PandA Learning Support System API (Sakai Entity Broker + IMS LTI)

openapi: 3.2.0
info:
  title: Kyoto University PandA (Sakai) LMS API
  description: "Machine-readable interfaces of PandA (Panda: People and Networked Digital Assets), the Kyoto University Learning Support System operated by the Institute for Information Management and Communication (IIMC). PandA is a Sakai deployment running on Kyoto University's own host panda.ecs.kyoto-u.ac.jp, linked from the IIMC's own education service page.\nTwo anonymous, machine-readable surfaces are described, and only paths and shapes verified live against the running system on 2026-08-19 are included:\n1. The Sakai Entity Broker REST layer under /direct, which self-describes at /direct/describe\n   (53 entity prefixes registered) and answers `application/json` on the public prefixes with\n   no credential. Anonymous callers receive an empty collection for user-scoped entities; the\n   tool registry is fully public and returned 96 registered tools.\n2. The IMS/1EdTech LTI endpoints — an LTI 1.3 (LTI Advantage) platform JWKS at\n   /imsblis/lti13/keyset serving three RS256 signing keys, and the LTI 1.1 Basic Outcomes\n   service at /imsblis/service/, which answers with an IMS `message_response` envelope.\n\nNo credentialed call was made and no authentication was attempted. Endpoints that require a session are documented by the status they return to an anonymous caller (400/401/403), which is the observed public contract, not an inferred one."
  version: 1.0.0
  contact:
    name: Institute for Information Management and Communication (IIMC), Kyoto University
    url: https://www.iimc.kyoto-u.ac.jp/en/inquiry
  x-operator: institution
  x-operator-evidence: panda.ecs.kyoto-u.ac.jp is under Kyoto University's own registrable domain kyoto-u.ac.jp and is published by the IIMC as the university's Learning Support Service at https://www.iimc.kyoto-u.ac.jp/en/services/education/lms. Sakai is open-source software the university self-deploys, not a hosted vendor tenancy; the host, the tool registry and the LTI platform keys are Kyoto University's.
  x-provenance:
    generated: '2026-08-19'
    method: probed
    source: Written by API Evangelist from live anonymous probes of https://panda.ecs.kyoto-u.ac.jp on 2026-08-19. Kyoto University publishes no OpenAPI for this surface.
    operator: institution
servers:
- url: https://panda.ecs.kyoto-u.ac.jp
  description: PandA — Kyoto University Learning Support System (Sakai)
tags:
- name: LMS
  description: PandA learning-management surfaces — the Sakai Entity Broker REST layer and the IMS LTI platform endpoints.
paths:
  /direct/describe:
    get:
      tags:
      - LMS
      operationId: describeEntities
      summary: Self-describing index of every registered entity prefix
      description: 'Returns the Sakai Entity Broker''s own HTML description of every registered entity prefix and the operations each supports. Verified 2026-08-19: 200, text/html, 53 prefixes registered (announcement, assignment, calendar, content, forum, lessons, lti, poll, sam_core, session, site, syllabus, tool, user, wiki and others).'
      responses:
        '200':
          description: HTML description of all registered entity prefixes.
          content:
            text/html:
              schema:
                type: string
  /direct/tool.json:
    get:
      tags:
      - LMS
      operationId: listTools
      summary: List every tool registered in the PandA installation
      description: 'Public, unauthenticated read. Verified 2026-08-19: 200, application/json, 96 registered tools returned with id, title, description, categories, keywords and required functions. This is the one Entity Broker collection that returns substantive data to an anonymous caller.'
      responses:
        '200':
          description: Tool registry.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ToolCollection'
  /direct/site.json:
    get:
      tags:
      - LMS
      operationId: listSites
      summary: List course and project sites visible to the caller
      description: 'Verified 2026-08-19: 200, application/json, `site_collection` empty for an anonymous caller. Site membership is session-scoped; no course data is exposed without credentials.'
      responses:
        '200':
          description: Site collection, scoped to the caller's session.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EntityCollection'
  /direct/syllabus.json:
    get:
      tags:
      - LMS
      operationId: listSyllabus
      summary: List syllabus entries visible to the caller
      description: 'Verified 2026-08-19: 200, application/json, empty collection for an anonymous caller.'
      responses:
        '200':
          description: Syllabus collection, scoped to the caller's session.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EntityCollection'
  /direct/announcement.json:
    get:
      tags:
      - LMS
      operationId: listAnnouncements
      summary: List announcements visible to the caller
      description: 'Verified 2026-08-19: 200, application/json, empty collection for an anonymous caller.'
      responses:
        '200':
          description: Announcement collection, scoped to the caller's session.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EntityCollection'
  /direct/calendar.json:
    get:
      tags:
      - LMS
      operationId: listCalendarEntries
      summary: List calendar entries visible to the caller
      description: 'Verified 2026-08-19: 200, application/json, empty collection for an anonymous caller.'
      responses:
        '200':
          description: Calendar collection, scoped to the caller's session.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EntityCollection'
  /direct/assignment.json:
    get:
      tags:
      - LMS
      operationId: listAssignments
      summary: List assignments visible to the caller
      description: 'Verified 2026-08-19: 200, application/json, empty collection for an anonymous caller.'
      responses:
        '200':
          description: Assignment collection, scoped to the caller's session.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EntityCollection'
  /direct/content.json:
    get:
      tags:
      - LMS
      operationId: listContent
      summary: List content resources visible to the caller
      description: 'Verified 2026-08-19: 200, application/json, empty collection for an anonymous caller.'
      responses:
        '200':
          description: Content collection, scoped to the caller's session.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EntityCollection'
  /direct/lti.json:
    get:
      tags:
      - LMS
      operationId: listLtiTools
      summary: List LTI tool registrations visible to the caller
      description: 'Verified 2026-08-19: 200, application/json, empty collection for an anonymous caller. The prefix exists because PandA runs the Sakai LTI (basiclti) service as an LTI platform.'
      responses:
        '200':
          description: LTI registration collection, scoped to the caller's session.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EntityCollection'
  /direct/session.json:
    get:
      tags:
      - LMS
      operationId: getSession
      summary: Describe the caller's current Sakai session
      description: 'Verified 2026-08-19: 200, application/json. An anonymous caller receives a session object with creationTime, currentTime and an `active` flag; no user identity is disclosed.'
      responses:
        '200':
          description: Session collection for the calling client.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EntityCollection'
  /direct/user.json:
    get:
      tags:
      - LMS
      operationId: listUsers
      summary: List users (privileged)
      description: 'Documented for its access boundary, not for anonymous use. Verified 2026-08-19: an anonymous GET returns 403 Forbidden with a Tomcat error page. The directory is closed.'
      responses:
        '403':
          description: Forbidden — the caller holds no session with user-directory permission.
          content:
            text/html:
              schema:
                type: string
  /direct/poll.json:
    get:
      tags:
      - LMS
      operationId: listPolls
      summary: List polls (session required)
      description: 'Documented for its access boundary. Verified 2026-08-19: an anonymous GET returns 401 Unauthorized.'
      responses:
        '401':
          description: Unauthorized — an authenticated Sakai session is required.
          content:
            text/html:
              schema:
                type: string
  /direct/membership.json:
    get:
      tags:
      - LMS
      operationId: listMemberships
      summary: List site memberships (parameters required)
      description: 'Documented for its access boundary. Verified 2026-08-19: an anonymous GET with no parameters returns 400 Bad Request.'
      responses:
        '400':
          description: Bad Request — required parameters were not supplied.
          content:
            text/html:
              schema:
                type: string
  /imsblis/lti13/keyset:
    get:
      tags:
      - LMS
      operationId: getLti13Keyset
      summary: LTI 1.3 (LTI Advantage) platform JWKS
      description: 'Public JSON Web Key Set for PandA acting as an LTI 1.3 platform. Verified 2026-08-19: 200, application/json, three RSA keys, all use=sig alg=RS256, each with a kid. This is the machine-readable evidence that Kyoto University operates an LTI Advantage platform of its own.'
      responses:
        '200':
          description: JSON Web Key Set.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Jwks'
  /imsblis/service/:
    get:
      tags:
      - LMS
      operationId: ltiBasicOutcomesService
      summary: IMS LTI 1.1 Basic Outcomes service endpoint
      description: 'The LTI 1.1 Basic Outcomes (grade passback) service. Verified 2026-08-19 with a GET and no body: 200 with an IMS `message_response` XML envelope reporting codemajor=Fail, description="Not a valid service request: lti_message_type:null" — i.e. the endpoint is live and speaking IMS LTI. In production use the service is called with POST and an imsx_POXEnvelopeRequest body signed with OAuth 1.0a; that path was NOT exercised here.'
      responses:
        '200':
          description: IMS POX `message_response` envelope.
          content:
            application/xml:
              schema:
                type: string
components:
  schemas:
    ToolCollection:
      type: object
      required:
      - entityPrefix
      - tool_collection
      properties:
        entityPrefix:
          type: string
          example: tool
        tool_collection:
          type: array
          items:
            $ref: '#/components/schemas/Tool'
    Tool:
      type: object
      description: A tool registered in the PandA (Sakai) installation.
      required:
      - id
      - title
      properties:
        id:
          type: string
          example: sakai-site-group-manager
        title:
          type: string
          example: Group Manager Helper
        description:
          type: string
          example: Site Group Manager Helper Tool
        access:
          type: string
          example: portal
        categories:
          type: array
          items:
            type: string
          example:
          - sakai.helper
        keywords:
          type: array
          items:
            type: string
        home:
          type:
          - string
          - 'null'
        finalConfig:
          type: object
          additionalProperties: true
        mutableConfig:
          type: object
          additionalProperties: true
        registeredConfig:
          type: object
          additionalProperties: true
        entityId:
          type: string
        entityReference:
          type: string
          example: /tool/sakai-site-group-manager
        entityURL:
          type: string
          format: uri
        entityTitle:
          type: string
    Jwk:
      type: object
      required:
      - kty
      - kid
      - alg
      - use
      - n
      - e
      properties:
        kty:
          type: string
          example: RSA
        e:
          type: string
          example: AQAB
        use:
          type: string
          example: sig
        kid:
          type: string
        alg:
          type: string
          example: RS256
        n:
          type: string
          description: RSA modulus, base64url-encoded.
    Jwks:
      type: object
      required:
      - keys
      properties:
        keys:
          type: array
          items:
            $ref: '#/components/schemas/Jwk'
    EntityCollection:
      type: object
      description: The generic Sakai Entity Broker envelope. Every /direct/<prefix>.json response carries the prefix and a collection array named "<prefix>_collection".
      required:
      - entityPrefix
      properties:
        entityPrefix:
          type: string
          description: The registered entity prefix that produced this response.
          example: site
      additionalProperties:
        type: array
        items:
          type: object