Skip to content
Student Data InteroperabilityStudent Data InteroperabilityStudent Data Interoperability

Conformance checklist

You are conformant at the enrollment-sync level when all of these hold:

  • GET /.well-known/sdi-configuration returns a valid discovery document over HTTPS, unauthenticated.
  • At least one OAuth grant works end-to-end; tokens are scoped; 403 on insufficient scope.
  • If you support Dynamic Registration, it requires a software statement and/or initial access token.
  • Access tokens are short-lived; refresh tokens (if issued) rotate with reuse detection.
  • GET {schema_endpoint} returns a valid Draft 2020-12 schema tagged with its contract version.
  • POST {ingest_endpoint} validates per record, returns per-record results, applies valid records even when others fail, and is idempotent on Idempotency-Key + recordRef.
  • Repeated recordRef upserts (no duplicates); externalId returned for created/updated.
  • If you accept documents: you resolve them by calling resolveUrl with a signed JWT assertion whose aud is the resolveUrl, and you verify sha256 after download.
  • Errors use application/problem+json; you honour Idempotency-Key and Retry-After.
  • If you localize: schema and error responses honour Accept-Language, set Content-Language + Vary: Accept-Language, fall back to default_language, and never translate property names, enum values, or error codes.
  • All endpoints are HTTPS; tokens travel only in the Authorization header.