REST API (v1)
All primary resources, orgs, users, courses, paths, enrolments, certificates, attestations. Typed OpenAPI 3.1 spec at /api/openapi.json. Rate-limited per tenant (generous).
Developers
An LMS that speaks your stack
ColPort Hall has a typed REST API, signed webhooks, xAPI / Tin Can native emission, SCIM 2.0 provisioning, and OIDC SSO out of the box. Every endpoint is documented in OpenAPI 3.1. Every customer can request a sandbox tenant for free.
Core APIs
Four ways to integrate
Webhooks
Signed webhooks (HMAC-SHA256) on every significant event: enrolment.created, course.completed, certificate.issued, compliance.gap_detected. Retried with exponential back-off for 72 hours.
xAPI statement stream
Every learning event emits xAPI statements in real time. Stream into your own LRS via the outbound webhook or poll the xAPI GET endpoint. SCORM + cmi5 runtime events translate to xAPI too.
SCIM 2.0 + OIDC
Standards-compliant SCIM 2.0 receiver for user provisioning + deprovisioning. OIDC SSO with claim mapping configurable per tenant. SAML 2.0 on Enterprise.
Quickstart
Your first API call, ~60 seconds
After sandbox provisioning, you receive a tenant URL and a personal API token. Replace
$TOKEN and $TENANT below. This call lists the first ten courses in your tenant.curl -X GET "https://$TENANT.hall.colport.io/api/v1/courses?limit=10" \
-H "Authorization: Bearer $TOKEN" \
-H "Accept: application/json"
# Response (trimmed):
# {
# "data": [
# {
# "id": "crs_01H...",
# "title": "GDPR awareness 2026",
# "status": "PUBLISHED",
# "durationMinutes": 25,
# "enrollments_count": 184,
# "createdAt": "2026-01-14T09:42:00Z"
# }
# ],
# "pagination": { "nextCursor": null, "limit": 10 }
# }xAPI example
What a learning event looks like
Every time a learner completes a course, Hall emits an xAPI Statement. Stream these into your LRS, data warehouse, or downstream analytics, whatever consumes JSON-LD.
POST https://your-lrs.example.com/xapi/statements
{
"actor": {
"account": { "homePage": "https://hall.colport.io", "name": "usr_01H..." },
"name": "Jan de Vries"
},
"verb": {
"id": "http://adlnet.gov/expapi/verbs/completed",
"display": { "en": "completed" }
},
"object": {
"id": "https://hall.colport.io/courses/crs_01H...",
"definition": {
"name": { "en": "GDPR awareness 2026" },
"type": "http://adlnet.gov/expapi/activities/course"
}
},
"result": { "score": { "scaled": 0.92, "raw": 46, "max": 50 }, "completion": true, "success": true },
"timestamp": "2026-04-21T14:22:18Z"
}Limits + conventions
What you need to know to build against Hall
Rate limits
1,000 requests/minute/tenant on REST. 10,000 statements/minute on xAPI. Webhook retries do not count against your quota. Enterprise tier raises the ceiling.
Versioning
v1 is stable. Breaking changes ship as v2 with a 12-month parallel-run window. Deprecations announced 90 days ahead with a migration guide.
Auth
Bearer tokens for server-to-server. PAT (personal access tokens) for integrations you build for your own org. OAuth 2.0 for end-user-authorised third parties (Enterprise).
Idempotency
POST endpoints accept an Idempotency-Key header. Duplicates are silently absorbed. Webhook payloads carry a stable event ID, use it to dedupe on your side.
Reference
Where the docs live
OpenAPI 3.1 spec
Available at /api/openapi.json on every tenant. Generates a typed client in any major language via openapi-generator.
Webhook event catalog
Live-edited catalog of every webhook event with payload schemas. Linked from the admin Integrations page.
xAPI profile
ColPort Hall emits a documented xAPI profile, verb extensions, context extensions, activity types. Useful if you’re normalising to a shared LRS across tools.
Sandbox tenants
Free sandbox tenant (unlimited test seats, full feature set, reset-weekly) on request. Ideal for CI integration tests.
Ready to build?
Email devs@colport.io with your use-case + a rough architecture. We turn around sandbox credentials within 1 business day.
Request a demo