Why Grout?
What you get by integrating with the Institution API instead of managing Grout by hand.
One key, the whole suite#
A single institution-scoped key covers GroutApp, GroutCode and the Guardians portal. There is no per-app credential, no per-user OAuth dance, and no way for a key to reach another institution's data.
Built for the school year#
| Moment | What the API does |
|---|---|
| Admissions | POST /students creates the login email and license in one call. Bulk endpoint for 200 at a time. |
| Timetabling | Groups mirror your sections; exams are assigned to groups. |
| Class time | POST /sso/tokens puts a student inside GroutCode from an LMS button, no OTP. |
| Assessment | Coding exams with encrypted hidden tests, proctoring events, grading and CSV export. |
| Results | exam.graded webhooks push scores to your gradebook within seconds. |
| Renewal | license.expired events and POST /licenses/{id}/extend. |
Privacy by default#
The API never returns a student's personal (guardian-facing) email, license keys, encrypted profile blobs or proctoring recordings unless the key explicitly holds submissions:write. Webhook payloads carry ids and outcomes, not documents.
Reliability you can verify#
- Every response has an
X-Request-Id. - Rate limits are per key and visible in headers.
- Webhooks are signed, retried for up to 12 hours, and replayable from the portal.
- Anything you can fetch by webhook you can also poll from
GET /events.