ElevateU
Public API · v1

Build on ElevateU

A simple, token-authenticated JSON API to read your ownElevateU data — your Career Readiness score, profile summary and opportunity recommendations — plus any student's public Career Passport. Pull your readiness into your portfolio site, a Notion widget, or your own dashboard.

Authentication

Every request is authenticated with an API key sent as a bearer token. Create a key from your developer console— you'll see the raw key once, so store it securely. We only ever store a hash of it, never the key itself.

Authorization: Bearer elu_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Keys are read-only and scoped to your account. If a key leaks, revoke it from the console and create a new one — revocation takes effect immediately.

Conventions

Versioned

All endpoints live under /api/v1. Every success response is wrapped as { "version": "v1", "data": … }.

Rate limited

60 requests per minute per key. Over the limit returns HTTP 429 with a Retry-After header — never a redirect.

Predictable errors

Errors are JSON with a real status code: 401 (bad key), 403 (scope), 404, 429.

Endpoints

GET/api/v1/profile

Profile summary

Your public profile summary — name, college, course, year, career goal, public handle and Career Readiness score. Never returns email, ID or any private field.

Request

curl https://elevate-u.org/api/v1/profile \
  -H "Authorization: Bearer YOUR_API_KEY"

Example response

{
  "version": "v1",
  "data": {
    "name": "Aarav S.",
    "college": "VJTI Mumbai",
    "course": "B.Tech Computer Engineering",
    "year": 3,
    "careerGoal": "Backend engineer",
    "handle": "aarav-s",
    "publicProfileUrl": "https://elevate-u.org/u/aarav-s",
    "readiness": { "score": 72, "version": "v1" }
  }
}
GET/api/v1/profile-summary

Consented profile summary

A summary derived from your PUBLIC Career Passport — privacy-reduced name, headline, readiness and public section counts. Consent-gated: returns 403 until you make your passport public (Passport → Share settings), and never carries more than the passport already publishes.

Request

curl https://elevate-u.org/api/v1/profile-summary \
  -H "Authorization: Bearer YOUR_API_KEY"

Example response

{
  "version": "v1",
  "data": {
    "consented": true,
    "handle": "aarav-s",
    "name": "Aarav S.",
    "headline": "Aspiring backend engineer",
    "summary": null,
    "readiness": { "score": 72, "version": "v1" },
    "publicSections": { "skills": 8, "projects": 3, "experience": 1,
      "achievements": 2, "certifications": 1, "links": 2 },
    "publicProfileUrl": "https://elevate-u.org/u/aarav-s"
  }
}
GET/api/v1/readiness

Readiness score

Your Career Readiness score (0–100) with the transparent component breakdown that sums exactly to the score, plus the change vs ~7 days ago.

Request

curl https://elevate-u.org/api/v1/readiness \
  -H "Authorization: Bearer YOUR_API_KEY"

Example response

{
  "version": "v1",
  "data": {
    "score": 72,
    "version": "v1",
    "delta": 4,
    "components": [
      { "key": "assessments", "label": "Self-awareness",
        "weight": 40, "earned": 30, "detail": "6 assessments done · 100% breadth · avg score 78/100" },
      { "key": "skills", "label": "Skills",
        "weight": 25, "earned": 18, "detail": "8 skills · avg level Advanced" }
    ]
  }
}
GET/api/v1/recommendations

Recommendations

Your top opportunity matches (internships, hackathons, scholarships), ranked against your stream, skills, interests, city and readiness — each with its 'why it matched' reasons.

Request

curl https://elevate-u.org/api/v1/recommendations \
  -H "Authorization: Bearer YOUR_API_KEY"

Example response

{
  "version": "v1",
  "data": {
    "recommendations": [
      {
        "id": "int_1042",
        "kind": "internship",
        "title": "Backend Intern",
        "org": "Acme Labs",
        "url": "https://…",
        "location": "Navi Mumbai",
        "deadline": null,
        "matchScore": 88,
        "reasons": ["Matches your skills: Python, SQL", "Near you — Navi Mumbai"]
      }
    ],
    "count": 1,
    "readiness": 72,
    "stream": "engineering-tech"
  }
}
GET/api/v1/passport/{handle}

Public passport

Any student's public Career Passport by handle — only the sections its owner chose to make public, with a privacy-reduced name. Returns 404 if the handle is unknown or not public.

Request

curl https://elevate-u.org/api/v1/passport/aarav-s \
  -H "Authorization: Bearer YOUR_API_KEY"

Example response

{
  "version": "v1",
  "data": {
    "handle": "aarav-s",
    "name": "Aarav S.",
    "headline": "Aspiring backend engineer",
    "skills": [{ "name": "Python", "category": "Programming", "proficiency": "Advanced" }],
    "readiness": { "score": 72, "version": "v1", "components": [] }
  }
}
GET/api/v1/opportunities

Opportunities (public)

The curated ElevateU opportunity list — internships, hackathons and scholarships. No API key required (per-IP rate limited). Filter with ?kind=internship|hackathon|scholarship, search with ?q=, paginate with ?limit= and ?offset=.

Request

curl "https://elevate-u.org/api/v1/opportunities?kind=internship&q=python&limit=10"

Example response

{
  "version": "v1",
  "data": {
    "opportunities": [
      {
        "id": "int_1042",
        "kind": "internship",
        "title": "Backend Intern",
        "org": "Acme Labs",
        "url": "https://…",
        "location": "Navi Mumbai",
        "deadline": null,
        "skills": ["Python", "SQL"]
      }
    ],
    "count": 1, "total": 14, "limit": 10, "offset": 0
  }
}
GET/api/v1/verify/certificate?id={id}

Verify a certificate (public)

Machine-readable certificate verification — the API twin of the /verify/<id> page. No API key required (per-IP rate limited). Returns only what the printed certificate shows: holder first name + last initial, title, kind, issue date and validity.

Request

curl "https://elevate-u.org/api/v1/verify/certificate?id=CERTIFICATE_ID"

Example response

{
  "version": "v1",
  "data": {
    "valid": true,
    "status": "valid",
    "certificate": {
      "id": "c9f2…",
      "title": "Campus Ambassador — Spring 2026",
      "kind": "ambassador",
      "holder": "Aarav S.",
      "issuedAt": "2026-05-30T10:12:00.000Z",
      "revokedAt": null
    },
    "verifyUrl": "https://elevate-u.org/verify/c9f2…"
  }
}

Sign in with ElevateU (OAuth 2.0)

Let students sign in to your app with their ElevateU identity. Standard authorization-code flow with PKCE (S256) — required for every client; there are no client secrets. One scope exists: profile-basic — a privacy-safe display name, public passport handle, college, and verified status. Nothing is shared until the student approves an explicit consent screen that lists exactly these fields.

Client registration is admin-approved. Write to developers@elevate-u.org with your app name, a one-line description and your exact redirect URIs (https only; http://localhost allowed for development). You'll receive a client_id once the app is vetted.

GET/api/oauth/authorize

1 · Send the student to authorize

Redirect the browser here. ElevateU validates the request and shows the consent screen; on approval the student returns to your redirect_uri with a single-use code (5-minute expiry) and your state.

https://elevate-u.org/api/oauth/authorize
  ?response_type=code
  &client_id=elu_app_xxxxxxxxxxxxxxxx
  &redirect_uri=https://app.example.com/auth/callback
  &scope=profile-basic
  &state=RANDOM_CSRF_STATE
  &code_challenge=BASE64URL(SHA256(code_verifier))
  &code_challenge_method=S256
POST/api/oauth/token

2 · Exchange the code for a token

Form-encoded (or JSON) POST with your PKCE code_verifier. Access tokens are opaque, short-lived (1 hour) and revocable server-side; there are no refresh tokens — run the flow again when a token expires. Errors follow RFC 6749 (invalid_grant, invalid_client, …) with real status codes, never redirects.

curl -X POST https://elevate-u.org/api/oauth/token \
  -d grant_type=authorization_code \
  -d code=elu_ac_... \
  -d redirect_uri=https://app.example.com/auth/callback \
  -d client_id=elu_app_xxxxxxxxxxxxxxxx \
  -d code_verifier=YOUR_CODE_VERIFIER

Example response

{
  "access_token": "elu_oat_…",
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "profile-basic"
}
GET/api/oauth/userinfo

3 · Read the profile

Returns exactly what the consent screen promised. sub is a stable per-app pseudonymous id — the same student gets a different sub in different apps, and internal ids never leave the platform. No email, phone, DOB, scores or activity, ever.

curl https://elevate-u.org/api/oauth/userinfo \
  -H "Authorization: Bearer elu_oat_…"

Example response

{
  "sub": "9f2c41d68a03b7e5c1a9d40f6b28e371",
  "name": "Aarav S.",
  "handle": "aarav-s",
  "college": "VJTI Mumbai",
  "verified": true,
  "scope": "profile-basic"
}

Privacy & data access

A key only ever reads data you own, plus Career Passports that their owners have explicitly made public. The API never returns emails, phone numbers, dates of birth or internal identifiers. Public passport data is limited to exactly the sections the student opted to share, with a privacy-reduced name — the same strict view as the public /u/<handle> page.

Ready to build?

Create your first key in the developer console — it takes a few seconds.

Open the developer console