Link one of your students to a supervisor on this organization
- Bearer token
- Permission
student/update - Per organization
Attaches the student to a supervisor of this organization, found by supervisorUsername. Any supervisor of this organization can be linked.
The link is made on this organization only. Each organization keeps its own record of a student and the link is written there, so the student’s records on other organizations are left as they were. Neither getStudent nor getOrgStudent shows it: both read the record you registered. The link stays when the student signs in again. Linking another supervisor replaces the first on this organization, and repeating a link changes nothing.
The student has to have signed in to this organization once, with a link from createSigninLink. That first sign-in is when the organization creates its record of them, and before it there is nothing to link.
Every refusal is the same 404, Not found!: a student who is not yours, a student this organization has no record of yet, a username nobody has here, and one whose owner is not a supervisor here. The answer never says which, and never repeats the username. A malformed studentId, or a supervisorUsername that is missing or empty, is a 400; one of spaces only is the 404.
Answers with the organization’s slug; this organization’s record of the student after the link, whose _id is this organization’s own id for the student and whose mainId is the id you use everywhere else; and the supervisor’s id and username.
Parameters
Path parameters
| Name | Type | Description |
|---|---|---|
organizationIdrequired | stringpattern ^[0-9a-f]{24}$ | The organization’s Example |
studentIdrequired | string | The student’s id ( |
Request body
supervisorUsernamestringrequiredThe username of a supervisor on this organization, as they sign in with it. Letter case and surrounding spaces do not matter.
example
XXT1003
Responses
200 OK
Success: message is "Student linked to supervisor successfully.".
Body
successbooleanrequiredAlways
trueon a success.one of
truemessagestringrequiredexample
Student linked to supervisor successfully.dataobject · SupervisorLinkResponserequiredA supervisor link, made on one organization only: the other organizations’ records of the student are left as they were.
3 fields of data
organizationstringrequiredThe
slugof the organization the link was made on.example
stemstudentobject · StudentRecordResponserequiredThe organization’s own copy of the student, after the link. Its
_idis that organization’s id for the student, andmainIdis the id you use everywhere else.supervisoris the supervisor’s id in the organization, and the other references are ids as that organization stores them.20 fields of student
_idstringrequiredThe student’s id: what every
studentIdpath parameter and body field takes.example
6650a1b2c3d4e5f6a7b8c9d0mainIdstringOnly on an organization’s own copy of a student, which
linkStudentSupervisoranswers with: there it is the student’s id, and_idis the organization’s own. Absent on every other operation.example
6650a1b2c3d4e5f6a7b8c9d0usernamestringrequiredIssued at registration, never chosen by you: the country’s two-letter code, a letter, then a number. It is how the student signs in and how support refers to the account.
example
XXB1045firstNamestringrequiredThe student’s first name.
example
JanelastNamestringrequiredThe student’s surname.
example
DoefullNamestringrequiredfirstNameandlastNamejoined by a space, kept in step when either changes.example
Jane DoeemailstringrequiredThe student’s email address, in lower case.
example
jane.doe@example.comemailConfirmedbooleanrequiredWhether the student has confirmed
email. It startsfalse, only the student can make ittrue, and changingemailsets it back tofalse. Once it istrue,setStudentPasswordis refused: the account is the student’s.example
falsephonestringA phone number, as you sent it.
example
+1 555 0100birthstringDate of birth,
DD/MM/YYYY.example
14/05/2008sexstringm,forn.one of
mfnexample
fcountrystringThe id of the student’s country.
example
6650a1b2c3d4e5f6a7b8c9d1citystringThe id of the student’s city. A city you sent by name is stored as the id it resolved to.
example
6650a1b2c3d4e5f6a7b8c9d2schoolstringThe id of the student’s school. A school you sent by name is stored as the id it resolved to.
example
6650a1b2c3d4e5f6a7b8c9d3gradestringThe id of the student’s grade. A grade you sent by name is stored as the id it resolved to.
example
6650a1b2c3d4e5f6a7b8c9d4supervisorstringThe id of the student’s supervisor, when one is attached.
example
6650a1b2c3d4e5f6a7b8c9d5partnerstringThe id of the student’s partner, when one is attached.
example
6650a1b2c3d4e5f6a7b8c9d6activatedPlatformsThisSeasonarray of stringrequiredThe organizations the student is active on this season, by
slug;commonmeans every organization. Registration setscommonunless you send a list. The organization-scoped student operations see a student only when this lists that organization orcommon, and updating a student through one adds that organization.example
["common"]createdAtstringrequiredWhen the student was registered.
format
date-timeexample2026-09-01T09:30:00.000ZupdatedAtstringrequiredWhen the record last changed.
format
date-timeexample2026-09-02T14:05:00.000Z
supervisorobject · LinkedSupervisorResponserequiredThe supervisor the student is now linked to.
2 fields of supervisor
_idstringrequiredThe supervisor’s id in this organization.
example
6650a1b2c3d4e5f6a7b8c9d5usernamestringrequiredThe supervisor’s username, in capitals.
example
XXT1003
Headers
X-RateLimit-LimitintegerRequests your account may make to this operation per window (100).
X-RateLimit-RemainingintegerRequests left in the current window.
X-RateLimit-ResetintegerSeconds until the current window ends.
Example
{
"success": true,
"message": "Student linked to supervisor successfully.",
"data": {
"organization": "stem",
"student": {
"_id": "6650a1b2c3d4e5f6a7b8c9d0",
"mainId": "6650a1b2c3d4e5f6a7b8c9d0",
"username": "XXB1045",
"firstName": "Jane",
"lastName": "Doe",
"fullName": "Jane Doe",
"email": "jane.doe@example.com",
"emailConfirmed": false,
"phone": "+1 555 0100",
"birth": "14/05/2008",
"sex": "f",
"country": "6650a1b2c3d4e5f6a7b8c9d1",
"city": "6650a1b2c3d4e5f6a7b8c9d2",
"school": "6650a1b2c3d4e5f6a7b8c9d3",
"grade": "6650a1b2c3d4e5f6a7b8c9d4",
"supervisor": "6650a1b2c3d4e5f6a7b8c9d5",
"partner": "6650a1b2c3d4e5f6a7b8c9d6",
"activatedPlatformsThisSeason": [
"common"
],
"createdAt": "2026-09-01T09:30:00.000Z",
"updatedAt": "2026-09-02T14:05:00.000Z"
},
"supervisor": {
"_id": "6650a1b2c3d4e5f6a7b8c9d5",
"username": "XXT1003"
}
}
}400 Bad request
bad_request: The body is not valid JSON, breaks a field’s rules, or has a field this operation does not accept ("property <name> should not exist").bad_request:studentIdis not a well-formed id.
When
bad_requestThe body is not valid JSON, breaks a field’s rules, or has a field this operation does not accept ("property <name> should not exist").
bad_requeststudentIdis not a well-formed id.
Example
{
"error": {
"code": "bad_request",
"documentation_url": "https://hub.main-team.org/api/errors#bad_request",
"message": "The request was malformed or contained invalid parameters.",
"request_id": "0b5c6d0e-8f7a-4b1c-9d2e-3f4a5b6c7d8e"
}
}Fields of the error body
errorobject · ErrorDetailrequiredWhat went wrong.
5 fields of error
codestringrequiredA stable machine code: branch on this. Each one is explained at
documentation_url.one of
invalid_emailbad_requestunauthorizedforbiddennot_foundconflictpayload_too_largeunsupported_media_typeunprocessable_entitytoo_many_requestsinternal_errorservice_unavailableexample
not_foundmessagestringrequiredWritten for a person, and may change: never branch on it.
example
Not found!documentation_urlstringrequiredWhere this code is explained.
format
uriexamplehttps://hub.main-team.org/api/errors#not_foundrequest_idstringrequiredThis request’s id, also sent as the
X-Request-Idresponse header: the one you sent, when it was acceptable, or else one the API made. Quote it when you report a problem.example
0b5c6d0e-8f7a-4b1c-9d2e-3f4a5b6c7d8edetailsobjectPresent only where an operation says so, and then with the shape that operation documents — the rows it could not accept, say. Treat it as absent everywhere else, and ignore a
detailsyou do not recognise.
401 Unauthorized
unauthorized: The token is missing or malformed, is not signed with your account’s apiSecret, breaks the iat and exp rules, has expired or been revoked, or its account is not active. All of these answer the same.
When
unauthorizedThe token is missing or malformed, is not signed with your account’s
apiSecret, breaks theiatandexprules, has expired or been revoked, or its account is not active. All of these answer the same.
Example
{
"error": {
"code": "unauthorized",
"documentation_url": "https://hub.main-team.org/api/errors#unauthorized",
"message": "Authentication is required or the provided credentials are invalid.",
"request_id": "0b5c6d0e-8f7a-4b1c-9d2e-3f4a5b6c7d8e"
}
}Fields of the error body
errorobject · ErrorDetailrequiredWhat went wrong.
5 fields of error
codestringrequiredA stable machine code: branch on this. Each one is explained at
documentation_url.one of
invalid_emailbad_requestunauthorizedforbiddennot_foundconflictpayload_too_largeunsupported_media_typeunprocessable_entitytoo_many_requestsinternal_errorservice_unavailableexample
not_foundmessagestringrequiredWritten for a person, and may change: never branch on it.
example
Not found!documentation_urlstringrequiredWhere this code is explained.
format
uriexamplehttps://hub.main-team.org/api/errors#not_foundrequest_idstringrequiredThis request’s id, also sent as the
X-Request-Idresponse header: the one you sent, when it was acceptable, or else one the API made. Quote it when you report a problem.example
0b5c6d0e-8f7a-4b1c-9d2e-3f4a5b6c7d8edetailsobjectPresent only where an operation says so, and then with the shape that operation documents — the rows it could not accept, say. Treat it as absent everywhere else, and ignore a
detailsyou do not recognise.
403 Forbidden
forbidden: The token is valid, but no role on your account allows student/update on the organization in the path, or a role denies it.
When
forbiddenThe token is valid, but no role on your account allows
student/updateon the organization in the path, or a role denies it.
Example
{
"error": {
"code": "forbidden",
"documentation_url": "https://hub.main-team.org/api/errors#forbidden",
"message": "Insufficient role permissions",
"request_id": "0b5c6d0e-8f7a-4b1c-9d2e-3f4a5b6c7d8e"
}
}Fields of the error body
errorobject · ErrorDetailrequiredWhat went wrong.
5 fields of error
codestringrequiredA stable machine code: branch on this. Each one is explained at
documentation_url.one of
invalid_emailbad_requestunauthorizedforbiddennot_foundconflictpayload_too_largeunsupported_media_typeunprocessable_entitytoo_many_requestsinternal_errorservice_unavailableexample
not_foundmessagestringrequiredWritten for a person, and may change: never branch on it.
example
Not found!documentation_urlstringrequiredWhere this code is explained.
format
uriexamplehttps://hub.main-team.org/api/errors#not_foundrequest_idstringrequiredThis request’s id, also sent as the
X-Request-Idresponse header: the one you sent, when it was acceptable, or else one the API made. Quote it when you report a problem.example
0b5c6d0e-8f7a-4b1c-9d2e-3f4a5b6c7d8edetailsobjectPresent only where an operation says so, and then with the shape that operation documents — the rows it could not accept, say. Treat it as absent everywhere else, and ignore a
detailsyou do not recognise.
404 Not found
not_found:organizationIdis not the_idof an organization.not_found: Any refusal: the student is not yours, this organization has no record of them yet (they have never signed in to it), or no supervisor of this organization has this username.
When
Example
{
"error": {
"code": "not_found",
"documentation_url": "https://hub.main-team.org/api/errors#not_found",
"message": "Organization not found!",
"request_id": "0b5c6d0e-8f7a-4b1c-9d2e-3f4a5b6c7d8e"
}
}Fields of the error body
errorobject · ErrorDetailrequiredWhat went wrong.
5 fields of error
codestringrequiredA stable machine code: branch on this. Each one is explained at
documentation_url.one of
invalid_emailbad_requestunauthorizedforbiddennot_foundconflictpayload_too_largeunsupported_media_typeunprocessable_entitytoo_many_requestsinternal_errorservice_unavailableexample
not_foundmessagestringrequiredWritten for a person, and may change: never branch on it.
example
Not found!documentation_urlstringrequiredWhere this code is explained.
format
uriexamplehttps://hub.main-team.org/api/errors#not_foundrequest_idstringrequiredThis request’s id, also sent as the
X-Request-Idresponse header: the one you sent, when it was acceptable, or else one the API made. Quote it when you report a problem.example
0b5c6d0e-8f7a-4b1c-9d2e-3f4a5b6c7d8edetailsobjectPresent only where an operation says so, and then with the shape that operation documents — the rows it could not accept, say. Treat it as absent everywhere else, and ignore a
detailsyou do not recognise.
413 Payload too large
payload_too_large: The body is larger than 100 kB.
When
payload_too_largeThe body is larger than 100 kB.
Example
{
"error": {
"code": "payload_too_large",
"documentation_url": "https://hub.main-team.org/api/errors#payload_too_large",
"message": "request entity too large",
"request_id": "0b5c6d0e-8f7a-4b1c-9d2e-3f4a5b6c7d8e"
}
}Fields of the error body
errorobject · ErrorDetailrequiredWhat went wrong.
5 fields of error
codestringrequiredA stable machine code: branch on this. Each one is explained at
documentation_url.one of
invalid_emailbad_requestunauthorizedforbiddennot_foundconflictpayload_too_largeunsupported_media_typeunprocessable_entitytoo_many_requestsinternal_errorservice_unavailableexample
not_foundmessagestringrequiredWritten for a person, and may change: never branch on it.
example
Not found!documentation_urlstringrequiredWhere this code is explained.
format
uriexamplehttps://hub.main-team.org/api/errors#not_foundrequest_idstringrequiredThis request’s id, also sent as the
X-Request-Idresponse header: the one you sent, when it was acceptable, or else one the API made. Quote it when you report a problem.example
0b5c6d0e-8f7a-4b1c-9d2e-3f4a5b6c7d8edetailsobjectPresent only where an operation says so, and then with the shape that operation documents — the rows it could not accept, say. Treat it as absent everywhere else, and ignore a
detailsyou do not recognise.
415 Unsupported media type
unsupported_media_type: The body declares a charset that is not a UTF one (send UTF-8), or a Content-Encoding other than gzip, deflate or br.
When
unsupported_media_typeThe body declares a charset that is not a UTF one (send UTF-8), or a
Content-Encodingother than gzip, deflate or br.
Example
{
"error": {
"code": "unsupported_media_type",
"documentation_url": "https://hub.main-team.org/api/errors#unsupported_media_type",
"message": "unsupported charset \"ISO-8859-1\"",
"request_id": "0b5c6d0e-8f7a-4b1c-9d2e-3f4a5b6c7d8e"
}
}Fields of the error body
errorobject · ErrorDetailrequiredWhat went wrong.
5 fields of error
codestringrequiredA stable machine code: branch on this. Each one is explained at
documentation_url.one of
invalid_emailbad_requestunauthorizedforbiddennot_foundconflictpayload_too_largeunsupported_media_typeunprocessable_entitytoo_many_requestsinternal_errorservice_unavailableexample
not_foundmessagestringrequiredWritten for a person, and may change: never branch on it.
example
Not found!documentation_urlstringrequiredWhere this code is explained.
format
uriexamplehttps://hub.main-team.org/api/errors#not_foundrequest_idstringrequiredThis request’s id, also sent as the
X-Request-Idresponse header: the one you sent, when it was acceptable, or else one the API made. Quote it when you report a problem.example
0b5c6d0e-8f7a-4b1c-9d2e-3f4a5b6c7d8edetailsobjectPresent only where an operation says so, and then with the shape that operation documents — the rows it could not accept, say. Treat it as absent everywhere else, and ignore a
detailsyou do not recognise.
429 Too many requests
too_many_requests: Your account has made more than 100 requests to this operation in the current 60-second window. Wait the seconds in Retry-After before sending again.
When
too_many_requestsYour account has made more than 100 requests to this operation in the current 60-second window. Wait the seconds in
Retry-Afterbefore sending again.
Headers
Retry-AfterintegerSeconds to wait before sending again; a request sent sooner is refused too.
Example
{
"error": {
"code": "too_many_requests",
"documentation_url": "https://hub.main-team.org/api/errors#too_many_requests",
"message": "Too many requests to this operation. Wait the number of seconds in Retry-After, then try again.",
"request_id": "0b5c6d0e-8f7a-4b1c-9d2e-3f4a5b6c7d8e"
}
}Fields of the error body
errorobject · ErrorDetailrequiredWhat went wrong.
5 fields of error
codestringrequiredA stable machine code: branch on this. Each one is explained at
documentation_url.one of
invalid_emailbad_requestunauthorizedforbiddennot_foundconflictpayload_too_largeunsupported_media_typeunprocessable_entitytoo_many_requestsinternal_errorservice_unavailableexample
not_foundmessagestringrequiredWritten for a person, and may change: never branch on it.
example
Not found!documentation_urlstringrequiredWhere this code is explained.
format
uriexamplehttps://hub.main-team.org/api/errors#not_foundrequest_idstringrequiredThis request’s id, also sent as the
X-Request-Idresponse header: the one you sent, when it was acceptable, or else one the API made. Quote it when you report a problem.example
0b5c6d0e-8f7a-4b1c-9d2e-3f4a5b6c7d8edetailsobjectPresent only where an operation says so, and then with the shape that operation documents — the rows it could not accept, say. Treat it as absent everywhere else, and ignore a
detailsyou do not recognise.
500 Internal error
internal_error: Something failed on our side. Retry later, and quote request_id if it goes on.
When
internal_errorSomething failed on our side. Retry later, and quote
request_idif it goes on.
Example
{
"error": {
"code": "internal_error",
"documentation_url": "https://hub.main-team.org/api/errors#internal_error",
"message": "An unexpected error occurred.",
"request_id": "0b5c6d0e-8f7a-4b1c-9d2e-3f4a5b6c7d8e"
}
}Fields of the error body
errorobject · ErrorDetailrequiredWhat went wrong.
5 fields of error
codestringrequiredA stable machine code: branch on this. Each one is explained at
documentation_url.one of
invalid_emailbad_requestunauthorizedforbiddennot_foundconflictpayload_too_largeunsupported_media_typeunprocessable_entitytoo_many_requestsinternal_errorservice_unavailableexample
not_foundmessagestringrequiredWritten for a person, and may change: never branch on it.
example
Not found!documentation_urlstringrequiredWhere this code is explained.
format
uriexamplehttps://hub.main-team.org/api/errors#not_foundrequest_idstringrequiredThis request’s id, also sent as the
X-Request-Idresponse header: the one you sent, when it was acceptable, or else one the API made. Quote it when you report a problem.example
0b5c6d0e-8f7a-4b1c-9d2e-3f4a5b6c7d8edetailsobjectPresent only where an operation says so, and then with the shape that operation documents — the rows it could not accept, say. Treat it as absent everywhere else, and ignore a
detailsyou do not recognise.