A simple, token-authenticated JSON API to read your ownElevateU data — your Career Readiness score, profile summary and opportunity recommendations — plus any student's public Career Passport. Pull your readiness into your portfolio site, a Notion widget, or your own dashboard.
Every request is authenticated with an API key sent as a bearer token. Create a key from your developer console— you'll see the raw key once, so store it securely. We only ever store a hash of it, never the key itself.
Authorization: Bearer elu_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxKeys are read-only and scoped to your account. If a key leaks, revoke it from the console and create a new one — revocation takes effect immediately.
Versioned
All endpoints live under /api/v1. Every success response is wrapped as { "version": "v1", "data": … }.
Rate limited
60 requests per minute per key. Over the limit returns HTTP 429 with a Retry-After header — never a redirect.
Predictable errors
Errors are JSON with a real status code: 401 (bad key), 403 (scope), 404, 429.
/api/v1/profileProfile summary
Your public profile summary — name, college, course, year, career goal, public handle and Career Readiness score. Never returns email, ID or any private field.
Request
curl https://elevate-u.org/api/v1/profile \
-H "Authorization: Bearer YOUR_API_KEY"Example response
{
"version": "v1",
"data": {
"name": "Aarav S.",
"college": "VJTI Mumbai",
"course": "B.Tech Computer Engineering",
"year": 3,
"careerGoal": "Backend engineer",
"handle": "aarav-s",
"publicProfileUrl": "https://elevate-u.org/u/aarav-s",
"readiness": { "score": 72, "version": "v1" }
}
}/api/v1/profile-summaryConsented profile summary
A summary derived from your PUBLIC Career Passport — privacy-reduced name, headline, readiness and public section counts. Consent-gated: returns 403 until you make your passport public (Passport → Share settings), and never carries more than the passport already publishes.
Request
curl https://elevate-u.org/api/v1/profile-summary \
-H "Authorization: Bearer YOUR_API_KEY"Example response
{
"version": "v1",
"data": {
"consented": true,
"handle": "aarav-s",
"name": "Aarav S.",
"headline": "Aspiring backend engineer",
"summary": null,
"readiness": { "score": 72, "version": "v1" },
"publicSections": { "skills": 8, "projects": 3, "experience": 1,
"achievements": 2, "certifications": 1, "links": 2 },
"publicProfileUrl": "https://elevate-u.org/u/aarav-s"
}
}/api/v1/readinessReadiness score
Your Career Readiness score (0–100) with the transparent component breakdown that sums exactly to the score, plus the change vs ~7 days ago.
Request
curl https://elevate-u.org/api/v1/readiness \
-H "Authorization: Bearer YOUR_API_KEY"Example response
{
"version": "v1",
"data": {
"score": 72,
"version": "v1",
"delta": 4,
"components": [
{ "key": "assessments", "label": "Self-awareness",
"weight": 40, "earned": 30, "detail": "6 assessments done · 100% breadth · avg score 78/100" },
{ "key": "skills", "label": "Skills",
"weight": 25, "earned": 18, "detail": "8 skills · avg level Advanced" }
]
}
}/api/v1/recommendationsRecommendations
Your top opportunity matches (internships, hackathons, scholarships), ranked against your stream, skills, interests, city and readiness — each with its 'why it matched' reasons.
Request
curl https://elevate-u.org/api/v1/recommendations \
-H "Authorization: Bearer YOUR_API_KEY"Example response
{
"version": "v1",
"data": {
"recommendations": [
{
"id": "int_1042",
"kind": "internship",
"title": "Backend Intern",
"org": "Acme Labs",
"url": "https://…",
"location": "Navi Mumbai",
"deadline": null,
"matchScore": 88,
"reasons": ["Matches your skills: Python, SQL", "Near you — Navi Mumbai"]
}
],
"count": 1,
"readiness": 72,
"stream": "engineering-tech"
}
}/api/v1/passport/{handle}Public passport
Any student's public Career Passport by handle — only the sections its owner chose to make public, with a privacy-reduced name. Returns 404 if the handle is unknown or not public.
Request
curl https://elevate-u.org/api/v1/passport/aarav-s \
-H "Authorization: Bearer YOUR_API_KEY"Example response
{
"version": "v1",
"data": {
"handle": "aarav-s",
"name": "Aarav S.",
"headline": "Aspiring backend engineer",
"skills": [{ "name": "Python", "category": "Programming", "proficiency": "Advanced" }],
"readiness": { "score": 72, "version": "v1", "components": [] }
}
}/api/v1/opportunitiesOpportunities (public)
The curated ElevateU opportunity list — internships, hackathons and scholarships. No API key required (per-IP rate limited). Filter with ?kind=internship|hackathon|scholarship, search with ?q=, paginate with ?limit= and ?offset=.
Request
curl "https://elevate-u.org/api/v1/opportunities?kind=internship&q=python&limit=10"Example response
{
"version": "v1",
"data": {
"opportunities": [
{
"id": "int_1042",
"kind": "internship",
"title": "Backend Intern",
"org": "Acme Labs",
"url": "https://…",
"location": "Navi Mumbai",
"deadline": null,
"skills": ["Python", "SQL"]
}
],
"count": 1, "total": 14, "limit": 10, "offset": 0
}
}/api/v1/verify/certificate?id={id}Verify a certificate (public)
Machine-readable certificate verification — the API twin of the /verify/<id> page. No API key required (per-IP rate limited). Returns only what the printed certificate shows: holder first name + last initial, title, kind, issue date and validity.
Request
curl "https://elevate-u.org/api/v1/verify/certificate?id=CERTIFICATE_ID"Example response
{
"version": "v1",
"data": {
"valid": true,
"status": "valid",
"certificate": {
"id": "c9f2…",
"title": "Campus Ambassador — Spring 2026",
"kind": "ambassador",
"holder": "Aarav S.",
"issuedAt": "2026-05-30T10:12:00.000Z",
"revokedAt": null
},
"verifyUrl": "https://elevate-u.org/verify/c9f2…"
}
}Let students sign in to your app with their ElevateU identity. Standard authorization-code flow with PKCE (S256) — required for every client; there are no client secrets. One scope exists: profile-basic — a privacy-safe display name, public passport handle, college, and verified status. Nothing is shared until the student approves an explicit consent screen that lists exactly these fields.
Client registration is admin-approved. Write to developers@elevate-u.org with your app name, a one-line description and your exact redirect URIs (https only; http://localhost allowed for development). You'll receive a client_id once the app is vetted.
/api/oauth/authorize1 · Send the student to authorize
Redirect the browser here. ElevateU validates the request and shows the consent screen; on approval the student returns to your redirect_uri with a single-use code (5-minute expiry) and your state.
https://elevate-u.org/api/oauth/authorize
?response_type=code
&client_id=elu_app_xxxxxxxxxxxxxxxx
&redirect_uri=https://app.example.com/auth/callback
&scope=profile-basic
&state=RANDOM_CSRF_STATE
&code_challenge=BASE64URL(SHA256(code_verifier))
&code_challenge_method=S256/api/oauth/token2 · Exchange the code for a token
Form-encoded (or JSON) POST with your PKCE code_verifier. Access tokens are opaque, short-lived (1 hour) and revocable server-side; there are no refresh tokens — run the flow again when a token expires. Errors follow RFC 6749 (invalid_grant, invalid_client, …) with real status codes, never redirects.
curl -X POST https://elevate-u.org/api/oauth/token \
-d grant_type=authorization_code \
-d code=elu_ac_... \
-d redirect_uri=https://app.example.com/auth/callback \
-d client_id=elu_app_xxxxxxxxxxxxxxxx \
-d code_verifier=YOUR_CODE_VERIFIERExample response
{
"access_token": "elu_oat_…",
"token_type": "Bearer",
"expires_in": 3600,
"scope": "profile-basic"
}/api/oauth/userinfo3 · Read the profile
Returns exactly what the consent screen promised. sub is a stable per-app pseudonymous id — the same student gets a different sub in different apps, and internal ids never leave the platform. No email, phone, DOB, scores or activity, ever.
curl https://elevate-u.org/api/oauth/userinfo \
-H "Authorization: Bearer elu_oat_…"Example response
{
"sub": "9f2c41d68a03b7e5c1a9d40f6b28e371",
"name": "Aarav S.",
"handle": "aarav-s",
"college": "VJTI Mumbai",
"verified": true,
"scope": "profile-basic"
}A key only ever reads data you own, plus Career Passports that their owners have explicitly made public. The API never returns emails, phone numbers, dates of birth or internal identifiers. Public passport data is limited to exactly the sections the student opted to share, with a privacy-reduced name — the same strict view as the public /u/<handle> page.
Ready to build?
Create your first key in the developer console — it takes a few seconds.
Open the developer console