API

Your tools, our certification tests

Your LMS, CRM or website talks to ExamBoot: choose a certification and its domains, send the test by email, get the results domain by domain.

Open a free trainer space My API keys

In six steps

Get your key

In your trainer space, open API keys and create a key. Copy it at once: it is shown only once. Send it in the X-API-KEY header of each call (Authorization: Bearer also works).

curl https://examboot.net/api/v1/certifications \
  -H "X-API-KEY: ebk_your_key"

Choose the certification and its domains

The catalogue lists the certifications you can test on, your own included. Each domain gives its ID and the number of questions available.

curl https://examboot.net/api/v1/certifications/12/domains \
  -H "X-API-KEY: ebk_your_key"

{"data": [
  {"id": 41, "name": "Security and Risk Management", "questions": 180},
  {"id": 42, "name": "Asset Security", "questions": 95}
]}

Create and send a test

Give the domains and the number of questions (shared evenly), or a count per domain. Each person gets an email with a personal link and starts at once, without an account. Add "send_email": false to send the links yourself.

curl -X POST https://examboot.net/api/v1/tests \
  -H "X-API-KEY: ebk_your_key" \
  -H "Content-Type: application/json" \
  -d '{
    "certification_id": 12,
    "domains": [41, 42],
    "questions": 20,
    "recipients": [{"email": "[email protected]", "name": "Ada"}]
  }'

Follow the results

Each person goes from sent to started to completed. Once completed, you get their score overall and per domain.

curl https://examboot.net/api/v1/tests/TEST_CODE \
  -H "X-API-KEY: ebk_your_key"

"recipients": [{
  "email": "[email protected]",
  "status": "completed",
  "result": {"percent": 75, "correct": 15, "questions": 20,
    "domains": [{"id": 41, "name": "Security and Risk Management", "percent": 80}, ...]}
}]

Fill a class and test it

Create a class with the emails of your students: they join with a free account. Then send a test to the whole class with class_id, and follow each student's progress.

curl -X POST https://examboot.net/api/v1/classes \
  -H "X-API-KEY: ebk_your_key" \
  -H "Content-Type: application/json" \
  -d '{"name": "CISSP evening cohort", "certification_id": 12,
       "emails": ["[email protected]", "[email protected]"]}'

# Then: POST /tests with "class_id" instead of "recipients".

Be told when it is done

In your trainer space, open Webhooks and add your address: when someone finishes a test, ExamBoot posts the result to it, domain by domain. Check the signature with the secret shown when you add it, and ignore an event_id you already handled.

POST https://your-site.example/examboot-hook
X-Webhook-Event: test.completed
X-Webhook-Event-Id: 6f1c2e0a-…
X-Webhook-Signature: HMAC-SHA256 of the raw body, with your whsec_ secret

{"event": "test.completed",
 "payload": {"test": "TEST_CODE", "score": 75, "correct": 15, "questions": 20,
   "recipient": {"email": "[email protected]", "name": "Ada"},
   "domains": [...], "event_id": "6f1c2e0a-…"},
 "sent_at": "2026-10-15T09:30:00+00:00"}

// PHP
hash_equals(hash_hmac('sha256', $rawBody, $secret), $signature);

All endpoints

Every path starts with https://examboot.net/api/v1 and answers in JSON.

GET	/certifications	The certifications you can test on (filters: vendor, search).
GET	/certifications/{id}	A certification and its domains.
GET	/certifications/{id}/domains	Its domains, with the questions available in each.
GET	/tests	Your tests, newest first, with how many completed them.
POST	/tests	Create a test and send it.
GET	/tests/{code}	A test, the people it was sent to and their results.
POST	/tests/{code}/recipients	Send the test to more people.
POST	/tests/{code}/recipients/{id}/resend	Send someone's email again.
GET	/classes	Your classes.
POST	/classes	Create a class and invite students by email.
GET	/classes/{id}	A class, its students and pending invitations.
POST	/classes/{id}/invitations	Invite more students.
GET	/classes/{id}/progress	Each student's progress.

Good to know

A key acts as you: it sees the catalogue and your own certifications, and only your classes and tests.
A test reaches as many people as you have seats. The free trainer space includes 1 class(es) and 2 students.
Up to 120 calls a minute, and 30 tests or classes created a minute.
A refused call says why: 401 (key missing or revoked), 404 (not yours), 409 (beyond your plan), 422 (a field to fix, with its errors).
Up to 5 active keys. Revoke a leaked key in API keys: it stops working at once.