Autonomous University of Madrid

UAM Moodle — LTI 1.3 Platform and Web Services

UAM self-hosts two Moodle learning platforms, Grado 2026/27 at moodle.uam.es and Posgrado at posgrado.uam.es, both acting as LTI 1.3 / LTI Advantage platforms. Each publishes live public signing keys at /mod/lti/certs.php (RS256 RSA, kid 3ef1afab74110b0d11ed on the Grado instance), an OIDC authorization endpoint at /mod/lti/auth.php and an access-token service at /mod/lti/token.php that returns a well-formed OAuth error to an unsigned request. The Moodle web services REST endpoint is enabled and answering with a Moodle invalidtoken exception, meaning tokens exist but are issued only by UAM administrators. Recorded as one surface rather than split per protocol: it is one deployment, and splitting it would inflate the footprint the way this cohort was inflated before.

Documentation GitHub

Documentation

📖

Authentication

https://raw.githubusercontent.com/api-evangelist/uam/refs/heads/main/authentication/uam-authentication.yml

Other Resources

🔗

JWKS

https://moodle.uam.es/mod/lti/certs.php

🔗

Examples

https://raw.githubusercontent.com/api-evangelist/uam/refs/heads/main/examples/uam-moodle-lti-jwks-example.json

🔗

Conformance

https://raw.githubusercontent.com/api-evangelist/uam/refs/heads/main/conformance/uam-conformance.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this

find_apisBrowse and filter every API in the catalog.
get_api_artifactsOne API's artifacts, grouped by type.
get_openapiThe primary OpenAPI for this API.
find_similar_apisAPIs that look like this one.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This API

curl "https://apis.io/api/v1/apis/moodle-lti"

All apis

curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

API entry from apis.yml

aid: uam:moodle-lti
name: UAM Moodle — LTI 1.3 Platform and Web Services
description: 'UAM self-hosts two Moodle learning platforms, Grado 2026/27 at moodle.uam.es and Posgrado
  at posgrado.uam.es, both acting as LTI 1.3 / LTI Advantage platforms. Each publishes live public signing
  keys at /mod/lti/certs.php (RS256 RSA, kid 3ef1afab74110b0d11ed on the Grado instance), an OIDC authorization
  endpoint at /mod/lti/auth.php and an access-token service at /mod/lti/token.php that returns a well-formed
  OAuth error to an unsigned request. The Moodle web services REST endpoint is enabled and answering with
  a Moodle invalidtoken exception, meaning tokens exist but are issued only by UAM administrators. Recorded
  as one surface rather than split per protocol: it is one deployment, and splitting it would inflate
  the footprint the way this cohort was inflated before.'
humanURL: https://moodle.uam.es/
baseURL: https://moodle.uam.es/mod/lti/
tags:
- Learning Management
- Moodle
- LTI
- LTI Advantage
- JWKS
- Course Delivery
- Gated
properties:
- type: JWKS
  url: https://moodle.uam.es/mod/lti/certs.php
- type: Examples
  url: examples/uam-moodle-lti-jwks-example.json
- type: Authentication
  url: authentication/uam-authentication.yml
- type: Conformance
  url: conformance/uam-conformance.yml
x-operator: institution
x-operator-evidence: moodle.uam.es 150.244.214.5 and posgrado.uam.es 150.244.214.56, both in UAM's own
  RIPE allocation with no CNAME. The signing keys are generated by UAM's own installation, not a shared
  vendor document.
x-access: gated
x-status: 200 application/json JWKS; token endpoint 400 invalid_request on unsigned POST (probed 2026-09-01)