Support

Write to info@main-team.org for anything about the API: access, roles, errors you cannot explain, security concerns, and feedback on this documentation.

Before you write

Many questions are answered faster here than by email:

• Troubleshooting is organized by symptom and quotes the API's error messages exactly. Search it for the message you received.
• The Errors page explains every error code. The documentation_url in an error links straight to its entry.
• The FAQ covers access, tokens, students, exams, sign-in links, results and limits.
• The changelog says what changed and when.

What to include

One request id is usually enough to find the problem. Put these in your message:

1. The request_id from the error body, or the X-Request-Id header of the response.
2. The time of the request, in UTC.
3. The operation. Give its operationId, for example createApplication, or the method and path.
4. What you received. The HTTP status, error.code and error.message.
5. What you expected, and what you have already checked.
6. Your company name and your apiKey. The key is a public identifier and is safe to share.

A template you can copy:

Subject: [API] 409 on createApplication

Company: Example Schools Ltd
apiKey: key_Q2x5c3RhbGxpbmVfZXhhbXBs
Operation: createApplication — POST /v1/<organizationId>/application
Time (UTC): 2026-10-02 14:03:27
request_id: 7c1e9a52-3f0b-4d8e-9a61-2b5d0c4e8f13
Received: 409 conflict — "Exam is not available for grade 7. It accepts grade 8, 9."
Expected: 201. The exam appeared in the student's available exams list at 14:01 UTC.
Already checked: the student's grade is 7 in GET /v1/student/<studentId>.

Keep students' personal details, such as names, birth dates and addresses, out of your message. Their ids are enough for us to find the records.

Response times

Support hours: to be confirmed.

Account changes

You cannot manage your API account yourself. An operator does it for you. Write to info@main-team.org from a known contact at your organization to ask for any of these:

• New or changed permissions. Name the operations you need, or a profile from Permissions. Changes reach every request within a minute.
• Deactivating the account. Every token stops working within a minute.
• A new account. A new account does not see the students the old account registered, because every student belongs to the account that registered them. Agree with us how to proceed before you switch.
• Access to the client libraries, which are issued with your credentials. See Client libraries.
• Sandbox access. Sandbox accounts are separate from production ones, and an operator issues them on request. See Environments.

Security reports

Write to info@main-team.org with a subject that starts with [Security]. Include:

• what you found,
• how to reproduce it,
• the request ids involved.

Do not include working credentials or real students' data. Please give us a reasonable time to fix the problem before you share it with anyone else.

If your apiSecret may have leaked

1. Ask us to deactivate the account at once. Within a minute, every token signed with that secret stops working.
2. Revoke the tokens you know of with POST /v1/api-account/revoke-token, if it helps you contain the problem. This works only while the account is still active, and only if it holds api/*.
3. Agree the next step with us. Secrets cannot be rotated, so recovery means a new account, and your existing students stay with the old one. See Security.

If a sign-in link or a token leaked

• A token: revoke it. Your secret and your other tokens are unaffected.
• A sign-in link: it works once and for 120 seconds, so by the time you notice, it is almost always used or expired. If you think someone else used it to sign in as a student, tell us, with the time and the request_id of the call that created it.

Service status

• GET /v1/health needs no token and doesn't count against your account's rate limit. It answers 200 while the API is running. Use it for uptime monitoring.
• To check your whole integration, including your token and your roles, call GET /v1/api-account/validate-me.
• Status page: to be confirmed.

Changes and deprecations

We announce changes in the changelog. Before anything is removed:

• it is announced at least 6 months ahead,
• the affected responses carry Deprecation and Sunset headers, and
• removals happen only in a new major version.

Every path stays under /v1 for the whole of version 1. See Versioning.