Skip to main content
The most important integration safety rule in Kralis is that all normal operations must stay inside the current user’s school.

​
Authentication surfaces

  • /auth/ handles login, logout, token lifecycle, password changes, and current user details
  • /graphql/ is the authenticated application API
  • /graphiql/ is the interactive GraphQL explorer

​
School scoping rules for clients

  • use the authenticated user’s returned school context as the operational boundary
  • never assume a valid ID from another school should be accessible
  • avoid building client flows that depend on cross-school data mixing
  • treat school scoping errors as safety signals, not inconveniences to work around

​
REST behavior

The REST resource layer is mainly read-oriented. School-scoped resource URLs use the school acronym in the path and still apply school filtering. Integrations may use different policies such as API keys, but they still operate within a single school’s data boundary.

​
Practical outcome

If a client appears to be missing records, check school context first before assuming the API is incomplete.