Build on top of Elite Drone School

The API is hosted at https://elitedroneschool.com/api/public/v1. All responses are JSON. Successful responses follow the shape { data, meta? }. Errors follow { error: { code, message } }.

Create a key in your API Keys settings. Keys look like edk_live_… and are shown once. Pass them in the Authorization header:

Authorization: Bearer edk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Scopes: read, write, users:read, users:write. write implies read.

Standard HTTP status codes. Common error codes:

• 401 missing_token / invalid_token — auth failed
• 403 insufficient_scope / forbidden — key lacks scope or workspace access
• 400 invalid_input / invalid_json — request validation failed
• 404 not_found — resource doesn't exist or isn't in your workspace
• 429 rate_limited — 120 req/min per key exceeded
• 500 internal_error / db_error — server-side failure

Every response carries X-RateLimit-Limit and X-RateLimit-Remaining. CORS is open for all origins.

Verify your key with the whoami endpoint:

curl https://elitedroneschool.com/api/public/v1/auth/whoami \
  -H "Authorization: Bearer $EDS_API_KEY"

{
  "data": {
    "workspace_id": "5f1c…",
    "api_key_id": "9b4a…",
    "scopes": ["read", "write"]
  }
}

Receive real-time HTTP POSTs when events happen in your workspace. Create endpoints in Settings → Webhooks. Each endpoint gets its own signing secret (whsec_…) used to sign the JSON body.

Event types

• flight_log.created — a new flight log entry
• lesson.progress.updated — any change to lesson progress
• lesson.completed — lesson transitioned to completed

Payload envelope

POST https://your-app.com/webhooks/eds
Content-Type: application/json
X-EDS-Event: lesson.completed
X-EDS-Event-Id: 6f0e…-uuid
X-EDS-Signature: t=1750000000,v1=<hex_hmac_sha256>

{
  "id": "6f0e…-uuid",
  "type": "lesson.completed",
  "created_at": "2026-06-21T15:30:00.000Z",
  "workspace_id": "5f1c…",
  "data": {
    "id": "row-uuid",
    "user_id": "uuid",
    "lesson_id": "part108-module-2",
    "completed": true,
    "best_time_seconds": 412,
    "attempts": 3,
    "completed_at": "2026-06-21T15:30:00.000Z"
  }
}

Verifying the signature

The header is t=<unix_ts>,v1=<hex>. Compute HMAC_SHA256(secret, "<t>.<raw_body>") and compare in constant time. Reject requests older than 5 minutes.

// Node.js example
import crypto from "node:crypto";

function verify(rawBody, header, secret) {
  const [tPart, sigPart] = header.split(",");
  const t = tPart.split("=")[1];
  const sig = sigPart.split("=")[1];
  const expected = crypto
    .createHmac("sha256", secret)
    .update(`${t}.${rawBody}`)
    .digest("hex");
  const a = Buffer.from(sig, "hex");
  const b = Buffer.from(expected, "hex");
  if (a.length !== b.length || !crypto.timingSafeEqual(a, b)) return false;
  const age = Math.floor(Date.now() / 1000) - Number(t);
  return age >= 0 && age < 300;
}

Delivery & retries

Endpoints must respond with a 2xx within 10 seconds. Any non-2xx response, timeout, or network error is automatically retried with exponential backoff:1m → 5m → 15m → 1h → 6h → 24h → 24h (8 attempts total, ±20% jitter). After the final attempt the delivery is marked failed and is visible in your dashboard with the last response code or error. Always make handlers idempotent by deduping on X-EDS-Event-Id — the same event id is re-sent on every retry.