# Support

> How to reach Main Team about the API, what to include so we can help quickly, how to report a security problem, and how account changes are requested.

Write to **[info@main-team.org](mailto:info@main-team.org)** for anything about the API: access, roles, errors you cannot explain, security concerns, and feedback on this documentation.

## Before you write

Many questions are answered faster here than by email:

- [Troubleshooting](https://hub.main-team.org/api/troubleshooting) is organized by symptom and quotes the API's error messages exactly. Search it for the message you received.
- The [Errors](https://hub.main-team.org/api/errors) page explains every error code. The `documentation_url` in an error links straight to its entry.
- The [FAQ](https://hub.main-team.org/api/faq) covers access, tokens, students, exams, sign-in links, results and limits.
- The [changelog](https://hub.main-team.org/api/changelog) says what changed and when.

## What to include

One request id is usually enough to find the problem. Put these in your message:

1. **The `request_id`** from the error body, or the `X-Request-Id` header of the response.
2. **The time of the request, in UTC.**
3. **The operation.** Give its operationId, for example `createApplication`, or the method and path.
4. **What you received.** The HTTP status, `error.code` and `error.message`.
5. **What you expected**, and what you have already checked.
6. **Your company name and your `apiKey`.** The key is a public identifier and is safe to share.

A template you can copy:

```text
Subject: [API] 409 on createApplication

Company: Example Schools Ltd
apiKey: key_Q2x5c3RhbGxpbmVfZXhhbXBs
Operation: createApplication — POST /v1/<organizationId>/application
Time (UTC): 2026-10-02 14:03:27
request_id: 7c1e9a52-3f0b-4d8e-9a61-2b5d0c4e8f13
Received: 409 conflict — "Exam is not available for grade 7. It accepts grade 8, 9."
Expected: 201. The exam appeared in the student's available exams list at 14:01 UTC.
Already checked: the student's grade is 7 in GET /v1/student/<studentId>.
```

Never send your `apiSecret`, a token, a sign-in link URL or a student's password, to us or anyone else. We will never ask for them. If you have sent one by mistake, revoke the token with [`POST /v1/api-account/revoke-token`](https://hub.main-team.org/api/reference/revoke-token), treat the link as used, and tell us if it was the secret.

Keep students' personal details, such as names, birth dates and addresses, out of your message. Their ids are enough for us to find the records.

## Response times

| Kind of request | First response | Notes |
|---|---|---|
| Production outage: every request fails | [to be confirmed] | Include several request ids and times. |
| Integration blocked: one operation fails for all students | [to be confirmed] | |
| Question, or a single failing request | [to be confirmed] | |
| Account changes: roles, new account, deactivation | [to be confirmed] | Role changes take effect within a minute once an operator saves them. |
| Security report | [to be confirmed] | See below. |

Support hours: [to be confirmed].

## Account changes

You cannot manage your API account yourself. An operator does it for you. Write to [info@main-team.org](mailto:info@main-team.org) from a known contact at your organization to ask for any of these:

- **New or changed permissions.** Name the operations you need, or a profile from [Permissions](https://hub.main-team.org/api/permissions). Changes reach every request within a minute.
- **Deactivating the account.** Every token stops working within a minute.
- **A new account.** A new account does not see the students the old account registered, because every student belongs to the account that registered them. Agree with us how to proceed before you switch.
- **Access to the client libraries**, which are issued with your credentials. See [Client libraries](https://hub.main-team.org/api/clients).
- **Sandbox access.** Sandbox accounts are separate from production ones, and an operator issues them on request. See [Environments](https://hub.main-team.org/api/environments#sandbox).

## Security reports

Write to [info@main-team.org](mailto:info@main-team.org) with a subject that starts with **`[Security]`**. Include:

- what you found,
- how to reproduce it,
- the request ids involved.

Do not include working credentials or real students' data. Please give us a reasonable time to fix the problem before you share it with anyone else.

### If your apiSecret may have leaked

1. **Ask us to deactivate the account at once.** Within a minute, every token signed with that secret stops working.
2. **Revoke the tokens you know of** with [`POST /v1/api-account/revoke-token`](https://hub.main-team.org/api/reference/revoke-token), if it helps you contain the problem. This works only while the account is still active, and only if it holds `api/*`.
3. **Agree the next step with us.** Secrets cannot be rotated, so recovery means a new account, and your existing students stay with the old one. See [Security](https://hub.main-team.org/api/security).

### If a sign-in link or a token leaked

- **A token**: revoke it. Your secret and your other tokens are unaffected.
- **A sign-in link**: it works once and for 120 seconds, so by the time you notice, it is almost always used or expired. If you think someone else used it to sign in as a student, tell us, with the time and the `request_id` of the call that created it.

## Service status

- [`GET /v1/health`](https://hub.main-team.org/api/reference/get-health) needs no token and doesn't count against your account's rate limit. It answers `200` while the API is running. Use it for uptime monitoring.
- To check your whole integration, including your token and your roles, call [`GET /v1/api-account/validate-me`](https://hub.main-team.org/api/reference/get-current-api-account).
- Status page: [to be confirmed].

## Changes and deprecations

We announce changes in the [changelog](https://hub.main-team.org/api/changelog). Before anything is removed:

- it is announced at least **6 months** ahead,
- the affected responses carry `Deprecation` and `Sunset` headers, and
- removals happen only in a new major version.

Every path stays under `/v1` for the whole of version 1. See [Versioning](https://hub.main-team.org/api/versioning).