All paths are relative to https://api.tutorflow.io.
Authentication types
| Auth type | Used by | Header |
|---|---|---|
| Admin session | Key management, webhook management, UI export | Cookie: jwt=... or curl -b tutorflow-admin.cookies |
| Content API key | Expansion create, status, result | Authorization: Bearer tf_content_... |
API key endpoints
Create key
POST /v1/content/organizations/{organizationId}/api-keysRequest:
{
"name": "external-content-test",
"rateLimitPerMinute": 60
}Response 201:
{
"apiKey": "tf_content_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
"keyId": "0b063e58-7e19-4787-90f0-d081c85f50d3",
"keyPrefix": "tf_content_abc123def456",
"name": "external-content-test",
"rateLimitPerMinute": 60
}List keys
GET /v1/content/organizations/{organizationId}/api-keysResponse 200 includes key metadata only. The full secret is not returned.
Rotate key
POST /v1/content/organizations/{organizationId}/api-keys/{keyId}/rotateResponse 200 returns a new one-time apiKey.
Revoke key
POST /v1/content/organizations/{organizationId}/api-keys/{keyId}/revokeResponse 200 has no body.
Expansion endpoints
Create expansion
POST /v1/content/integrations/expansionsHeaders:
Authorization: Bearer tf_content_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Content-Type: application/json
Idempotency-Key: source-content-level-a1-2026-07-04Request fields:
| Field | Type | Required | Notes |
|---|---|---|---|
requestedOutputs | string[] | No | Supported values are interactive_module, summary_video, expanded_quiz. |
payload | object | Yes | Existing source JSON. |
sourceType | string | No | Defaults to source_json. |
idempotencyKey | string | No | Header is preferred. |
Response 200 returns the created job and queued output rows.
Get status
GET /v1/content/integrations/expansions/{jobId}Response 200 returns the job and outputs. Poll until completed or failed.
Get result
GET /v1/content/integrations/expansions/{jobId}/resultResponse 200 returns job, outputs, and a combined manifest.
UI-authored export
POST /v1/content/classrooms/{classroomId}/integrations/exportsRequest:
{
"lessonId": "standalone-lesson-id",
"idempotencyKey": "standalone-lesson:standalone-lesson-id"
}Use this endpoint when content was authored in the TutorFlow UI and needs to be synchronized to another system.
Webhook endpoints
Create webhook
POST /v1/content/organizations/{organizationId}/webhooksRequest:
{
"url": "https://example.com/tutorflow/content-webhooks",
"events": ["content.completed", "content.failed"]
}Response 201 returns endpoint metadata and a one-time secret.
List webhooks
GET /v1/content/organizations/{organizationId}/webhooksResponse 200 returns endpoint metadata without the signing secret.
Delete webhook
DELETE /v1/content/organizations/{organizationId}/webhooks/{webhookId}Response 200 has no body.
Status codes
| Code | Meaning |
|---|---|
200 | Request succeeded. |
201 | Key or webhook created. |
400 | Request body is invalid. |
401 | Missing or invalid Content API key. |
403 | Signed-in admin cannot manage the organization. |
404 | Job, key, or webhook was not found. |
409 | Idempotency or state conflict. |
429 | Rate limit exceeded. |
500 | Unexpected server error. |