Scoped authentication
API tokens are hashed at rest, displayed once, limited by scopes, expire after ninety days, and can be revoked.
Developer portal
A versioned, scoped mobile API boundary.
Efibb exposes selected mobile configuration, catalog, authenticated sync, adaptive learning, credentials, and study-abroad state through /api/v2. Internal administration, infrastructure, private tenant, and operational-security routes are excluded from this public specification.
API base/api/v2Minimum client1.0.0Recommended client1.0.0Configured capabilities5
Incremental synchronization
Cursor-based synchronization supports bounded updates for learning, projects, notifications, and orders.
Selected public catalogs
Public catalog endpoints expose approved learning and opportunity content—not internal administration schemas or secrets.
Device registration
Authenticated registration creates a controlled foundation for future iOS, Android, and web-push delivery.
Security boundary: never embed an Efibb API token in public source code, browser bundles, screenshots, or client logs. Native applications must use secure device storage and production threat modeling.