API keys and Connected AI

RTObase has two ways for other software to work with your data. Both act as the person who set them up, and never with more access than that person's role allows.

Access required

Sign in with your own member account to connect an AI assistant. The connection can only narrow your existing role access. Creating an organisation API key is a separate administrator action under API keys below.

API keys

API keys let your other systems, such as a CRM or finance tool, read and update RTObase records.

• API keys are on the Business and Custom plans.
• Administrators create them under Settings → API Keys. Choose Read only, Read and change, or Read, change and manage (which adds area settings such as custom field definitions) when you create one. Organisation settings, members, roles, billing and keys are never available to a key.
• The key is shown once. Store it somewhere safe. Anyone with the key can act as you, within the access you chose.
• Revoke a key at any time. It stops working straight away.
• Changes made with a key are recorded in the audit log against the key.

How the API works

The API is a standard REST API at https://rtobase.com.au/api/v1. Send the key as Authorization: Bearer <key>.

• Each kind of record has its own address, such as /students or /enrolments. GET /students lists students, GET /students/{id} reads one, POST /students creates one and PATCH /students/{id} changes only the fields you send. Other actions have their own address, such as POST /students/{id}/archive.
• Lists return 50 records at a time, oldest change first. Pass next_cursor as cursor to get the next page, and updated_since to fetch only records changed since your last sync.
• Saves follow the same rules as the screens. For example, a PO Box typed as a street address is saved as the mailing address, as it is in the student form.
• Send an Idempotency-Key header with a POST so a retry never creates a second record. The same key returns the first response for 24 hours, even a server error. After a server error, check whether the record was saved, then retry with a new key.
• Errors come back as { "error": { "code", "message" } } with the usual HTTP status codes. Each key can make 120 requests a minute.

The reference on the same page lists every endpoint and the access it needs. The full OpenAPI description is at /api/v1/openapi.json.

Connected AI

Connected AI lets you use your own AI assistant to find students, check progress and help with everyday updates in RTObase. It is available on every plan. Compatible tools include Claude, ChatGPT and Codex when their plan and workspace settings allow custom connections. The connection uses MCP (Model Context Protocol), the name you may see in your assistant’s setup screen. An RTObase administrator must enable AI access to personal records in organisation Settings before a connection can use them.

The easiest way is to sign in from your AI tool:

1. In your AI tool, add a custom connector (or MCP server) with the address https://rtobase.com.au/api/v1/mcp.
2. Your tool opens RTObase. Sign in, choose the organisation and the access, and select Connect. The page names where the connection is sent. If RTObase does not know that address, it warns you. Only connect if you started the connection from that address.
3. The connection appears under Connected AI, where you can disconnect it at any time.

If your tool cannot sign in this way, use a token instead:

1. Open the menu under your name and choose Connected AI.
2. Select Create connection, name it and choose the access.
3. Copy the token and add RTObase to your AI tool using the instructions on the page.

Your AI tool sees only the actions your connection allows. RTObase instructs your assistant to say what will change and get your yes first. Approval happens in your assistant; Connected AI does not use the in-app Admin Agent approval cards. When an action can send a System Message, such as creating an enrolment, the tool must say whether to send it, so it should ask you. Payments, refunds, invoices, certificates, AVETMISS lodgement and new assessment submission reviews are never done through a connection. Revoke the connection to stop access.

Connections with the required permissions can record unit outcomes and update some already-reviewed assessment records. These actions do not replace the assessor’s responsibility for the decision and its evidence.

Keep going