Students & Faculty API
Last updated August 2, 2026
This reference is generated from the current Express route definitions and their handlers. It documents route-level authentication and authorization; deployment-wide middleware may add further checks.
Conventions
- Base API origin:
https://api.classgrid.in - Authentication: authenticated routes use the Classgrid session/JWT recognized by
isAuthenticated. - JSON is the default request and response format unless an endpoint explicitly accepts multipart data or redirects.
- Path parameters are always required.
- A field marked
nomeans the static handler scan did not find a direct required-field check; business rules may still make it conditionally required. - Role checks can also accept
super_adminthrough the shared authorization middleware where implemented.
This document contains 31 route definitions from 4 source files.
student.routes.js
Mounted at: /api/student
POST /api/student/send-onboarding-otp
Auth: isAuthenticated
Roles: Any authenticated user, subject to organization, plan, and feature middleware listed below.
Middleware: isAuthenticated
What it does: Sends the requested information.
Path parameters: None detected in the route or handler.
Query parameters: None detected in the route or handler.
Body: None detected in the route or handler.
Response: JSON response fields observed in the handler include message. Explicit status codes include 429, 500. Please wait 60 seconds before requesting a new code.
Source: server/src/routes/student.routes.js:16; handler inline handler in server/src/routes/student.routes.js.
POST /api/student/verify-onboarding-otp
Auth: isAuthenticated
Roles: Any authenticated user, subject to organization, plan, and feature middleware listed below.
Middleware: isAuthenticated
What it does: Verifies the supplied information.
Path parameters: None detected in the route or handler.
Query parameters: None detected in the route or handler.
Body:
Response: JSON response fields observed in the handler include message, verified. Explicit status codes include 400, 429, 500. Verification code is required.
Source: server/src/routes/student.routes.js:66; handler inline handler in server/src/routes/student.routes.js.
POST /api/student/onboarding
Auth: isAuthenticated, requireOrganization, attachInstitutionProfile()
Roles: Any authenticated user, subject to organization, plan, and feature middleware listed below.
Middleware: isAuthenticated, requireOrganization, attachInstitutionProfile()
What it does: Creates or processes onboarding.
Path parameters: None detected in the route or handler.
Query parameters: None detected in the route or handler.
Body:
Response: JSON response fields observed in the handler include message, student. Explicit status codes include 400, 409, 500. You do not belong to any organization.
Source: server/src/routes/student.routes.js:102; handler inline handler in server/src/routes/student.routes.js.
GET /api/student/profile
Auth: isAuthenticated
Roles: Any authenticated user, subject to organization, plan, and feature middleware listed below.
Middleware: isAuthenticated
What it does: Retrieves profile.
Path parameters: None detected in the route or handler.
Query parameters: None detected in the route or handler.
Body: None detected in the route or handler.
Response: JSON response fields observed in the handler include student, message. Explicit status codes include 500. Failed to load student profile.
Source: server/src/routes/student.routes.js:243; handler inline handler in server/src/routes/student.routes.js.
GET /api/student/academic-history
Auth: isAuthenticated
Roles: Any authenticated user, subject to organization, plan, and feature middleware listed below.
Middleware: isAuthenticated
What it does: Retrieves academic history.
Path parameters: None detected in the route or handler.
Query parameters: None detected in the route or handler.
Body: None detected in the route or handler.
Response: JSON response fields observed in the handler include history, message. Explicit status codes include 500. Failed to fetch academic history.
Source: server/src/routes/student.routes.js:267; handler inline handler in server/src/routes/student.routes.js.
PUT /api/student/academic-history
Auth: isAuthenticated
Roles: Any authenticated user, subject to organization, plan, and feature middleware listed below.
Middleware: isAuthenticated
What it does: Upsert one qualification record (SSC, HSC, CET, etc.). Updates academic history.
Path parameters: None detected in the route or handler.
Query parameters: None detected in the route or handler.
Body:
Response: JSON response fields observed in the handler include message, record. Explicit status codes include 400, 500. No organization found.
Source: server/src/routes/student.routes.js:290; handler inline handler in server/src/routes/student.routes.js.
DELETE /api/student/academic-history/:qual_type
Auth: isAuthenticated
Roles: Any authenticated user, subject to organization, plan, and feature middleware listed below.
Middleware: isAuthenticated
What it does: Deletes academic history.
Path parameters:
Query parameters: None detected in the route or handler.
Body: None detected in the route or handler.
Response: JSON response fields observed in the handler include message. Explicit status codes include 500. Record deleted.
Source: server/src/routes/student.routes.js:341; handler inline handler in server/src/routes/student.routes.js.
GET /api/student/address
Auth: isAuthenticated
Roles: Any authenticated user, subject to organization, plan, and feature middleware listed below.
Middleware: isAuthenticated
What it does: Retrieves address.
Path parameters: None detected in the route or handler.
Query parameters: None detected in the route or handler.
Body: None detected in the route or handler.
Response: JSON response fields observed in the handler include address, message. Explicit status codes include 500. Failed to fetch address.
Source: server/src/routes/student.routes.js:367; handler inline handler in server/src/routes/student.routes.js.
PUT /api/student/address
Auth: isAuthenticated
Roles: Any authenticated user, subject to organization, plan, and feature middleware listed below.
Middleware: isAuthenticated
What it does: Updates address.
Path parameters: None detected in the route or handler.
Query parameters: None detected in the route or handler.
Body:
Response: JSON response fields observed in the handler include message, address. Explicit status codes include 400, 500. No organization found.
Source: server/src/routes/student.routes.js:387; handler inline handler in server/src/routes/student.routes.js.
GET /api/student/onboarding-progress
Auth: isAuthenticated
Roles: Any authenticated user, subject to organization, plan, and feature middleware listed below.
Middleware: isAuthenticated
What it does: Retrieves onboarding progress.
Path parameters: None detected in the route or handler.
Query parameters: None detected in the route or handler.
Body: None detected in the route or handler.
Response: JSON response fields observed in the handler include steps, completed, total, percentage, message. Explicit status codes include 500. Failed to compute onboarding progress.
Source: server/src/routes/student.routes.js:439; handler inline handler in server/src/routes/student.routes.js.
POST /api/student/batch-import
Auth: isAuthenticated
Roles: Any authenticated user, subject to organization, plan, and feature middleware listed below.
Middleware: isAuthenticated
What it does: Creates or processes batch import.
Path parameters: None detected in the route or handler.
Query parameters: None detected in the route or handler.
Body:
Response: JSON response fields observed in the handler include message. Explicit status codes include 400, 403, 500. Only org admins can batch import students.
Source: server/src/routes/student.routes.js:508; handler inline handler in server/src/routes/student.routes.js.
GET /api/student/dashboard/summary
Auth: isAuthenticated, requireOrganization, attachInstitutionProfile()
Roles: Any authenticated user, subject to organization, plan, and feature middleware listed below.
Middleware: isAuthenticated, requireOrganization, attachInstitutionProfile()
What it does: Get student dashboard data.
Path parameters: None detected in the route or handler.
Query parameters: None detected in the route or handler.
Body: None detected in the route or handler.
Response: JSON response fields observed in the handler include success, message, data. Explicit status codes include 200, 400, 500. Missing required organization or user context.
Source: server/src/routes/student.routes.js:604; handler getStudentDashboardData in server/src/controllers/student-dashboard.controller.js.
student-profile.routes.js
Mounted at: /api/student-profile
GET /api/student-profile/family
Auth: isAuthenticated
Roles: Any authenticated user, subject to organization, plan, and feature middleware listed below.
Middleware: isAuthenticated
What it does: Retrieves family.
Path parameters: None detected in the route or handler.
Query parameters: None detected in the route or handler.
Body: None detected in the route or handler.
Response: JSON response fields observed in the handler include familyInfo, message. Explicit status codes include 500. Server error
Source: server/src/routes/student-profile.routes.js:11; handler inline handler in server/src/routes/student-profile.routes.js.
PUT /api/student-profile/family
Auth: isAuthenticated
Roles: Any authenticated user, subject to organization, plan, and feature middleware listed below.
Middleware: isAuthenticated
What it does: Updates family.
Path parameters: None detected in the route or handler.
Query parameters: None detected in the route or handler.
Body:
Response: JSON response fields observed in the handler include message, familyInfo. Explicit status codes include 500. Family info saved
Source: server/src/routes/student-profile.routes.js:28; handler inline handler in server/src/routes/student-profile.routes.js.
GET /api/student-profile/qualifications
Auth: isAuthenticated
Roles: Any authenticated user, subject to organization, plan, and feature middleware listed below.
Middleware: isAuthenticated
What it does: Retrieves qualifications.
Path parameters: None detected in the route or handler.
Query parameters: None detected in the route or handler.
Body: None detected in the route or handler.
Response: JSON response fields observed in the handler include qualifications, message. Explicit status codes include 500. Server error
Source: server/src/routes/student-profile.routes.js:58; handler inline handler in server/src/routes/student-profile.routes.js.
PUT /api/student-profile/qualifications
Auth: isAuthenticated
Roles: Any authenticated user, subject to organization, plan, and feature middleware listed below.
Middleware: isAuthenticated
What it does: Updates qualifications.
Path parameters: None detected in the route or handler.
Query parameters: None detected in the route or handler.
Body:
Response: JSON response fields observed in the handler include message, qualification. Explicit status codes include 400, 500. Qualification type is required
Source: server/src/routes/student-profile.routes.js:74; handler inline handler in server/src/routes/student-profile.routes.js.
DELETE /api/student-profile/qualifications/:id
Auth: isAuthenticated
Roles: Any authenticated user, subject to organization, plan, and feature middleware listed below.
Middleware: isAuthenticated
What it does: Deletes qualifications.
Path parameters:
Query parameters: None detected in the route or handler.
Body: None detected in the route or handler.
Response: JSON response fields observed in the handler include message. Explicit status codes include 500. Qualification deleted
Source: server/src/routes/student-profile.routes.js:105; handler inline handler in server/src/routes/student-profile.routes.js.
GET /api/student-profile/documents
Auth: isAuthenticated
Roles: Any authenticated user, subject to organization, plan, and feature middleware listed below.
Middleware: isAuthenticated
What it does: Retrieves documents.
Path parameters: None detected in the route or handler.
Query parameters: None detected in the route or handler.
Body: None detected in the route or handler.
Response: JSON response fields observed in the handler include documents, message. Explicit status codes include 500. Server error
Source: server/src/routes/student-profile.routes.js:125; handler inline handler in server/src/routes/student-profile.routes.js.
PUT /api/student-profile/documents
Auth: isAuthenticated
Roles: Any authenticated user, subject to organization, plan, and feature middleware listed below.
Middleware: isAuthenticated
What it does: Updates documents.
Path parameters: None detected in the route or handler.
Query parameters: None detected in the route or handler.
Body:
Response: JSON response fields observed in the handler include message, document. Explicit status codes include 400, 500. Doc type and URL required
Source: server/src/routes/student-profile.routes.js:141; handler inline handler in server/src/routes/student-profile.routes.js.
DELETE /api/student-profile/documents/:doc_type
Auth: isAuthenticated
Roles: Any authenticated user, subject to organization, plan, and feature middleware listed below.
Middleware: isAuthenticated
What it does: Deletes documents.
Path parameters:
Query parameters: None detected in the route or handler.
Body: None detected in the route or handler.
Response: JSON response fields observed in the handler include message. Explicit status codes include 500. Document deleted
Source: server/src/routes/student-profile.routes.js:168; handler inline handler in server/src/routes/student-profile.routes.js.
PUT /api/student-profile/compliance
Auth: isAuthenticated
Roles: Any authenticated user, subject to organization, plan, and feature middleware listed below.
Middleware: isAuthenticated
What it does: Update student compliance.
Path parameters: None detected in the route or handler.
Query parameters: None detected in the route or handler.
Body:
Response: JSON response fields observed in the handler include error, success, message, user. Explicit status codes include 404, 500.
Source: server/src/routes/student-profile.routes.js:188; handler updateStudentCompliance in server/src/controllers/student-compliance.controller.js.
faculty.routes.js
Mounted at: /api/faculty
GET /api/faculty/dashboard/summary
Auth: isAuthenticated, requireOrganization, attachInstitutionProfile()
Roles: Any authenticated user, subject to organization, plan, and feature middleware listed below.
Middleware: isAuthenticated, requireOrganization, attachInstitutionProfile()
What it does: Get faculty dashboard data.
Path parameters: None detected in the route or handler.
Query parameters: None detected in the route or handler.
Body: None detected in the route or handler.
Response: JSON response fields observed in the handler include success, message, data. Explicit status codes include 200, 400, 500. Missing required organization or user context.
Source: server/src/routes/faculty.routes.js:12; handler getFacultyDashboardData in server/src/controllers/faculty-dashboard.controller.js.
user.routes.js
Mounted at: /api/user
GET /api/user/profile-schema
Auth: isAuthenticated
Roles: Any authenticated user, subject to organization, plan, and feature middleware listed below.
Middleware: isAuthenticated
What it does: Retrieves profile schema.
Path parameters: None detected in the route or handler.
Query parameters: None detected in the route or handler.
Body: None detected in the route or handler.
Response: JSON response fields observed in the handler include schema, message. Explicit status codes include 500. Server error getting schema
Source: server/src/routes/user.routes.js:19; handler inline handler in server/src/routes/user.routes.js.
GET /api/user/profile
Auth: isAuthenticated
Roles: Any authenticated user, subject to organization, plan, and feature middleware listed below.
Middleware: isAuthenticated
What it does: Retrieves profile.
Path parameters: None detected in the route or handler.
Query parameters: None detected in the route or handler.
Body: None detected in the route or handler.
Response: JSON response fields observed in the handler include message. Explicit status codes include 404, 500. User not found
Source: server/src/routes/user.routes.js:41; handler inline handler in server/src/routes/user.routes.js.
PUT /api/user/update
Auth: isAuthenticated, attachInstitutionProfile({required:false})
Roles: Any authenticated user, subject to organization, plan, and feature middleware listed below.
Middleware: isAuthenticated, attachInstitutionProfile({required:false})
What it does: Updates update.
Path parameters: None detected in the route or handler.
Query parameters: None detected in the route or handler.
Body:
Response: JSON response fields observed in the handler include message, user, error. Explicit status codes include 400, 404, 409, 500. Name cannot be empty
Source: server/src/routes/user.routes.js:143; handler inline handler in server/src/routes/user.routes.js.
POST /api/user/upload-url
Auth: isAuthenticated
Roles: Any authenticated user, subject to organization, plan, and feature middleware listed below.
Middleware: isAuthenticated
What it does: Uploads the supplied resource.
Path parameters: None detected in the route or handler.
Query parameters: None detected in the route or handler.
Body:
Response: JSON response fields observed in the handler include message, uploadUrl, publicUrl. Explicit status codes include 400, 500. Filename and file type are required
Source: server/src/routes/user.routes.js:465; handler inline handler in server/src/routes/user.routes.js.
GET /api/user/email-preferences
Auth: isAuthenticated
Roles: Any authenticated user, subject to organization, plan, and feature middleware listed below.
Middleware: isAuthenticated
What it does: Retrieves email preferences.
Path parameters: None detected in the route or handler.
Query parameters: None detected in the route or handler.
Body: None detected in the route or handler.
Response: JSON response fields observed in the handler include message, emailNotifications. Explicit status codes include 404, 500. User not found
Source: server/src/routes/user.routes.js:487; handler inline handler in server/src/routes/user.routes.js.
PUT /api/user/email-preferences
Auth: isAuthenticated
Roles: Any authenticated user, subject to organization, plan, and feature middleware listed below.
Middleware: isAuthenticated
What it does: Updates email preferences.
Path parameters: None detected in the route or handler.
Query parameters: None detected in the route or handler.
Body:
Response: JSON response fields observed in the handler include message, emailNotifications. Explicit status codes include 400, 404, 500. No valid preferences provided
Source: server/src/routes/user.routes.js:515; handler inline handler in server/src/routes/user.routes.js.
POST /api/user/fcm-token
Auth: isAuthenticated
Roles: Any authenticated user, subject to organization, plan, and feature middleware listed below.
Middleware: isAuthenticated
What it does: Creates or processes fcm token.
Path parameters: None detected in the route or handler.
Query parameters: None detected in the route or handler.
Body:
Response: JSON response fields observed in the handler include message. Explicit status codes include 400, 500. Token is required
Source: server/src/routes/user.routes.js:558; handler inline handler in server/src/routes/user.routes.js.
POST /api/user/divisions
Auth: isAuthenticated
Roles: Any authenticated user, subject to organization, plan, and feature middleware listed below.
Middleware: isAuthenticated
What it does: Creates or processes divisions.
Path parameters: None detected in the route or handler.
Query parameters: None detected in the route or handler.
Body:
Response: JSON response fields observed in the handler include message. Explicit status codes include 400, 409, 500. User does not belong to any organization.
Source: server/src/routes/user.routes.js:578; handler inline handler in server/src/routes/user.routes.js.
GET /api/user/my-teaching-roles
Auth: isAuthenticated
Roles: Any authenticated user, subject to organization, plan, and feature middleware listed below.
Middleware: isAuthenticated
What it does: Retrieves my teaching roles.
Path parameters: None detected in the route or handler.
Query parameters: None detected in the route or handler.
Body: None detected in the route or handler.
Response: JSON response fields observed in the handler include message, classTeacher, assistantTeacher, subjectTeacher. Explicit status codes include 400, 403, 500. Only faculty can access this.
Source: server/src/routes/user.routes.js:676; handler inline handler in server/src/routes/user.routes.js.