Enter one of your students for an exam

POST

/v1/{organizationId}/application

Bearer token
Permissionapplication/create
Per organization

Enters one of your students for one exam in this organization, and creates the payment record the application is paid through.

Before you call it: register the student (registerStudent), have them sign in to this organization once through a sign-in link (createSigninLink), which creates the organization’s own record of them, and pick the exam from listAvailableExams: a leaf’s matchedExam._id is the examId to send. An exam that list leaves out for this student is refused here too.

Checks, in order. The first that fails decides the answer.

The student is yours (404). Your students are the ones your account registered; anyone else’s answers like an unknown id.
The organization holds a record of the student (409).
The exam exists in this organization (404).
The exam is offered to this student: it is open, and it fits their grade (400 for a student with no grade), their country and has a language (409, naming the rule).
The student already has this exact exam: 200 "Application already exists." with that application, and nothing is created.
The student holds no other exam in the same category on the same sitting (409).

Side effects. A payment record for the exam’s price: paid with amount 0 for a free exam, pending otherwise. This API never takes or refunds money. An application for a make-up sitting is removed automatically 6 hours after it is made (see removeAfter).

Safe to retry for the same student and exam: a repeat answers 200 with the application already there. Only while the exam is still offered to the student, though, because check 4 runs first: once the sitting date has passed, a repeat answers 409 and leaves the existing application as it was.

data is the application as stored. exam, payment and user are ids, and user is the organization’s own id for the student, not your studentId; getApplication resolves them.

Parameters

Path parameters

Name	Type	Description
`organizationId`required	stringpattern `^[0-9a-f]{24}$`	The organization’s `_id`: 24 hexadecimal digits, as `listOrganizations` (`GET /v1/organization`) lists it. Example `64b7f0c2a1d3e4f5a6b7c8d9`

Request body

application/jsonrequired

examIdstringrequired
The exam’s _id in this organization, 24 hexadecimal digits: a listAvailableExams leaf’s matchedExam._id, or an _id from listExams. It has to be an exam listAvailableExams offers this student.
example6650a1b2c3d4e5f6a7b8c9e1
studentIdstringrequired
The student’s _id, 24 hexadecimal digits: the id registerStudent returned. It has to be one of your students, the ones your account registered.
example6650a1b2c3d4e5f6a7b8c9d0

Responses

200 OK

Nothing new had to be created: message is "Application already exists.".

Body

successbooleanrequired
Always true on a success.
one oftrue
messagestringrequired
exampleApplication already exists.
dataobject · ApplicationRecordResponserequired
An application as stored, with exam, user and payment as ids. Read the application to have them resolved.
16 fields of data
- _idstringrequired
  The application’s id: what applicationId takes.
  example6650a1b2c3d4e5f6a7b8c9e5
- examstringrequired
  The id of the exam applied for.
  example6650a1b2c3d4e5f6a7b8c9e1
- userstringrequired
  The organization’s own id for the student, not the id you registered them with. The application reads resolve it into a record carrying both.
  example6650a1b2c3d4e5f6a7b8c9e9
- paymentstring
  The id of the application’s payment.
  example6650a1b2c3d4e5f6a7b8c9e6
- partnersarray of ApplicationPartnerResponserequired
  On a team exam, the other members of the team. Empty for an exam sat alone.
  2 fields of each item
  userstring
  The team member’s id in this organization. Not one of your students’ ids, and not resolved.
  example6650a1b2c3d4e5f6a7b8c9d6
  acceptedboolean
  Whether they have accepted the invitation to the team.
  exampletrue
- participatedbooleanrequired
  Whether the student has started the exam. A started application cannot be moved to another exam.
  examplefalse
- examStartstring
  When the student started the exam; absent until then.
  formatdate-timeexample2026-11-14T10:04:12.000Z
- examSubmittedboolean
  Whether the student has handed the exam in. A handed-in application cannot be moved to another exam.
  examplefalse
- submitDatestring
  When the student handed the exam in; absent until then.
  formatdate-timeexample2026-11-14T11:12:40.000Z
- simulationStartedbooleanrequired
  Whether the student has started the practice run.
  examplefalse
- simulationStartstring
  When the student started the practice run; absent until then.
  formatdate-timeexample2026-11-07T10:00:00.000Z
- simulationSubmittedbooleanrequired
  Whether the student has handed the practice run in.
  examplefalse
- removeAfterstring
  Only on an application to an exam on a make-up sitting: when it will be removed, 6 hours after it was made.
  formatdate-timeexample2026-09-02T14:05:00.000Z
- uuidstringrequired
  A short reference code for the application.
  examplea3f-09c-7e1
- createdAtstringrequired
  When the application was made.
  formatdate-timeexample2026-09-01T09:30:00.000Z
- updatedAtstringrequired
  When the application last changed.
  formatdate-timeexample2026-09-02T14:05:00.000Z

Headers

X-RateLimit-Limit integer: Requests your account may make to this operation per window (100).
X-RateLimit-Remaining integer: Requests left in the current window.
X-RateLimit-Reset integer: Seconds until the current window ends.

Example

{
  "success": true,
  "message": "Application already exists.",
  "data": {
    "_id": "6650a1b2c3d4e5f6a7b8c9e5",
    "exam": "6650a1b2c3d4e5f6a7b8c9e1",
    "user": "6650a1b2c3d4e5f6a7b8c9e9",
    "payment": "6650a1b2c3d4e5f6a7b8c9e6",
    "partners": [
      {
        "user": "6650a1b2c3d4e5f6a7b8c9d6",
        "accepted": true
      }
    ],
    "participated": false,
    "examStart": "2026-11-14T10:04:12.000Z",
    "examSubmitted": false,
    "submitDate": "2026-11-14T11:12:40.000Z",
    "simulationStarted": false,
    "simulationStart": "2026-11-07T10:00:00.000Z",
    "simulationSubmitted": false,
    "removeAfter": "2026-09-02T14:05:00.000Z",
    "uuid": "a3f-09c-7e1",
    "createdAt": "2026-09-01T09:30:00.000Z",
    "updatedAt": "2026-09-02T14:05:00.000Z"
  }
}

201 Created

Created: message is "Application created successfully.".

Body

successbooleanrequired
Always true on a success.
one oftrue
messagestringrequired
exampleApplication created successfully.
dataobject · ApplicationRecordResponserequired
An application as stored, with exam, user and payment as ids. Read the application to have them resolved.
16 fields of data
- _idstringrequired
  The application’s id: what applicationId takes.
  example6650a1b2c3d4e5f6a7b8c9e5
- examstringrequired
  The id of the exam applied for.
  example6650a1b2c3d4e5f6a7b8c9e1
- userstringrequired
  The organization’s own id for the student, not the id you registered them with. The application reads resolve it into a record carrying both.
  example6650a1b2c3d4e5f6a7b8c9e9
- paymentstring
  The id of the application’s payment.
  example6650a1b2c3d4e5f6a7b8c9e6
- partnersarray of ApplicationPartnerResponserequired
  On a team exam, the other members of the team. Empty for an exam sat alone.
  2 fields of each item
  userstring
  The team member’s id in this organization. Not one of your students’ ids, and not resolved.
  example6650a1b2c3d4e5f6a7b8c9d6
  acceptedboolean
  Whether they have accepted the invitation to the team.
  exampletrue
- participatedbooleanrequired
  Whether the student has started the exam. A started application cannot be moved to another exam.
  examplefalse
- examStartstring
  When the student started the exam; absent until then.
  formatdate-timeexample2026-11-14T10:04:12.000Z
- examSubmittedboolean
  Whether the student has handed the exam in. A handed-in application cannot be moved to another exam.
  examplefalse
- submitDatestring
  When the student handed the exam in; absent until then.
  formatdate-timeexample2026-11-14T11:12:40.000Z
- simulationStartedbooleanrequired
  Whether the student has started the practice run.
  examplefalse
- simulationStartstring
  When the student started the practice run; absent until then.
  formatdate-timeexample2026-11-07T10:00:00.000Z
- simulationSubmittedbooleanrequired
  Whether the student has handed the practice run in.
  examplefalse
- removeAfterstring
  Only on an application to an exam on a make-up sitting: when it will be removed, 6 hours after it was made.
  formatdate-timeexample2026-09-02T14:05:00.000Z
- uuidstringrequired
  A short reference code for the application.
  examplea3f-09c-7e1
- createdAtstringrequired
  When the application was made.
  formatdate-timeexample2026-09-01T09:30:00.000Z
- updatedAtstringrequired
  When the application last changed.
  formatdate-timeexample2026-09-02T14:05:00.000Z

Headers

X-RateLimit-Limit integer: Requests your account may make to this operation per window (100).
X-RateLimit-Remaining integer: Requests left in the current window.
X-RateLimit-Reset integer: Seconds until the current window ends.

Example

{
  "success": true,
  "message": "Application created successfully.",
  "data": {
    "_id": "6650a1b2c3d4e5f6a7b8c9e5",
    "exam": "6650a1b2c3d4e5f6a7b8c9e1",
    "user": "6650a1b2c3d4e5f6a7b8c9e9",
    "payment": "6650a1b2c3d4e5f6a7b8c9e6",
    "partners": [
      {
        "user": "6650a1b2c3d4e5f6a7b8c9d6",
        "accepted": true
      }
    ],
    "participated": false,
    "examStart": "2026-11-14T10:04:12.000Z",
    "examSubmitted": false,
    "submitDate": "2026-11-14T11:12:40.000Z",
    "simulationStarted": false,
    "simulationStart": "2026-11-07T10:00:00.000Z",
    "simulationSubmitted": false,
    "removeAfter": "2026-09-02T14:05:00.000Z",
    "uuid": "a3f-09c-7e1",
    "createdAt": "2026-09-01T09:30:00.000Z",
    "updatedAt": "2026-09-02T14:05:00.000Z"
  }
}

400 Bad request

bad_request: The body is not valid JSON, breaks a field’s rules, or has a field this operation does not accept ("property <name> should not exist").
bad_request: The exam is open, but the student has no grade. Set one with updateOrgStudent or updateStudent, then try again.

When

bad_request
The body is not valid JSON, breaks a field’s rules, or has a field this operation does not accept ("property <name> should not exist").
bad_request
The exam is open, but the student has no grade. Set one with updateOrgStudent or updateStudent, then try again.

Example

{
  "error": {
    "code": "bad_request",
    "documentation_url": "https://hub.main-team.org/api/errors#bad_request",
    "message": "The request was malformed or contained invalid parameters.",
    "request_id": "0b5c6d0e-8f7a-4b1c-9d2e-3f4a5b6c7d8e"
  }
}

Fields of the error body

errorobject · ErrorDetailrequired
What went wrong.
5 fields of error
- codestringrequired
  A stable machine code: branch on this. Each one is explained at documentation_url.
  one ofinvalid_emailbad_requestunauthorizedforbiddennot_foundconflictpayload_too_largeunsupported_media_typeunprocessable_entitytoo_many_requestsinternal_errorservice_unavailable
  examplenot_found
- messagestringrequired
  Written for a person, and may change: never branch on it.
  exampleNot found!
- documentation_urlstringrequired
  Where this code is explained.
  formaturiexamplehttps://hub.main-team.org/api/errors#not_found
- request_idstringrequired
  This request’s id, also sent as the X-Request-Id response header: the one you sent, when it was acceptable, or else one the API made. Quote it when you report a problem.
  example0b5c6d0e-8f7a-4b1c-9d2e-3f4a5b6c7d8e
- detailsobject
  Present only where an operation says so, and then with the shape that operation documents — the rows it could not accept, say. Treat it as absent everywhere else, and ignore a details you do not recognise.

401 Unauthorized

unauthorized: The token is missing or malformed, is not signed with your account’s apiSecret, breaks the iat and exp rules, has expired or been revoked, or its account is not active. All of these answer the same.

When

unauthorized
The token is missing or malformed, is not signed with your account’s apiSecret, breaks the iat and exp rules, has expired or been revoked, or its account is not active. All of these answer the same.

Example

{
  "error": {
    "code": "unauthorized",
    "documentation_url": "https://hub.main-team.org/api/errors#unauthorized",
    "message": "Authentication is required or the provided credentials are invalid.",
    "request_id": "0b5c6d0e-8f7a-4b1c-9d2e-3f4a5b6c7d8e"
  }
}

Fields of the error body

errorobject · ErrorDetailrequired
What went wrong.
5 fields of error
- codestringrequired
  A stable machine code: branch on this. Each one is explained at documentation_url.
  one ofinvalid_emailbad_requestunauthorizedforbiddennot_foundconflictpayload_too_largeunsupported_media_typeunprocessable_entitytoo_many_requestsinternal_errorservice_unavailable
  examplenot_found
- messagestringrequired
  Written for a person, and may change: never branch on it.
  exampleNot found!
- documentation_urlstringrequired
  Where this code is explained.
  formaturiexamplehttps://hub.main-team.org/api/errors#not_found
- request_idstringrequired
  This request’s id, also sent as the X-Request-Id response header: the one you sent, when it was acceptable, or else one the API made. Quote it when you report a problem.
  example0b5c6d0e-8f7a-4b1c-9d2e-3f4a5b6c7d8e
- detailsobject
  Present only where an operation says so, and then with the shape that operation documents — the rows it could not accept, say. Treat it as absent everywhere else, and ignore a details you do not recognise.

403 Forbidden

forbidden: The token is valid, but no role on your account allows application/create on the organization in the path, or a role denies it.

When

forbidden
The token is valid, but no role on your account allows application/create on the organization in the path, or a role denies it.

Example

{
  "error": {
    "code": "forbidden",
    "documentation_url": "https://hub.main-team.org/api/errors#forbidden",
    "message": "Insufficient role permissions",
    "request_id": "0b5c6d0e-8f7a-4b1c-9d2e-3f4a5b6c7d8e"
  }
}

Fields of the error body

errorobject · ErrorDetailrequired
What went wrong.
5 fields of error
- codestringrequired
  A stable machine code: branch on this. Each one is explained at documentation_url.
  one ofinvalid_emailbad_requestunauthorizedforbiddennot_foundconflictpayload_too_largeunsupported_media_typeunprocessable_entitytoo_many_requestsinternal_errorservice_unavailable
  examplenot_found
- messagestringrequired
  Written for a person, and may change: never branch on it.
  exampleNot found!
- documentation_urlstringrequired
  Where this code is explained.
  formaturiexamplehttps://hub.main-team.org/api/errors#not_found
- request_idstringrequired
  This request’s id, also sent as the X-Request-Id response header: the one you sent, when it was acceptable, or else one the API made. Quote it when you report a problem.
  example0b5c6d0e-8f7a-4b1c-9d2e-3f4a5b6c7d8e
- detailsobject
  Present only where an operation says so, and then with the shape that operation documents — the rows it could not accept, say. Treat it as absent everywhere else, and ignore a details you do not recognise.

404 Not found

not_found: organizationId is not the _id of an organization.
not_found: No student of yours has this id: it matches nobody, or another account registered the student.
not_found: examId is not the _id of an exam in this organization.

When

not_found
organizationId is not the _id of an organization.
not_found
No student of yours has this id: it matches nobody, or another account registered the student.
not_found
examId is not the _id of an exam in this organization.

Example

{
  "error": {
    "code": "not_found",
    "documentation_url": "https://hub.main-team.org/api/errors#not_found",
    "message": "Organization not found!",
    "request_id": "0b5c6d0e-8f7a-4b1c-9d2e-3f4a5b6c7d8e"
  }
}

Fields of the error body

errorobject · ErrorDetailrequired
What went wrong.
5 fields of error
- codestringrequired
  A stable machine code: branch on this. Each one is explained at documentation_url.
  one ofinvalid_emailbad_requestunauthorizedforbiddennot_foundconflictpayload_too_largeunsupported_media_typeunprocessable_entitytoo_many_requestsinternal_errorservice_unavailable
  examplenot_found
- messagestringrequired
  Written for a person, and may change: never branch on it.
  exampleNot found!
- documentation_urlstringrequired
  Where this code is explained.
  formaturiexamplehttps://hub.main-team.org/api/errors#not_found
- request_idstringrequired
  This request’s id, also sent as the X-Request-Id response header: the one you sent, when it was acceptable, or else one the API made. Quote it when you report a problem.
  example0b5c6d0e-8f7a-4b1c-9d2e-3f4a5b6c7d8e
- detailsobject
  Present only where an operation says so, and then with the shape that operation documents — the rows it could not accept, say. Treat it as absent everywhere else, and ignore a details you do not recognise.

409 Conflict

conflict: The student has never signed in to this organization, so it holds no record of them yet. Send them a sign-in link (createSigninLink), and try again once they have used it.
conflict: The exam is not open: applications to it are switched off, its sitting date has passed, or its category is inactive.
conflict: The exam does not accept the student’s grade. The message names the grades it does accept, such as "Exam is not available for grade 8. It accepts grade 9, 10."
conflict: The exam is restricted to countries the student is not in. The message names the countries it is offered in.
conflict: The exam has no language set, so it is offered to no student.
conflict: For any other reason, listAvailableExams leaves the exam out for this student.
conflict: The student already holds another exam in the same category on the same sitting, and nobody can sit both. Move that application (moveApplication) instead.

When

conflict
The student has never signed in to this organization, so it holds no record of them yet. Send them a sign-in link (createSigninLink), and try again once they have used it.
conflict
The exam is not open: applications to it are switched off, its sitting date has passed, or its category is inactive.
conflict
The exam does not accept the student’s grade. The message names the grades it does accept, such as "Exam is not available for grade 8. It accepts grade 9, 10."
conflict
The exam is restricted to countries the student is not in. The message names the countries it is offered in.
conflict
The exam has no language set, so it is offered to no student.
conflict
For any other reason, listAvailableExams leaves the exam out for this student.
conflict
The student already holds another exam in the same category on the same sitting, and nobody can sit both. Move that application (moveApplication) instead.

Example

{
  "error": {
    "code": "conflict",
    "documentation_url": "https://hub.main-team.org/api/errors#conflict",
    "message": "The request conflicts with the current state of the resource.",
    "request_id": "0b5c6d0e-8f7a-4b1c-9d2e-3f4a5b6c7d8e"
  }
}

Fields of the error body

errorobject · ErrorDetailrequired
What went wrong.
5 fields of error
- codestringrequired
  A stable machine code: branch on this. Each one is explained at documentation_url.
  one ofinvalid_emailbad_requestunauthorizedforbiddennot_foundconflictpayload_too_largeunsupported_media_typeunprocessable_entitytoo_many_requestsinternal_errorservice_unavailable
  examplenot_found
- messagestringrequired
  Written for a person, and may change: never branch on it.
  exampleNot found!
- documentation_urlstringrequired
  Where this code is explained.
  formaturiexamplehttps://hub.main-team.org/api/errors#not_found
- request_idstringrequired
  This request’s id, also sent as the X-Request-Id response header: the one you sent, when it was acceptable, or else one the API made. Quote it when you report a problem.
  example0b5c6d0e-8f7a-4b1c-9d2e-3f4a5b6c7d8e
- detailsobject
  Present only where an operation says so, and then with the shape that operation documents — the rows it could not accept, say. Treat it as absent everywhere else, and ignore a details you do not recognise.

413 Payload too large

payload_too_large: The body is larger than 100 kB.

When

payload_too_large
The body is larger than 100 kB.

Example

{
  "error": {
    "code": "payload_too_large",
    "documentation_url": "https://hub.main-team.org/api/errors#payload_too_large",
    "message": "request entity too large",
    "request_id": "0b5c6d0e-8f7a-4b1c-9d2e-3f4a5b6c7d8e"
  }
}

Fields of the error body

errorobject · ErrorDetailrequired
What went wrong.
5 fields of error
- codestringrequired
  A stable machine code: branch on this. Each one is explained at documentation_url.
  one ofinvalid_emailbad_requestunauthorizedforbiddennot_foundconflictpayload_too_largeunsupported_media_typeunprocessable_entitytoo_many_requestsinternal_errorservice_unavailable
  examplenot_found
- messagestringrequired
  Written for a person, and may change: never branch on it.
  exampleNot found!
- documentation_urlstringrequired
  Where this code is explained.
  formaturiexamplehttps://hub.main-team.org/api/errors#not_found
- request_idstringrequired
  This request’s id, also sent as the X-Request-Id response header: the one you sent, when it was acceptable, or else one the API made. Quote it when you report a problem.
  example0b5c6d0e-8f7a-4b1c-9d2e-3f4a5b6c7d8e
- detailsobject
  Present only where an operation says so, and then with the shape that operation documents — the rows it could not accept, say. Treat it as absent everywhere else, and ignore a details you do not recognise.

415 Unsupported media type

unsupported_media_type: The body declares a charset that is not a UTF one (send UTF-8), or a Content-Encoding other than gzip, deflate or br.

When

unsupported_media_type
The body declares a charset that is not a UTF one (send UTF-8), or a Content-Encoding other than gzip, deflate or br.

Example

{
  "error": {
    "code": "unsupported_media_type",
    "documentation_url": "https://hub.main-team.org/api/errors#unsupported_media_type",
    "message": "unsupported charset \"ISO-8859-1\"",
    "request_id": "0b5c6d0e-8f7a-4b1c-9d2e-3f4a5b6c7d8e"
  }
}

Fields of the error body

errorobject · ErrorDetailrequired
What went wrong.
5 fields of error
- codestringrequired
  A stable machine code: branch on this. Each one is explained at documentation_url.
  one ofinvalid_emailbad_requestunauthorizedforbiddennot_foundconflictpayload_too_largeunsupported_media_typeunprocessable_entitytoo_many_requestsinternal_errorservice_unavailable
  examplenot_found
- messagestringrequired
  Written for a person, and may change: never branch on it.
  exampleNot found!
- documentation_urlstringrequired
  Where this code is explained.
  formaturiexamplehttps://hub.main-team.org/api/errors#not_found
- request_idstringrequired
  This request’s id, also sent as the X-Request-Id response header: the one you sent, when it was acceptable, or else one the API made. Quote it when you report a problem.
  example0b5c6d0e-8f7a-4b1c-9d2e-3f4a5b6c7d8e
- detailsobject
  Present only where an operation says so, and then with the shape that operation documents — the rows it could not accept, say. Treat it as absent everywhere else, and ignore a details you do not recognise.

429 Too many requests

too_many_requests: Your account has made more than 100 requests to this operation in the current 60-second window. Wait the seconds in Retry-After before sending again.

When

too_many_requests
Your account has made more than 100 requests to this operation in the current 60-second window. Wait the seconds in Retry-After before sending again.

Headers

Retry-After integer: Seconds to wait before sending again; a request sent sooner is refused too.

Example

{
  "error": {
    "code": "too_many_requests",
    "documentation_url": "https://hub.main-team.org/api/errors#too_many_requests",
    "message": "Too many requests to this operation. Wait the number of seconds in Retry-After, then try again.",
    "request_id": "0b5c6d0e-8f7a-4b1c-9d2e-3f4a5b6c7d8e"
  }
}

Fields of the error body

errorobject · ErrorDetailrequired
What went wrong.
5 fields of error
- codestringrequired
  A stable machine code: branch on this. Each one is explained at documentation_url.
  one ofinvalid_emailbad_requestunauthorizedforbiddennot_foundconflictpayload_too_largeunsupported_media_typeunprocessable_entitytoo_many_requestsinternal_errorservice_unavailable
  examplenot_found
- messagestringrequired
  Written for a person, and may change: never branch on it.
  exampleNot found!
- documentation_urlstringrequired
  Where this code is explained.
  formaturiexamplehttps://hub.main-team.org/api/errors#not_found
- request_idstringrequired
  This request’s id, also sent as the X-Request-Id response header: the one you sent, when it was acceptable, or else one the API made. Quote it when you report a problem.
  example0b5c6d0e-8f7a-4b1c-9d2e-3f4a5b6c7d8e
- detailsobject
  Present only where an operation says so, and then with the shape that operation documents — the rows it could not accept, say. Treat it as absent everywhere else, and ignore a details you do not recognise.

500 Internal error

internal_error: Something failed on our side. Retry later, and quote request_id if it goes on.

When

internal_error
Something failed on our side. Retry later, and quote request_id if it goes on.

Example

{
  "error": {
    "code": "internal_error",
    "documentation_url": "https://hub.main-team.org/api/errors#internal_error",
    "message": "An unexpected error occurred.",
    "request_id": "0b5c6d0e-8f7a-4b1c-9d2e-3f4a5b6c7d8e"
  }
}

Fields of the error body

errorobject · ErrorDetailrequired
What went wrong.
5 fields of error
- codestringrequired
  A stable machine code: branch on this. Each one is explained at documentation_url.
  one ofinvalid_emailbad_requestunauthorizedforbiddennot_foundconflictpayload_too_largeunsupported_media_typeunprocessable_entitytoo_many_requestsinternal_errorservice_unavailable
  examplenot_found
- messagestringrequired
  Written for a person, and may change: never branch on it.
  exampleNot found!
- documentation_urlstringrequired
  Where this code is explained.
  formaturiexamplehttps://hub.main-team.org/api/errors#not_found
- request_idstringrequired
  This request’s id, also sent as the X-Request-Id response header: the one you sent, when it was acceptable, or else one the API made. Quote it when you report a problem.
  example0b5c6d0e-8f7a-4b1c-9d2e-3f4a5b6c7d8e
- detailsobject
  Present only where an operation says so, and then with the shape that operation documents — the rows it could not accept, say. Treat it as absent everywhere else, and ignore a details you do not recognise.

Example request

# $TOKEN: a short-lived token you minted with your API key and secret
curl -sS -X POST 'https://api.main-team.org/v1/<organizationId>/application' \
  -H "Authorization: Bearer $TOKEN" \
  -H 'Content-Type: application/json' \
  --data-binary @- <<'JSON'
{
  "examId": "6650a1b2c3d4e5f6a7b8c9e1",
  "studentId": "6650a1b2c3d4e5f6a7b8c9d0"
}
JSON

const token = process.env.TOKEN; // a short-lived token you minted with your API key and secret

const res = await fetch('https://api.main-team.org/v1/<organizationId>/application', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${token}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "examId": "6650a1b2c3d4e5f6a7b8c9e1",
    "studentId": "6650a1b2c3d4e5f6a7b8c9d0"
  }),
});
const body = await res.json();
if (!res.ok) throw new Error(`${res.status} ${body.error.code}: ${body.error.message}`);
console.log(body.data);

<?php
$token = getenv('TOKEN'); // a short-lived token you minted with your API key and secret

$ch = curl_init('https://api.main-team.org/v1/<organizationId>/application');
curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer ' . $token,
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => json_encode([
        'examId' => '6650a1b2c3d4e5f6a7b8c9e1',
        'studentId' => '6650a1b2c3d4e5f6a7b8c9d0',
    ]),
    CURLOPT_RETURNTRANSFER => true,
]);
$response = curl_exec($ch);
if ($response === false) {
    throw new RuntimeException(curl_error($ch));
}
$status = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
$body = json_decode($response, true);
if ($status >= 400) {
    $error = $body['error'];
    throw new RuntimeException("$status {$error['code']}: {$error['message']}");
}
print_r($body['data']);