Sync rosters via the Schoology API

Steps

1. Register your application in the Schoology App Center or obtain a system-level API key and secret from a Schoology administrator; system-level (two-legged OAuth) keys allow server-to-server access without per-user authorization.
2. Authenticate using two-legged OAuth 1.0a: sign each request with your consumer key and secret using HMAC-SHA1; include the OAuth Authorization header with oauth_consumer_key, oauth_nonce, oauth_signature, oauth_signature_method, oauth_timestamp, and oauth_version.
3. Fetch schools and buildings via GET https://api.schoology.com/v1/schools, then retrieve users via GET /v1/users?start=0&limit=200 using start/limit pagination.
4. Retrieve enrollments (section memberships) via GET /v1/sections/:section_id/enrollments; iterate over all course sections retrieved from GET /v1/courses/:course_id/sections.
5. To update enrollments, POST to /v1/sections/:section_id/enrollments with a JSON body containing an array of enrollment objects (uid, admin, status); the API supports bulk enrollment creation in a single call.
6. As of June 25 2025, personal API keys have reduced third-party access; ensure your app uses system-level credentials approved by the district, or request formal Schoology app approval for cross-district access.