Create a PowerSchool Data Access plugin (a ZIP file containing plugin.xml, plugin_config.xml, and queries_root XML files); in plugin.xml enable the <oauth/> element to activate API credential generation for the plugin.
Install the plugin in PowerSchool at Start Page > System > System Settings > Plugin Management, then navigate to the plugin's detail page to copy the generated OAuth client ID and client secret.
Obtain a Bearer token by POSTing to https://your-ps-instance/oauth/access_token with Authorization: Basic base64(clientId:clientSecret) and body grant_type=client_credentials; the token is valid for one hour.
Call the core REST endpoints: GET /ws/v1/district/student?pagesize=100&page=1 to list students with pagination; GET /ws/v1/school/:schoolId/student to scope by school; include Accept: application/json to receive JSON rather than XML.
For data not exposed via the core REST API, use PowerQueries: define a named_queries.xml file in your plugin with SQL queries against the PowerSchool database, then invoke them via POST /ws/schema/table/[queryname]/count and POST /ws/schema/table/[queryname] with a JSON body containing the query arguments.
Handle 401 responses by refreshing the Bearer token; implement pagination using the returned @expansionData pagination metadata in the response envelope, which includes count, current, and total fields.
Known gotchas
The plugin must be installed and the OAuth credential generated before any API calls can succeed; there are no developer sandbox credentials independent of a live PowerSchool instance, which makes local development without a PS instance difficult.
PowerSchool's core REST API exposes a limited set of student fields; accessing custom fields, extensions, or state-specific data typically requires PowerQuery definitions in the plugin, adding development complexity.
PowerSchool's API access is controlled by the plugin's declared access permissions; if you need to read fields from tables not declared in the plugin manifest, the API returns empty results rather than an error — verify your plugin permissions when responses look unexpectedly sparse.
Give your agent this knowledge — and 200+ more routes
One MCP install gives any agent live access to the full route map, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp