Students Granting Blackbaud Access Before Schools Granting Access ?

Saul Holding
Saul Holding
Second Anniversary Kudos 1 Name Dropper Participant
in Education Management APIs

Hello All,

I have a hopefully quick question on authorization. Can students independently grant us access to their blackbaud ? Or, to a limited amount of their blackbaud data ? Or do we always need school approval first ?

For context, we're using the SKY API Auth 2.0. We're wondering if this is possible so we can begin working with students independent of the longer process of being granted full school access.

Any advice would be greatly appreciated. Thank you !

Comments

  • Stephen Boyle
    Stephen Boyle Blackbaud Employee
    Tenth Anniversary Kudos 5 First Reply Name Dropper

    @Champion AI
    The user that connects a BB marketplace app to a school must be an environment admin for the school.

    A student can log in to a connected app and access the information they have rights to, but they cannot connect an app to a school's data.

  • Saul Holding
    Saul Holding
    Second Anniversary Kudos 1 Name Dropper Participant

    Hi @Stephen Boyle, thank you again.

    A quick follow up question:

    If schools approve the apps, do students have to also approve the app to use their data ? So do students have to opt-in themselves ? Or can the school have it so that all student data is accessible once the school approves the app ?

    We ask because when getting out there to schools, schools have understandably been worried about their data, and they may be less worried if students make the decision themselves to opt-in.

    Thank you, Stephen. I hope you’re having a great day !

  • Stephen Boyle
    Stephen Boyle Blackbaud Employee
    Tenth Anniversary Kudos 5 First Reply Name Dropper

    @Champion AI
    Once an app is approved and connected to a school, the universe of data available is set by the user that approved it.

    When a regular user logs in to your app and you use their credentials to connect to the school through the SKY app, that user is limited to only the data they would normally have access to. Our API endpoints check the calling user and make sure they have rights to that endpoints data, else a 403 error is returned.

    So, the regular user's access is always a subset of the app-approver's access. And the approver may not have access to all data, so it's a subset of a subset.

    290e4d9f87b0fec4e12c4583c5ff1b98-huge-im
  • Saul Holding
    Saul Holding
    Second Anniversary Kudos 1 Name Dropper Participant

    Hi @Stephen Boyle,

    Understood !

    One additional follow-up question regarding student data:

    At a given school, only a select group of students will be paying customers. We want our access to student data to be exclusively limited to this group of paying customers. Is this possible, or will we have access to every student’s data once we have school approval ? Just for a bit more context, we’re trying to work through the privacy concerns upfront.


    Thank you, Stephen. I hope you're having a great weekend.

  • Stephen Boyle
    Stephen Boyle Blackbaud Employee
    Tenth Anniversary Kudos 5 First Reply Name Dropper

    @Champion AI
    I think there is a distinction to make between access to the data and access to your app. The SKY app only controls the access a user has to the school's data. How your app manages it's users is not something the SKY app can affect. If you allow all students to log in but only paid up students to access certain data, you will need to control access to the areas only paid students can see.

  • Saul Holding
    Saul Holding
    Second Anniversary Kudos 1 Name Dropper Participant

    @Stephen Boyle, hi and I hope you had a great long weekend !

    Got it. One last follow-up question: Does this mean that once a SKY app is granted access to a school’s data, the app can access any of that data at any time ? For example, if the app were approved by a school and it wanted to pull one student’s schedule and assignments, could it do that ? Or, would the app need permission from the student before looking at that student's details in particular ?

    Please excuse all the follow-up questions ! We really appreciate learning more and your help.

  • Stephen Boyle
    Stephen Boyle Blackbaud Employee
    Tenth Anniversary Kudos 5 First Reply Name Dropper

    @Champion AI
    The SKY app only needs the school's permission (via the admin user) to access data. The app can then access all data within the rights of the admin user at any time.

Categories