Register a data provider plugin in the PowerSchool SIS admin console under System > Plugin Management Configuration; the plugin XML manifest declares the required data access scopes.
After plugin installation, retrieve the generated Client ID and Client Secret from the plugin's Data Provider Configuration screen.
Exchange credentials for an access token by POSTing to https://<ps-host>/oauth/access_token with a Basic Authorization header (Base64-encoded client_id:client_secret) and body grant_type=client_credentials.
Include the returned access_token as a Bearer token in subsequent API calls, e.g., GET /ws/v1/student with Accept: application/json to list students.
Use the pagesize and page query parameters for pagination, and filter with q=(last_name==Smith) using PowerSchool's PowerQuery syntax for server-side filtering.
For expanded student data, use the expansions parameter (e.g., expansions=demographics,addresses) rather than making multiple requests per student.
Known gotchas
Access tokens have a short expiry (typically one hour); the API returns a 401 when expired, so build token refresh logic around the expires_in field in the token response.
Plugin manifests must explicitly declare every table and field the plugin will access; the SIS admin must approve the plugin and grant access — requests to undeclared fields return empty or 403.
PowerSchool SIS hosted versions may restrict which IP ranges can call the API; confirm firewall/allowlist requirements with the district's PowerSchool admin before deploying.
Give your agent this knowledge — and 200+ more routes
One MCP install gives any agent live access to the full route map, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp