Students
| Student No. | Name | Program | Year | Section | Status | Actions |
|---|---|---|---|---|---|---|
| Loading... | ||||||
Programs
| Code | Program | Students | Active | Actions |
|---|---|---|---|---|
| Loading... | ||||
Subjects
| Code | Title | Units | Active | Actions |
|---|---|---|---|---|
| Loading... | ||||
Sections
| Name | Program | Year | Adviser | Students | Classes | Active | Actions |
|---|---|---|---|---|---|---|---|
| Loading... | |||||||
Users
New users must change this temporary password on first login.
| Name | Role | Status | Added | Actions | |
|---|---|---|---|---|---|
| Loading... | |||||
Settings
Delete PIN
Checking…
When enabled, a PIN is required to permanently delete students, programs, or users — an extra safeguard against accidental deletion.
API Keys
API keys let external apps and scripts call the data endpoints
(/students, /programs) without logging in — send the key
as an X-API-Key header. Keys can't manage users, settings, or other keys.
| Name | Key | Created | Last used | Actions |
|---|---|---|---|---|
| Loading... | ||||
Audit Log
| When | Actor | Action | Record | IP |
|---|---|---|---|---|
| Loading... | ||||
API Documentation
A REST API returning JSON. Base URL:
http://localhost:4000/api.
Every /students, /programs and /settings
endpoint requires authentication — log in first to get a token (or use the
session cookie from a browser). External apps can instead send an
API key as X-API-Key: aclc_live_… (create one under
API Keys). All examples below use your current server.
Playground
Send a request using your current login session — no token needed. Handy for quickly testing endpoints.
Authentication
Returns the user and a token, and sets an httpOnly session cookie. Use the token as Authorization: Bearer <token> for non-browser clients.
curl -X POST http://localhost:4000/api/auth/login \
-H "Content-Type: application/json" \
-d '{"email":"admin@aclc-ormoc.edu.ph","password":"admin123"}'const res = await fetch("http://localhost:4000/api/auth/login", {
method: "POST",
headers: { "Content-Type": "application/json" },
body: JSON.stringify({ email: "admin@aclc-ormoc.edu.ph", password: "admin123" }),
});
const { token } = await res.json(); // save this tokenStudents
List students (paginated). Returns { data: [...], pagination: {...} }.
| Query param | Example | Notes |
|---|---|---|
search | ?search=cruz | Name, student no., or email |
program | ?program=BS Computer Science | Exact program name |
status | ?status=enrolled | enrolled/graduated/dropped/loa/transferred |
year_level | ?year_level=3 | 1–6 |
sort | ?sort=-created_at | Prefix - for descending |
page | ?page=2 | Default 1 |
limit | ?limit=50 | Default 20, max 100 |
curl "http://localhost:4000/api/students?status=enrolled&limit=20" \
-H "Authorization: Bearer YOUR_TOKEN"const res = await fetch("http://localhost:4000/api/students?search=cruz", {
headers: { "Authorization": `Bearer ${token}` },
});
const { data, pagination } = await res.json();Fetch one student by UUID.
Create a student. Required: student_no, first_name, last_name, program, year_level.
curl -X POST http://localhost:4000/api/students \
-H "Authorization: Bearer YOUR_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"student_no": "2025-01234",
"first_name": "Jose",
"last_name": "Rizal",
"program": "BS Information Technology",
"year_level": 1,
"email": "jose.rizal@aclc-ormoc.edu.ph"
}'Update a student. Send only the fields you want to change. (PUT works the same way.)
Delete a student. If a delete PIN is set (Settings), include header X-Delete-Pin: 1234 — otherwise returns 403.
curl -X DELETE http://localhost:4000/api/students/THE_ID \
-H "Authorization: Bearer YOUR_TOKEN" \
-H "X-Delete-Pin: 1234"Programs
List programs, each with a live student_count. Params: ?search=, ?active=true.
Create a program. Body: { "name": "BS Nursing", "code": "BSN", "active": true } (only name required).
Update. Renaming cascades to all students in that program. Send { "active": false } to deactivate.
Delete a program (blocked with 409 if students are assigned). Honors the delete PIN.
Users & Settings
The current logged-in user.
List users. POST /api/auth/users creates one; DELETE /api/auth/users/:id removes one.
Returns { enabled }. PUT sets/changes it; POST /api/settings/delete-pin/disable turns it off.
Public liveness check (no auth). Returns { status: "ok" }.
Errors
Errors return an HTTP status and a JSON body shaped like this. Common codes:
400 validation, 401 not logged in, 403 wrong/ missing delete PIN,
404 not found, 409 conflict (duplicate / in-use).
{
"error": {
"message": "Validation failed",
"details": [ { "field": "student_no", "message": "Required" } ]
}
}