Build & Scale with
Direct access to the Prasunex Server Backend API. Sync student records, ingest biometric attendance, automate fee receipts, and integrate campus hardware.
Gateway URL
https://api.prasunex.com/api
Security
Bearer JWT
Specification
OpenAPI 3.1
SLA & Latency
99.99% • <25ms
API Overview
The Prasunex Education OS backend exposes unified REST interfaces organized by domain services (SIS, Biometric Attendance, Marks & Exam, Fee Gateway, Hostel, Transport, and Prerana Predictive AI).
Authentication
Secure JWT Bearer tokens and HTTP-only session cookies with role capabilities.
Strict UTF-8 JSON
Strict application/json request payloads with Zod runtime validation.
Standard Envelopes
Predictable JSON responses containing status, payload, and pagination metadata.
Error Envelopes
Uniform HTTP status codes with machine error codes and correlation IDs.
Correlation Tracking
X-Request-Id header propagation across universal audit logs for forensic tracing.
Rate Limiting
1,000 req/min standard with burst allowances for morning turnstile rushes.
Developer Quick Start
Follow this 4-step sequence to authenticate and communicate with the live Prasunex backend server.
Obtain Credentials
Login via /api/v2/auth/login or generate an API key in Management Settings.
Pass Bearer Token
Include "Authorization: Bearer <token>" and optional X-Request-Id header on all requests.
Execute First Call
Call GET /api/v2/auth/me or GET /health/ready to verify your connection and permissions.
Sync Subsystems
Ingest attendance batches, query student profiles, or listen for webhook triggers.
API Request Code Samples
Select your preferred language or shell to inspect production-ready client code with authentication and correlation tracking.
// Prasunex Node.js / TypeScript SDK Client
import { randomUUID } from 'node:crypto';
const API_BASE = 'https://api.prasunex.com/api';
const BEARER_TOKEN = process.env.PRASUNEX_API_KEY;
// 1. Fetch active students with correlation tracking
async function fetchActiveStudents(classId = 'cls_10a') {
const requestId = randomUUID();
const response = await fetch(`${API_BASE}/v2/management/students?classId=${classId}`, {
method: 'GET',
headers: {
'Authorization': `Bearer ${BEARER_TOKEN}`,
'X-Request-Id': requestId,
'Accept': 'application/json'
}
});
if (!response.ok) {
throw new Error(`HTTP error ${response.status}: ${await response.text()}`);
}
return response.json();
}
// 2. Submit daily attendance bulk ingest
async function submitTurnstileAttendance(records) {
const response = await fetch(`${API_BASE}/v2/attendance/bulk`, {
method: 'POST',
headers: {
'Authorization': `Bearer ${BEARER_TOKEN}`,
'Content-Type': 'application/json'
},
body: JSON.stringify({
date: new Date().toISOString().split('T')[0],
source: 'BIOMETRIC_TURNSTILE',
records
})
});
return response.json();
}Authentication & Session Control
All server routes (except public health checks and login) require valid cryptographic JWT Bearer authentication passed in standard HTTP headers.
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
X-Request-Id: 550e8400-e29b-41d4-a716-446655440000
Content-Type: application/jsonKeep secret JWT keys and private credentials server-side. Never expose long-lived admin tokens in public client-side JavaScript bundles.
Compromised credentials can be invalidated immediately from the Admin Global Command Center (/api/v2/admin/security/revoke).
Server API Endpoints Directory
Real backend route interfaces directly matching server/src/app.ts. Filter by service category or search by path keyword.
/api/v2/auth/loginAuthAuthenticate user credentials across Student, Parent, Staff, or Management portals; returns signed JWT and sets HTTP-only refresh cookie.
Request Payload JSON
{
"email": "registrar@campus.prasunex.com",
"password": "••••••••••••",
"portalType": "management"
}Response 200 OK
{
"success": true,
"data": {
"token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
"expiresIn": 86400,
"user": {
"id": "usr_9410ea82",
"email": "registrar@campus.prasunex.com",
"fullName": "Dr. Ananya Sharma",
"role": "REGISTRAR",
"organisationId": "org_delhi_campus"
}
}
}/api/v2/auth/meAuth/api/v2/auth/refreshAuth/api/v2/management/studentsStudents/api/v2/management/studentsStudents/api/v2/management/students/{id}Students/api/v2/management/students/{id}Students/api/v2/attendanceAttendance/api/v2/attendance/bulkAttendance/api/v2/attendance/summary/{studentId}Attendance/api/v2/classesAcademics/api/v2/timetable/{classId}Academics/api/v2/examsExams/api/v4/marks/batchExams/api/v2/fee-management/invoicesFinance/api/v2/fee-receipts/createFinance/api/v2/defaultersFinance/api/v2/predictive-ai/interventionsAI & Analytics/api/v2/hostel/roomsHostel & Transport/api/v2/transport-smart/routesHostel & Transport/api/v2/audit-logsAudit & System/health/readyAudit & SystemReal-Time Webhook Subscriptions
Receive asynchronous notifications when state-changing institutional events occur without continuous polling.
student.enrolledTriggered when a student is admitted and allocated to an SIS class vault.
attendance.recordedDispatched immediately when morning turnstiles or mobile scans log entry.
fee.paidSent when Razorpay or bank gateway reconciles digital fee collection.
exam.publishedFires when teachers publish term marksheets and generate report cards.
transport.sosUrgent broadcast emitted when campus transport triggers GPS distress alerts.
ai.risk_flaggedDispatched when Prerana AI identifies an academic or attendance intervention.
import crypto from 'node:crypto';
function verifyPrasunexWebhook(rawPayload, signatureHeader, webhookSecret) {
const computedSignature = crypto
.createHmac('sha256', webhookSecret)
.update(rawPayload)
.digest('hex');
return crypto.timingSafeEqual(
Buffer.from(signatureHeader),
Buffer.from(computedSignature)
);
}Error Handling & Codes
Prasunex returns standard HTTP response codes accompanied by structured, machine-readable JSON error payloads.
API Security & Rate Limits
Prasunex protects sensitive educational records with strict transport security, tenant isolation, and cryptographic auditing.
All REST traffic mandates HTTPS encrypted via TLS 1.3. Plain HTTP requests are rejected automatically.
Tokens are restricted to specific operations (e.g. read-only student queries or turnstile write ingest).
Per-token rate limiting protects institutional availability with burst capacity for morning bell rush.
Developer FAQ
Direct answers regarding backend authentication, correlation tracing, rate limits, and integration practices.
Need help building custom integrations?
Our solutions engineering team assists institutional developers with biometric hardware integration, SIS roster synchronization, and custom webhooks.