List your students’ applications for one exam

GET

/v1/{organizationId}/application/exam-applications/{examId}

Bearer token
Permissionapplication/read
Per organization

Lists your students’ applications for one exam, with payment and the student (user) resolved into records. exam stays the id you asked about. It covers the same students as listApplications.

A page at a time: limit is 20 by default and at most 100. No order is guaranteed, so to take a complete snapshot walk every page and remove duplicates by _id.

The exam itself is not looked up: an id that matches no exam answers an empty list rather than 404, and past sittings work too.

Parameters

Path parameters

Name	Type	Description
`organizationId`required	stringpattern `^[0-9a-f]{24}$`	The organization’s `_id`: 24 hexadecimal digits, as `listOrganizations` (`GET /v1/organization`) lists it. Example `64b7f0c2a1d3e4f5a6b7c8d9`
`examId`required	string	The exam’s `_id` in this organization, from `listExams`, `listAvailableExams` or an application’s `exam`.

Query parameters

Name	Type	Description
`page`optional	number	Page number. Defaults to 1. Example `1`
`limit`optional	number	Items per page. Defaults to 20, max 100. Example `20`

Responses

200 OK

Success: message is "Applications fetched successfully.".

Body

successbooleanrequired
Always true on a success.
one oftrue
messagestringrequired
exampleApplications fetched successfully.
paginationobject · PaginationMetarequired
Where one page sits in the whole list.
4 fields of pagination
- pagenumberrequired
  The page returned, counting from 1.
  min1example1
- limitnumberrequired
  Items per page: the limit you sent, 20 if you sent none, and never more than 100.
  min1max100example20
- totalnumberrequired
  Items across every page.
  min0example57
- totalPagesnumberrequired
  Pages at this limit: total / limit, rounded up.
  min0example3
dataarray of ExamApplicationResponserequired
16 fields of each item
- _idstringrequired
  The application’s id: what applicationId takes.
  example6650a1b2c3d4e5f6a7b8c9e5
- examstringrequired
  The id of the exam applied for: the one you asked about.
  example6650a1b2c3d4e5f6a7b8c9e1
- userobject · StudentRefResponserequired
  The student the application is for.
  4 fields of user
  _idstringrequired
  The organization’s own id for the student. It differs from the id you registered them with: match on mainId.
  example6650a1b2c3d4e5f6a7b8c9e9
  mainIdstringrequired
  The student’s id: the one you registered them with, and what every studentId takes.
  example6650a1b2c3d4e5f6a7b8c9d0
  firstNamestring
  The student’s first name.
  exampleJane
  lastNamestring
  The student’s surname.
  exampleDoe
- paymentobject · PaymentResponsenullable
  The application’s payment. null if the stored reference no longer resolves; absent when none is set.
  8 fields of payment
  _idstringrequired
  The payment’s id.
  example6650a1b2c3d4e5f6a7b8c9e6
  statusstringrequired
  pending: not paid yet. paid: settled; a free exam’s payment is paid from the start, with amount 0. canceled: will not be paid. An application whose payment is paid with an amount above 0 cannot be deleted, and can move only to an exam of the same price.
  one ofpendingpaidcanceled
  examplepending
  amountnumber
  What is due, or was paid, as a number; no currency is given. 0 for a free exam. Moving an unpaid application to another exam changes it to that exam’s price.
  example25
  applicationstring
  The id of the application it pays for.
  example6650a1b2c3d4e5f6a7b8c9e5
  examstring
  The id of the exam it pays for.
  example6650a1b2c3d4e5f6a7b8c9e1
  forstring
  The organization’s own id for the student it is for.
  example6650a1b2c3d4e5f6a7b8c9e9
  createdAtstring
  When the payment was created.
  formatdate-timeexample2026-09-01T09:30:00.000Z
  updatedAtstring
  When the payment last changed.
  formatdate-timeexample2026-09-02T14:05:00.000Z
- partnersarray of ApplicationPartnerResponserequired
  On a team exam, the other members of the team. Empty for an exam sat alone.
  2 fields of each item
  userstring
  The team member’s id in this organization. Not one of your students’ ids, and not resolved.
  example6650a1b2c3d4e5f6a7b8c9d6
  acceptedboolean
  Whether they have accepted the invitation to the team.
  exampletrue
- participatedbooleanrequired
  Whether the student has started the exam. A started application cannot be moved to another exam.
  examplefalse
- examStartstring
  When the student started the exam; absent until then.
  formatdate-timeexample2026-11-14T10:04:12.000Z
- examSubmittedboolean
  Whether the student has handed the exam in. A handed-in application cannot be moved to another exam.
  examplefalse
- submitDatestring
  When the student handed the exam in; absent until then.
  formatdate-timeexample2026-11-14T11:12:40.000Z
- simulationStartedbooleanrequired
  Whether the student has started the practice run.
  examplefalse
- simulationStartstring
  When the student started the practice run; absent until then.
  formatdate-timeexample2026-11-07T10:00:00.000Z
- simulationSubmittedbooleanrequired
  Whether the student has handed the practice run in.
  examplefalse
- removeAfterstring
  Only on an application to an exam on a make-up sitting: when it will be removed, 6 hours after it was made.
  formatdate-timeexample2026-09-02T14:05:00.000Z
- uuidstringrequired
  A short reference code for the application.
  examplea3f-09c-7e1
- createdAtstringrequired
  When the application was made.
  formatdate-timeexample2026-09-01T09:30:00.000Z
- updatedAtstringrequired
  When the application last changed.
  formatdate-timeexample2026-09-02T14:05:00.000Z

Headers

X-RateLimit-Limit integer: Requests your account may make to this operation per window (100).
X-RateLimit-Remaining integer: Requests left in the current window.
X-RateLimit-Reset integer: Seconds until the current window ends.

Example

{
  "success": true,
  "message": "Applications fetched successfully.",
  "pagination": {
    "page": 1,
    "limit": 20,
    "total": 57,
    "totalPages": 3
  },
  "data": [
    {
      "_id": "6650a1b2c3d4e5f6a7b8c9e5",
      "exam": "6650a1b2c3d4e5f6a7b8c9e1",
      "user": {
        "_id": "6650a1b2c3d4e5f6a7b8c9e9",
        "mainId": "6650a1b2c3d4e5f6a7b8c9d0",
        "firstName": "Jane",
        "lastName": "Doe"
      },
      "payment": {
        "_id": "6650a1b2c3d4e5f6a7b8c9e6",
        "status": "pending",
        "amount": 25,
        "application": "6650a1b2c3d4e5f6a7b8c9e5",
        "exam": "6650a1b2c3d4e5f6a7b8c9e1",
        "for": "6650a1b2c3d4e5f6a7b8c9e9",
        "createdAt": "2026-09-01T09:30:00.000Z",
        "updatedAt": "2026-09-02T14:05:00.000Z"
      },
      "partners": [
        {
          "user": "6650a1b2c3d4e5f6a7b8c9d6",
          "accepted": true
        }
      ],
      "participated": false,
      "examStart": "2026-11-14T10:04:12.000Z",
      "examSubmitted": false,
      "submitDate": "2026-11-14T11:12:40.000Z",
      "simulationStarted": false,
      "simulationStart": "2026-11-07T10:00:00.000Z",
      "simulationSubmitted": false,
      "removeAfter": "2026-09-02T14:05:00.000Z",
      "uuid": "a3f-09c-7e1",
      "createdAt": "2026-09-01T09:30:00.000Z",
      "updatedAt": "2026-09-02T14:05:00.000Z"
    }
  ]
}

400 Bad request

bad_request: examId is not 24 hexadecimal digits.

When

bad_request
examId is not 24 hexadecimal digits.

Example

{
  "error": {
    "code": "bad_request",
    "documentation_url": "https://hub.main-team.org/api/errors#bad_request",
    "message": "Invalid value for 'exam': expected ObjectId.",
    "request_id": "0b5c6d0e-8f7a-4b1c-9d2e-3f4a5b6c7d8e"
  }
}

Fields of the error body

errorobject · ErrorDetailrequired
What went wrong.
5 fields of error
- codestringrequired
  A stable machine code: branch on this. Each one is explained at documentation_url.
  one ofinvalid_emailbad_requestunauthorizedforbiddennot_foundconflictpayload_too_largeunsupported_media_typeunprocessable_entitytoo_many_requestsinternal_errorservice_unavailable
  examplenot_found
- messagestringrequired
  Written for a person, and may change: never branch on it.
  exampleNot found!
- documentation_urlstringrequired
  Where this code is explained.
  formaturiexamplehttps://hub.main-team.org/api/errors#not_found
- request_idstringrequired
  This request’s id, also sent as the X-Request-Id response header: the one you sent, when it was acceptable, or else one the API made. Quote it when you report a problem.
  example0b5c6d0e-8f7a-4b1c-9d2e-3f4a5b6c7d8e
- detailsobject
  Present only where an operation says so, and then with the shape that operation documents — the rows it could not accept, say. Treat it as absent everywhere else, and ignore a details you do not recognise.

401 Unauthorized

unauthorized: The token is missing or malformed, is not signed with your account’s apiSecret, breaks the iat and exp rules, has expired or been revoked, or its account is not active. All of these answer the same.

When

unauthorized
The token is missing or malformed, is not signed with your account’s apiSecret, breaks the iat and exp rules, has expired or been revoked, or its account is not active. All of these answer the same.

Example

{
  "error": {
    "code": "unauthorized",
    "documentation_url": "https://hub.main-team.org/api/errors#unauthorized",
    "message": "Authentication is required or the provided credentials are invalid.",
    "request_id": "0b5c6d0e-8f7a-4b1c-9d2e-3f4a5b6c7d8e"
  }
}

Fields of the error body

errorobject · ErrorDetailrequired
What went wrong.
5 fields of error
- codestringrequired
  A stable machine code: branch on this. Each one is explained at documentation_url.
  one ofinvalid_emailbad_requestunauthorizedforbiddennot_foundconflictpayload_too_largeunsupported_media_typeunprocessable_entitytoo_many_requestsinternal_errorservice_unavailable
  examplenot_found
- messagestringrequired
  Written for a person, and may change: never branch on it.
  exampleNot found!
- documentation_urlstringrequired
  Where this code is explained.
  formaturiexamplehttps://hub.main-team.org/api/errors#not_found
- request_idstringrequired
  This request’s id, also sent as the X-Request-Id response header: the one you sent, when it was acceptable, or else one the API made. Quote it when you report a problem.
  example0b5c6d0e-8f7a-4b1c-9d2e-3f4a5b6c7d8e
- detailsobject
  Present only where an operation says so, and then with the shape that operation documents — the rows it could not accept, say. Treat it as absent everywhere else, and ignore a details you do not recognise.

403 Forbidden

forbidden: The token is valid, but no role on your account allows application/read on the organization in the path, or a role denies it.

When

forbidden
The token is valid, but no role on your account allows application/read on the organization in the path, or a role denies it.

Example

{
  "error": {
    "code": "forbidden",
    "documentation_url": "https://hub.main-team.org/api/errors#forbidden",
    "message": "Insufficient role permissions",
    "request_id": "0b5c6d0e-8f7a-4b1c-9d2e-3f4a5b6c7d8e"
  }
}

Fields of the error body

errorobject · ErrorDetailrequired
What went wrong.
5 fields of error
- codestringrequired
  A stable machine code: branch on this. Each one is explained at documentation_url.
  one ofinvalid_emailbad_requestunauthorizedforbiddennot_foundconflictpayload_too_largeunsupported_media_typeunprocessable_entitytoo_many_requestsinternal_errorservice_unavailable
  examplenot_found
- messagestringrequired
  Written for a person, and may change: never branch on it.
  exampleNot found!
- documentation_urlstringrequired
  Where this code is explained.
  formaturiexamplehttps://hub.main-team.org/api/errors#not_found
- request_idstringrequired
  This request’s id, also sent as the X-Request-Id response header: the one you sent, when it was acceptable, or else one the API made. Quote it when you report a problem.
  example0b5c6d0e-8f7a-4b1c-9d2e-3f4a5b6c7d8e
- detailsobject
  Present only where an operation says so, and then with the shape that operation documents — the rows it could not accept, say. Treat it as absent everywhere else, and ignore a details you do not recognise.

404 Not found

not_found: organizationId is not the _id of an organization.

When

not_found
organizationId is not the _id of an organization.

Example

{
  "error": {
    "code": "not_found",
    "documentation_url": "https://hub.main-team.org/api/errors#not_found",
    "message": "Organization not found!",
    "request_id": "0b5c6d0e-8f7a-4b1c-9d2e-3f4a5b6c7d8e"
  }
}

Fields of the error body

errorobject · ErrorDetailrequired
What went wrong.
5 fields of error
- codestringrequired
  A stable machine code: branch on this. Each one is explained at documentation_url.
  one ofinvalid_emailbad_requestunauthorizedforbiddennot_foundconflictpayload_too_largeunsupported_media_typeunprocessable_entitytoo_many_requestsinternal_errorservice_unavailable
  examplenot_found
- messagestringrequired
  Written for a person, and may change: never branch on it.
  exampleNot found!
- documentation_urlstringrequired
  Where this code is explained.
  formaturiexamplehttps://hub.main-team.org/api/errors#not_found
- request_idstringrequired
  This request’s id, also sent as the X-Request-Id response header: the one you sent, when it was acceptable, or else one the API made. Quote it when you report a problem.
  example0b5c6d0e-8f7a-4b1c-9d2e-3f4a5b6c7d8e
- detailsobject
  Present only where an operation says so, and then with the shape that operation documents — the rows it could not accept, say. Treat it as absent everywhere else, and ignore a details you do not recognise.

429 Too many requests

too_many_requests: Your account has made more than 100 requests to this operation in the current 60-second window. Wait the seconds in Retry-After before sending again.

When

too_many_requests
Your account has made more than 100 requests to this operation in the current 60-second window. Wait the seconds in Retry-After before sending again.

Headers

Retry-After integer: Seconds to wait before sending again; a request sent sooner is refused too.

Example

{
  "error": {
    "code": "too_many_requests",
    "documentation_url": "https://hub.main-team.org/api/errors#too_many_requests",
    "message": "Too many requests to this operation. Wait the number of seconds in Retry-After, then try again.",
    "request_id": "0b5c6d0e-8f7a-4b1c-9d2e-3f4a5b6c7d8e"
  }
}

Fields of the error body

errorobject · ErrorDetailrequired
What went wrong.
5 fields of error
- codestringrequired
  A stable machine code: branch on this. Each one is explained at documentation_url.
  one ofinvalid_emailbad_requestunauthorizedforbiddennot_foundconflictpayload_too_largeunsupported_media_typeunprocessable_entitytoo_many_requestsinternal_errorservice_unavailable
  examplenot_found
- messagestringrequired
  Written for a person, and may change: never branch on it.
  exampleNot found!
- documentation_urlstringrequired
  Where this code is explained.
  formaturiexamplehttps://hub.main-team.org/api/errors#not_found
- request_idstringrequired
  This request’s id, also sent as the X-Request-Id response header: the one you sent, when it was acceptable, or else one the API made. Quote it when you report a problem.
  example0b5c6d0e-8f7a-4b1c-9d2e-3f4a5b6c7d8e
- detailsobject
  Present only where an operation says so, and then with the shape that operation documents — the rows it could not accept, say. Treat it as absent everywhere else, and ignore a details you do not recognise.

500 Internal error

internal_error: Something failed on our side. Retry later, and quote request_id if it goes on.

When

internal_error
Something failed on our side. Retry later, and quote request_id if it goes on.

Example

{
  "error": {
    "code": "internal_error",
    "documentation_url": "https://hub.main-team.org/api/errors#internal_error",
    "message": "An unexpected error occurred.",
    "request_id": "0b5c6d0e-8f7a-4b1c-9d2e-3f4a5b6c7d8e"
  }
}

Fields of the error body

errorobject · ErrorDetailrequired
What went wrong.
5 fields of error
- codestringrequired
  A stable machine code: branch on this. Each one is explained at documentation_url.
  one ofinvalid_emailbad_requestunauthorizedforbiddennot_foundconflictpayload_too_largeunsupported_media_typeunprocessable_entitytoo_many_requestsinternal_errorservice_unavailable
  examplenot_found
- messagestringrequired
  Written for a person, and may change: never branch on it.
  exampleNot found!
- documentation_urlstringrequired
  Where this code is explained.
  formaturiexamplehttps://hub.main-team.org/api/errors#not_found
- request_idstringrequired
  This request’s id, also sent as the X-Request-Id response header: the one you sent, when it was acceptable, or else one the API made. Quote it when you report a problem.
  example0b5c6d0e-8f7a-4b1c-9d2e-3f4a5b6c7d8e
- detailsobject
  Present only where an operation says so, and then with the shape that operation documents — the rows it could not accept, say. Treat it as absent everywhere else, and ignore a details you do not recognise.

List your students’ applications for one exam

Parameters

Path parameters

Query parameters

Responses

Example request

Try it