Fetch one of your students, if they can use this organization
- Bearer token
- Permission
student/read - Per organization
Returns one student your account registered, if they can use this organization (their activatedPlatformsThisSeason holds its slug or common), with the references resolved as listOrgStudents returns them.
An unknown id, a student registered by another account and a student of yours without access to this organization all answer 404 not_found, the same way. A malformed id is a 400.
To give a student access, use updateOrgStudent.
Parameters
Path parameters
| Name | Type | Description |
|---|---|---|
organizationIdrequired | stringpattern ^[0-9a-f]{24}$ | The organization’s Example |
studentIdrequired | string | The student’s id ( |
Responses
200 OK
Success: message is "Student fetched successfully".
Body
successbooleanrequiredAlways
trueon a success.one of
truemessagestringrequiredexample
Student fetched successfullydataobject · StudentResponserequiredOne of your students, with
country,city,school,grade,supervisorandpartnerresolved into records. What the student reads answer with.20 fields of data
_idstringrequiredThe student’s id: what every
studentIdpath parameter and body field takes.example
6650a1b2c3d4e5f6a7b8c9d0mainIdstringOnly on an organization’s own copy of a student, which
linkStudentSupervisoranswers with: there it is the student’s id, and_idis the organization’s own. Absent on every other operation.example
6650a1b2c3d4e5f6a7b8c9d0usernamestringrequiredIssued at registration, never chosen by you: the country’s two-letter code, a letter, then a number. It is how the student signs in and how support refers to the account.
example
XXB1045firstNamestringrequiredThe student’s first name.
example
JanelastNamestringrequiredThe student’s surname.
example
DoefullNamestringrequiredfirstNameandlastNamejoined by a space, kept in step when either changes.example
Jane DoeemailstringrequiredThe student’s email address, in lower case.
example
jane.doe@example.comemailConfirmedbooleanrequiredWhether the student has confirmed
email. It startsfalse, only the student can make ittrue, and changingemailsets it back tofalse. Once it istrue,setStudentPasswordis refused: the account is the student’s.example
falsephonestringA phone number, as you sent it.
example
+1 555 0100birthstringDate of birth,
DD/MM/YYYY.example
14/05/2008sexstringm,forn.one of
mfnexample
fcountryobject · CountryResponsenullableThe student’s country.
nullif the stored reference no longer resolves; absent when none is set.9 fields of country
_idstringrequiredThe country’s id: what
countrytakes when you register or update a student.example
6650a1b2c3d4e5f6a7b8c9d1namestringThe country’s name, in capitals.
example
UNITED STATESiso3stringThe ISO 3166-1 alpha-3 code, in capitals.
example
USAiso2stringThe ISO 3166-1 alpha-2 code, in capitals. A student’s
usernamestarts with it.example
UStzstringThe IANA time zone a sitting on local time is read in for students in this country (see
tzon a sitting).example
America/New_YorkdialCodestringThe international dialling code, with its
+.example
+1flagstringThe country’s flag, as an emoji.
example
🇺🇸createdAtstringWhen the record was created.
format
date-timeexample2026-09-01T09:30:00.000ZupdatedAtstringWhen the record last changed.
format
date-timeexample2026-09-02T14:05:00.000Z
cityobject · CityResponsenullableThe student’s city.
nullif the stored reference no longer resolves; absent when none is set.6 fields of city
_idstringrequiredThe city’s id.
example
6650a1b2c3d4e5f6a7b8c9d2namestringThe city’s name, in capitals.
example
SPRINGFIELDcountrystringThe id of the country the city is in, where one is recorded.
example
6650a1b2c3d4e5f6a7b8c9d1stateCodestringA state or region code, where one is recorded.
example
ILcreatedAtstringWhen the record was created.
format
date-timeexample2026-09-01T09:30:00.000ZupdatedAtstringWhen the record last changed.
format
date-timeexample2026-09-02T14:05:00.000Z
schoolobject · SchoolResponsenullableThe student’s school.
nullif the stored reference no longer resolves; absent when none is set.6 fields of school
_idstringrequiredThe school’s id.
example
6650a1b2c3d4e5f6a7b8c9d3namestringThe school’s name, in capitals.
example
SPRINGFIELD HIGH SCHOOLcountrystringThe id of the school’s country, where one is recorded.
example
6650a1b2c3d4e5f6a7b8c9d1citystringThe id of the school’s city, where one is recorded.
example
6650a1b2c3d4e5f6a7b8c9d2createdAtstringWhen the record was created.
format
date-timeexample2026-09-01T09:30:00.000ZupdatedAtstringWhen the record last changed.
format
date-timeexample2026-09-02T14:05:00.000Z
gradeobject · GradeResponsenullableThe student’s grade, which decides the exams they are offered.
nullif the stored reference no longer resolves; absent when none is set.4 fields of grade
_idstringrequiredThe grade’s id: what
gradetakes when you register or update a student. A grade has the same id in every organization.example
6650a1b2c3d4e5f6a7b8c9d4namestringThe grade, as a number in a string,
1to12.gradeaccepts this name as well as the id.example
10createdAtstringWhen the record was created. The grade list is in this order.
format
date-timeexample2026-09-01T09:30:00.000ZupdatedAtstringWhen the record last changed.
format
date-timeexample2026-09-02T14:05:00.000Z
supervisorobject · PersonRefResponsenullableThe supervisor the student is attached to across the platform. A supervisor you link with
linkStudentSupervisoris set on that one organization’s copy of the student, and does not appear here.nullif the stored reference no longer resolves; absent when none is set.6 fields of supervisor
_idstringrequiredTheir id.
example
6650a1b2c3d4e5f6a7b8c9d5mainIdstringTheir main id, when this is an organization’s own copy of them. Absent otherwise.
example
6650a1b2c3d4e5f6a7b8c9d5firstNamestringTheir first name.
example
JohnlastNamestringTheir surname.
example
SmithfullNamestringTheir first name and surname, joined by a space.
example
John SmithusernamestringTheir username, in capitals. For a supervisor, the value
linkStudentSupervisortakes.example
XXT1003
partnerobject · PersonRefResponsenullableThe partner the student is attached to.
nullif the stored reference no longer resolves; absent when none is set.6 fields of partner
_idstringrequiredTheir id.
example
6650a1b2c3d4e5f6a7b8c9d5mainIdstringTheir main id, when this is an organization’s own copy of them. Absent otherwise.
example
6650a1b2c3d4e5f6a7b8c9d5firstNamestringTheir first name.
example
JohnlastNamestringTheir surname.
example
SmithfullNamestringTheir first name and surname, joined by a space.
example
John SmithusernamestringTheir username, in capitals. For a supervisor, the value
linkStudentSupervisortakes.example
XXT1003
activatedPlatformsThisSeasonarray of stringrequiredThe organizations the student is active on this season, by
slug;commonmeans every organization. Registration setscommonunless you send a list. The organization-scoped student operations see a student only when this lists that organization orcommon, and updating a student through one adds that organization.example
["common"]createdAtstringrequiredWhen the student was registered.
format
date-timeexample2026-09-01T09:30:00.000ZupdatedAtstringrequiredWhen the record last changed.
format
date-timeexample2026-09-02T14:05:00.000Z
Headers
X-RateLimit-LimitintegerRequests your account may make to this operation per window (100).
X-RateLimit-RemainingintegerRequests left in the current window.
X-RateLimit-ResetintegerSeconds until the current window ends.
Example
{
"success": true,
"message": "Student fetched successfully",
"data": {
"_id": "6650a1b2c3d4e5f6a7b8c9d0",
"mainId": "6650a1b2c3d4e5f6a7b8c9d0",
"username": "XXB1045",
"firstName": "Jane",
"lastName": "Doe",
"fullName": "Jane Doe",
"email": "jane.doe@example.com",
"emailConfirmed": false,
"phone": "+1 555 0100",
"birth": "14/05/2008",
"sex": "f",
"country": {
"_id": "6650a1b2c3d4e5f6a7b8c9d1",
"name": "UNITED STATES",
"iso3": "USA",
"iso2": "US",
"tz": "America/New_York",
"dialCode": "+1",
"flag": "🇺🇸",
"createdAt": "2026-09-01T09:30:00.000Z",
"updatedAt": "2026-09-02T14:05:00.000Z"
},
"city": {
"_id": "6650a1b2c3d4e5f6a7b8c9d2",
"name": "SPRINGFIELD",
"country": "6650a1b2c3d4e5f6a7b8c9d1",
"stateCode": "IL",
"createdAt": "2026-09-01T09:30:00.000Z",
"updatedAt": "2026-09-02T14:05:00.000Z"
},
"school": {
"_id": "6650a1b2c3d4e5f6a7b8c9d3",
"name": "SPRINGFIELD HIGH SCHOOL",
"country": "6650a1b2c3d4e5f6a7b8c9d1",
"city": "6650a1b2c3d4e5f6a7b8c9d2",
"createdAt": "2026-09-01T09:30:00.000Z",
"updatedAt": "2026-09-02T14:05:00.000Z"
},
"grade": {
"_id": "6650a1b2c3d4e5f6a7b8c9d4",
"name": "10",
"createdAt": "2026-09-01T09:30:00.000Z",
"updatedAt": "2026-09-02T14:05:00.000Z"
},
"supervisor": {
"_id": "6650a1b2c3d4e5f6a7b8c9d5",
"mainId": "6650a1b2c3d4e5f6a7b8c9d5",
"firstName": "John",
"lastName": "Smith",
"fullName": "John Smith",
"username": "XXT1003"
},
"partner": {
"_id": "6650a1b2c3d4e5f6a7b8c9d5",
"mainId": "6650a1b2c3d4e5f6a7b8c9d5",
"firstName": "John",
"lastName": "Smith",
"fullName": "John Smith",
"username": "XXT1003"
},
"activatedPlatformsThisSeason": [
"common"
],
"createdAt": "2026-09-01T09:30:00.000Z",
"updatedAt": "2026-09-02T14:05:00.000Z"
}
}400 Bad request
bad_request: studentId is not a well-formed id.
When
bad_requeststudentIdis not a well-formed id.
Example
{
"error": {
"code": "bad_request",
"documentation_url": "https://hub.main-team.org/api/errors#bad_request",
"message": "Invalid value for 'mainId': expected ObjectId.",
"request_id": "0b5c6d0e-8f7a-4b1c-9d2e-3f4a5b6c7d8e"
}
}Fields of the error body
errorobject · ErrorDetailrequiredWhat went wrong.
5 fields of error
codestringrequiredA stable machine code: branch on this. Each one is explained at
documentation_url.one of
invalid_emailbad_requestunauthorizedforbiddennot_foundconflictpayload_too_largeunsupported_media_typeunprocessable_entitytoo_many_requestsinternal_errorservice_unavailableexample
not_foundmessagestringrequiredWritten for a person, and may change: never branch on it.
example
Not found!documentation_urlstringrequiredWhere this code is explained.
format
uriexamplehttps://hub.main-team.org/api/errors#not_foundrequest_idstringrequiredThis request’s id, also sent as the
X-Request-Idresponse header: the one you sent, when it was acceptable, or else one the API made. Quote it when you report a problem.example
0b5c6d0e-8f7a-4b1c-9d2e-3f4a5b6c7d8edetailsobjectPresent only where an operation says so, and then with the shape that operation documents — the rows it could not accept, say. Treat it as absent everywhere else, and ignore a
detailsyou do not recognise.
401 Unauthorized
unauthorized: The token is missing or malformed, is not signed with your account’s apiSecret, breaks the iat and exp rules, has expired or been revoked, or its account is not active. All of these answer the same.
When
unauthorizedThe token is missing or malformed, is not signed with your account’s
apiSecret, breaks theiatandexprules, has expired or been revoked, or its account is not active. All of these answer the same.
Example
{
"error": {
"code": "unauthorized",
"documentation_url": "https://hub.main-team.org/api/errors#unauthorized",
"message": "Authentication is required or the provided credentials are invalid.",
"request_id": "0b5c6d0e-8f7a-4b1c-9d2e-3f4a5b6c7d8e"
}
}Fields of the error body
errorobject · ErrorDetailrequiredWhat went wrong.
5 fields of error
codestringrequiredA stable machine code: branch on this. Each one is explained at
documentation_url.one of
invalid_emailbad_requestunauthorizedforbiddennot_foundconflictpayload_too_largeunsupported_media_typeunprocessable_entitytoo_many_requestsinternal_errorservice_unavailableexample
not_foundmessagestringrequiredWritten for a person, and may change: never branch on it.
example
Not found!documentation_urlstringrequiredWhere this code is explained.
format
uriexamplehttps://hub.main-team.org/api/errors#not_foundrequest_idstringrequiredThis request’s id, also sent as the
X-Request-Idresponse header: the one you sent, when it was acceptable, or else one the API made. Quote it when you report a problem.example
0b5c6d0e-8f7a-4b1c-9d2e-3f4a5b6c7d8edetailsobjectPresent only where an operation says so, and then with the shape that operation documents — the rows it could not accept, say. Treat it as absent everywhere else, and ignore a
detailsyou do not recognise.
403 Forbidden
forbidden: The token is valid, but no role on your account allows student/read on the organization in the path, or a role denies it.
When
forbiddenThe token is valid, but no role on your account allows
student/readon the organization in the path, or a role denies it.
Example
{
"error": {
"code": "forbidden",
"documentation_url": "https://hub.main-team.org/api/errors#forbidden",
"message": "Insufficient role permissions",
"request_id": "0b5c6d0e-8f7a-4b1c-9d2e-3f4a5b6c7d8e"
}
}Fields of the error body
errorobject · ErrorDetailrequiredWhat went wrong.
5 fields of error
codestringrequiredA stable machine code: branch on this. Each one is explained at
documentation_url.one of
invalid_emailbad_requestunauthorizedforbiddennot_foundconflictpayload_too_largeunsupported_media_typeunprocessable_entitytoo_many_requestsinternal_errorservice_unavailableexample
not_foundmessagestringrequiredWritten for a person, and may change: never branch on it.
example
Not found!documentation_urlstringrequiredWhere this code is explained.
format
uriexamplehttps://hub.main-team.org/api/errors#not_foundrequest_idstringrequiredThis request’s id, also sent as the
X-Request-Idresponse header: the one you sent, when it was acceptable, or else one the API made. Quote it when you report a problem.example
0b5c6d0e-8f7a-4b1c-9d2e-3f4a5b6c7d8edetailsobjectPresent only where an operation says so, and then with the shape that operation documents — the rows it could not accept, say. Treat it as absent everywhere else, and ignore a
detailsyou do not recognise.
404 Not found
not_found:organizationIdis not the_idof an organization.not_found: No student of yours with this id can use this organization: unknown, another account’s, or not activated here.
When
Example
{
"error": {
"code": "not_found",
"documentation_url": "https://hub.main-team.org/api/errors#not_found",
"message": "Organization not found!",
"request_id": "0b5c6d0e-8f7a-4b1c-9d2e-3f4a5b6c7d8e"
}
}Fields of the error body
errorobject · ErrorDetailrequiredWhat went wrong.
5 fields of error
codestringrequiredA stable machine code: branch on this. Each one is explained at
documentation_url.one of
invalid_emailbad_requestunauthorizedforbiddennot_foundconflictpayload_too_largeunsupported_media_typeunprocessable_entitytoo_many_requestsinternal_errorservice_unavailableexample
not_foundmessagestringrequiredWritten for a person, and may change: never branch on it.
example
Not found!documentation_urlstringrequiredWhere this code is explained.
format
uriexamplehttps://hub.main-team.org/api/errors#not_foundrequest_idstringrequiredThis request’s id, also sent as the
X-Request-Idresponse header: the one you sent, when it was acceptable, or else one the API made. Quote it when you report a problem.example
0b5c6d0e-8f7a-4b1c-9d2e-3f4a5b6c7d8edetailsobjectPresent only where an operation says so, and then with the shape that operation documents — the rows it could not accept, say. Treat it as absent everywhere else, and ignore a
detailsyou do not recognise.
429 Too many requests
too_many_requests: Your account has made more than 100 requests to this operation in the current 60-second window. Wait the seconds in Retry-After before sending again.
When
too_many_requestsYour account has made more than 100 requests to this operation in the current 60-second window. Wait the seconds in
Retry-Afterbefore sending again.
Headers
Retry-AfterintegerSeconds to wait before sending again; a request sent sooner is refused too.
Example
{
"error": {
"code": "too_many_requests",
"documentation_url": "https://hub.main-team.org/api/errors#too_many_requests",
"message": "Too many requests to this operation. Wait the number of seconds in Retry-After, then try again.",
"request_id": "0b5c6d0e-8f7a-4b1c-9d2e-3f4a5b6c7d8e"
}
}Fields of the error body
errorobject · ErrorDetailrequiredWhat went wrong.
5 fields of error
codestringrequiredA stable machine code: branch on this. Each one is explained at
documentation_url.one of
invalid_emailbad_requestunauthorizedforbiddennot_foundconflictpayload_too_largeunsupported_media_typeunprocessable_entitytoo_many_requestsinternal_errorservice_unavailableexample
not_foundmessagestringrequiredWritten for a person, and may change: never branch on it.
example
Not found!documentation_urlstringrequiredWhere this code is explained.
format
uriexamplehttps://hub.main-team.org/api/errors#not_foundrequest_idstringrequiredThis request’s id, also sent as the
X-Request-Idresponse header: the one you sent, when it was acceptable, or else one the API made. Quote it when you report a problem.example
0b5c6d0e-8f7a-4b1c-9d2e-3f4a5b6c7d8edetailsobjectPresent only where an operation says so, and then with the shape that operation documents — the rows it could not accept, say. Treat it as absent everywhere else, and ignore a
detailsyou do not recognise.
500 Internal error
internal_error: Something failed on our side. Retry later, and quote request_id if it goes on.
When
internal_errorSomething failed on our side. Retry later, and quote
request_idif it goes on.
Example
{
"error": {
"code": "internal_error",
"documentation_url": "https://hub.main-team.org/api/errors#internal_error",
"message": "An unexpected error occurred.",
"request_id": "0b5c6d0e-8f7a-4b1c-9d2e-3f4a5b6c7d8e"
}
}Fields of the error body
errorobject · ErrorDetailrequiredWhat went wrong.
5 fields of error
codestringrequiredA stable machine code: branch on this. Each one is explained at
documentation_url.one of
invalid_emailbad_requestunauthorizedforbiddennot_foundconflictpayload_too_largeunsupported_media_typeunprocessable_entitytoo_many_requestsinternal_errorservice_unavailableexample
not_foundmessagestringrequiredWritten for a person, and may change: never branch on it.
example
Not found!documentation_urlstringrequiredWhere this code is explained.
format
uriexamplehttps://hub.main-team.org/api/errors#not_foundrequest_idstringrequiredThis request’s id, also sent as the
X-Request-Idresponse header: the one you sent, when it was acceptable, or else one the API made. Quote it when you report a problem.example
0b5c6d0e-8f7a-4b1c-9d2e-3f4a5b6c7d8edetailsobjectPresent only where an operation says so, and then with the shape that operation documents — the rows it could not accept, say. Treat it as absent everywhere else, and ignore a
detailsyou do not recognise.