Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/Saurabh-07586/examplatform/llms.txt

Use this file to discover all available pages before exploring further.

ExamPlatform uses JWT Bearer token authentication. To access any protected endpoint, you must first obtain a token by logging in. Tokens are returned in the response body of a successful login or registration and must be included in the Authorization header of every subsequent API request. The three authentication endpoints (/api/auth/login, /api/auth/register, and /api/auth/reset-password) do not themselves require a token.

​
POST /api/auth/login

Authenticate an existing user with their email and password. On success, returns a signed JWT access token and the authenticated user’s profile. This token must be passed as a Bearer token in all subsequent API calls.

​
Request Body

​
email
string
required
The user’s registered email address.
​
password
string
required
The user’s account password.

​
Example Request

curl -X POST https://your-domain.com/api/auth/login \
  -H "Content-Type: application/json" \
  -d '{
    "email": "jane.doe@example.com",
    "password": "S3cur3P@ss!"
  }'

​
Example Response

{
  "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c3JfMDFKMksiLCJyb2xlIjoiZXhhbWluZXIiLCJpYXQiOjE3MjAwMDAwMDB9.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c",
  "user": {
    "id": "usr_01J2K9XMAB",
    "name": "Jane Doe",
    "email": "jane.doe@example.com",
    "role": "examiner"
  }
}

​
Error Responses

StatusDescription
401 UnauthorizedEmail or password is incorrect
400 Bad RequestMissing required fields

​
POST /api/auth/register

Register a new student account. Students may self-register using this endpoint. Examiner and admin accounts must be created by an administrator through the Users API — they cannot be created via self-registration.

​
Request Body

​
full_name
string
required
The student’s full legal name.
​
email
string
required
A valid, unique email address. Used for login and communications.
​
password
string
required
Account password. Must be at least 8 characters and include at least one uppercase letter, one lowercase letter, one digit, and one special character (e.g., !@#$%^&*).
​
roll_number
string
required
The student’s institutional roll number. Must be unique within the platform.
​
registration_number
string
required
The student’s official registration or enrollment number.
​
phone
string
Optional contact phone number.

​
Example Request

curl -X POST https://your-domain.com/api/auth/register \
  -H "Content-Type: application/json" \
  -d '{
    "full_name": "Arjun Sharma",
    "email": "arjun.sharma@university.edu",
    "password": "MyP@ssw0rd!",
    "roll_number": "CS2024001",
    "registration_number": "REG20240001",
    "phone": "+91-9876543210"
  }'

​
Example Response

{
  "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "user": {
    "id": "usr_01J3P7RQZN",
    "name": "Arjun Sharma",
    "email": "arjun.sharma@university.edu",
    "role": "student",
    "roll_number": "CS2024001",
    "registration_number": "REG20240001"
  }
}

​
Error Responses

StatusDescription
422 Unprocessable EntityPassword does not meet complexity requirements, or a required field is missing
409 ConflictEmail or roll number is already registered
Examiner and admin accounts cannot self-register via this endpoint. Only role: "student" accounts can be created here. To create an examiner or admin, an existing administrator must use POST /api/users.

​
POST /api/auth/reset-password

Initiate a password reset flow for any account. If the provided email address matches an existing account, a reset link is sent to that address. For security reasons, the response message is identical whether or not the email exists, preventing account enumeration.

​
Request Body

​
email
string
required
The email address associated with the account to reset.

​
Example Request

curl -X POST https://your-domain.com/api/auth/reset-password \
  -H "Content-Type: application/json" \
  -d '{
    "email": "arjun.sharma@university.edu"
  }'

​
Example Response

{
  "message": "If an account exists for arjun.sharma@university.edu, a password reset link has been sent."
}

​
Error Responses

StatusDescription
400 Bad Requestemail field is missing or malformed
Password reset links expire after 30 minutes. If a user does not complete the reset within that window, they must request a new link by calling this endpoint again.

​
Using Your Token

Once you have an access_token, include it in the Authorization header of every protected API call: 
curl https://your-domain.com/api/exams \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
If the token is missing, expired, or malformed, the API returns 401 Unauthorized. Your client should handle this by re-authenticating via POST /api/auth/login and retrying the original request with the new token.

Build docs developers (and LLMs) love

Get started for freeTalk to us