RIST CRM API

REST API of RIST CRM. Each school has its own address, https://<school>.rist.pro/api, and its own data; a key works only with the school that issued it. Every request acts as the user who created the API key and sees only what their role allows.

Create a key in the CRM: Account → API. Send it in every request:

Authorization: Bearer rist_…

The key is shown once; the CRM keeps only its hash. A read-only key works on read routes; writing needs a key with write access and a role allowed to write through the API. Revoke a key in the same place; it stops working at once.

Successful answers are wrapped: { "statusCode": 200, "message": "…", "data": … }. Errors carry statusCode, an English message and, for most of them, a stable code (e.g. apiKey.readOnlyKey) to branch on; the message text may change.

• 400 — validation failed: message lists the problems
• 401 — missing, invalid, revoked or expired key
• 403 — the route is not in the public API, or the key or role may not do this
• 404 — no such record, or the user may not see it
• 429 — rate limit reached

List routes take page (from 1) and pageSize (default 20, max 250) and return the page with total, totalPages and currentPage.

Dates and times are in the school's time zone, without a UTC offset: 2026-11-09T14:30:00. Send them the same way.

300 requests per 2 minutes per key. The X-RateLimit-* headers show what is left; on 429 wait for Retry-After seconds.

A repeated POST creates a second record. If a write times out, check whether the record exists before sending it again.