# Why Grout?

> What you get by integrating with the Institution API instead of managing Grout by hand.

Canonical: https://grout.app/developer/documentation/why-grout/

## One key, the whole suite

A single institution-scoped key covers GroutApp, GroutCode and the Guardians portal. There is no per-app credential, no per-user OAuth dance, and no way for a key to reach another institution's data.

## Built for the school year

| Moment | What the API does |
|---|---|
| Admissions | `POST /students` creates the login email and license in one call. Bulk endpoint for 200 at a time. |
| Timetabling | Groups mirror your sections; exams are assigned to groups. |
| Assessment | Coding exams with encrypted hidden tests, proctoring events, grading and CSV export. |
| Results | `exam.graded` webhooks push scores to your gradebook within seconds. |
| Renewal | `license.expired` events and `POST /licenses/{id}/extend`. |

## Privacy by default

The API never returns a student's personal (guardian-facing) email, license keys, encrypted profile blobs or proctoring recordings unless the key explicitly holds `submissions:write`. Webhook payloads carry ids and outcomes, not documents.

## Reliability you can verify

- Every response has an `X-Request-Id`.
- Rate limits are per key and visible in headers.
- Webhooks are signed, retried for up to 12 hours, and replayable from the portal.
- Anything you can fetch by webhook you can also poll from `GET /events`.

:::tip Next
Head to the [Quick Start](/developer/documentation/quickstart/) — the first call takes under five minutes.
:::