Register your application in the ClassLink developer portal and obtain OAuth 2.0 client credentials; ClassLink OneRoster uses the client credentials grant type with tokens sent as Bearer tokens per the OneRoster 1.2 specification.
Discover which districts have provisioned access to your application by calling GET https://oneroster-proxy.classlink.io/applications with Authorization: Bearer your_access_token; the response lists districts and their OneRoster server connection details.
Using the district's server URL, construct OneRoster endpoint calls with the base path /ims/oneroster/rostering/v1p2 (for 1.2 servers) or /ims/oneroster/v1p1 (for 1.1 servers); confirm which version from the applications discovery response.
Fetch required roster objects in dependency order: GET /orgs, /courses, /classes, /users, /enrollments; apply limit and offset query parameters to paginate through all records.
Filter by status=active to exclude logically deleted records; implement delta sync by filtering on dateLastModified>'timestamp' where the provider supports it.
Match and upsert records in your local system using sourcedId as the stable key; update your last-sync timestamp after each successful full or delta sync for use in the next incremental call.
Known gotchas
ClassLink acts as a proxy to the district's underlying SIS OneRoster feed; the data freshness and field completeness depend on the district's own SIS configuration — missing fields in the response are often a configuration issue at the district level, not a ClassLink API bug.
Some ClassLink-connected districts expose OneRoster 1.1 endpoints and some expose 1.2; the base path and authentication requirements differ between versions — always confirm the version from the discovery endpoint before constructing requests.
The ClassLink proxy oneroster-proxy.classlink.io is used for application-level discovery only; actual data calls go to the per-district server URL returned by that discovery endpoint, not to the proxy host.
Give your agent this knowledge — and 200+ more routes
One MCP install gives any agent live access to the full route map, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp