> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kralis.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Auth and School Scoping

> How Kralis authentication works, which APIs are primary, and how school scoping must be enforced.

The most important integration safety rule in Kralis is that all normal
operations must stay inside the current user's school.

## Authentication surfaces

* `/auth/` handles login, logout, token lifecycle, password changes, and current
  user details
* `/graphql/` is the authenticated application API
* `/graphiql/` is the interactive GraphQL explorer

## School scoping rules for clients

* use the authenticated user's returned school context as the operational
  boundary
* never assume a valid ID from another school should be accessible
* avoid building client flows that depend on cross-school data mixing
* treat school scoping errors as safety signals, not inconveniences to work
  around

## REST behavior

The REST resource layer is mainly read-oriented. School-scoped resource URLs use
the school acronym in the path and still apply school filtering.

Integrations may use different policies such as API keys, but they still operate
within a single school's data boundary.

## Practical outcome

If a client appears to be missing records, check school context first before
assuming the API is incomplete.