My endpoint was disabled.** 30 consecutive failures or a `410`. Fix the receiver, then re-enable with `PATCH { "status": "active" }` and replay the dead deliveries.

**Do you support IP allow-lists?** Deliveries come from Cloudflare's network; use the signature, not the source IP, to authenticate.

## Support

Email [hello@grout.app](mailto:hello@grout.app) with the `X-Request-Id` of a failing call. Institution admins can also use the in-portal help widget.