Moodle Web Services API

What authentication does the Moodle Web Services API use?

Moodle uses an API key (wstoken) passed as a query parameter on every request. Tokens are obtained from the /login/token.php endpoint using username and password credentials plus the service shortname. Through Jentic, the wstoken is stored in the encrypted Jentic One instance, so agents authenticate without handling raw credentials.

Can I enroll users in a Moodle course with the API?

Yes. Use the enrol_manual_enrol_users function, which accepts an array of enrollments each specifying a user ID, course ID, and role ID (5 for student, 3 for teacher). You can also use enrol_manual_unenrol_users to remove enrollments or enrol_self_enrol_user for self-service enrollment.

How do I retrieve assignment grades for a student through Jentic?

Search Jentic for 'get moodle assignment grades' to find the gradereport_user_get_grade_items function. This returns all grade items for a specific user in a course, including assignment grades, quiz scores, and computed totals. Install with pip install jentic, then search, load the schema, and execute with the user and course IDs.

What are the rate limits for the Moodle Web Services API?

Rate limits depend on the Moodle instance configuration set by the site administrator. There are no universal limits in the spec. Administrators typically configure request throttling via the Moodle security settings. Self-hosted instances can adjust these limits based on server capacity.

Does the Moodle API support file uploads?

Yes. The core_files_upload function handles file uploads to Moodle's file system. You provide the file content, filename, and target context (course, user, etc.). The core_files_get_files function retrieves file listings from any file area in the system.

Can I limit what my agent is allowed to do with the Moodle Web Services API?

Yes. Because Moodle addresses each action by function name rather than a resource path, your self-hosted Jentic One instance lets you allow only the specific functions your agent needs, such as core_course_search_courses or gradereport_user_get_grade_items for read-only work. Write functions like enrol_manual_enrol_users, core_user_create_users, or mod_assign_save_grade stay off-limits unless you explicitly add them. Your own rules decide which operations the agent may call and which stored wstoken it uses, so the agent never has access beyond what you grant.