Endpoint reference
The public, stable endpoints you register, monitor, and smoke-test — plus a categorized map of the tool's routes.
These are the endpoints you interact with as an operator — for Canvas registration, health checks, monitoring, and smoke tests. The application's internal API routes are listed at the end for context, but their parameters and response shapes are implementation details owned by the service.
Stable public contracts
These paths must stay stable — Canvas and managed clients depend on them. Do not change them without coordinating a Canvas update.
| Endpoint | Purpose |
|---|---|
GET /lti/config | Dynamic Canvas LTI registration document. |
GET|POST /lti/login | OIDC login initiation. |
GET|POST /lti/launch | Signed LTI launch handling. |
GET /.well-known/jwks.json | Public LTI signing keys. |
GET /health | Process liveness. |
GET /ready | Database + schema readiness. |
GET /js/canvas-seb-detector.js | Stable detector script for theme loaders. |
GET /js/canvas-seb-theme-loader.js | Hosted, quiz-route-limited loader. |
GET /api/seb/canvas-detector.js | Compatibility alias for an existing loader. |
GET /api/oauth2callback | Canvas OAuth redirect URI. |
GET /seb/config/:courseId/:contentId.seb | Encrypted assessment configuration download. |
Content IDs: Classic Quiz classicquiz_{quizId}; New Quiz
newquiz:{courseId}:{assignmentId}.
Certificate verification endpoints
| Endpoint | Purpose |
|---|---|
GET /seb/config-encryption-certificate.pem | Active public encryption certificate (PEM). |
GET /seb/config-encryption-certificate.cer | Active public encryption certificate (DER). |
Their x-seb-public-key-hash header is what you compare against the client
identity during rollout checks. These never serve private material.
Smoke-test set
What to curl after any deploy:
curl -fsS "${TOOL_URL}/health"
curl -fsS "${TOOL_URL}/ready"
curl -fsS "${TOOL_URL}/.well-known/jwks.json"
curl -fsS "${TOOL_URL}/lti/config"
curl -fsS "${TOOL_URL}/js/canvas-seb-detector.js" | head
curl -fsS "${TOOL_URL}/js/canvas-seb-theme-loader.js" | headPublic and status routes
| Route | Purpose |
|---|---|
GET /, GET /login | Public service status and Canvas-launch fallback. |
GET /health, /login/health, /js/health | Lightweight health responses. |
GET /setup, /setup/guide | Public, role-oriented setup handoff (confirms the service responds — not that Canvas stored the registration). |
Categorized route map
The tool also exposes authenticated API routes behind the verified LTI/OAuth boundary. You do not call these directly, but they help when reading logs or configuring a WAF:
The route handlers in the service are the source of truth for parameters and response schemas. Treat unlisted query parameters or output fields as implementation details that may change.