API v1 endpoint reference

This matrix is checked against Waqar’s canonical OpenAPI contract and scope registry. Paths below are relative to https://waqar.app/api/v1.

Method	Path	Required scope
GET	/school	school:read
GET	/semesters	semesters:read
GET	/semesters/{id}	semesters:read
GET	/halqas	halqas:read
GET	/halqas/{id}	halqas:read
GET	/sheikhs	sheikhs:read
GET	/sheikhs/{id}	sheikhs:read
GET	/students	students:read
POST	/students	students:write
GET	/students/{id}	students:read
PATCH	/students/{id}	students:write
GET	/students/{id}/recitations	recitations:read
GET	/learning-plans	learning_plans:read
GET	/learning-plans/{id}	learning_plans:read
GET	/learning-plans/{id}/assignments	learning_plans:read
GET	/sessions	sessions:read
POST	/sessions	sessions:write
GET	/sessions/{id}	sessions:read
PATCH	/sessions/{id}	sessions:write
POST	/sessions/{id}/end	sessions:write
GET	/sessions/{id}/attendance	attendance:read
PUT	/sessions/{id}/attendance	attendance:write
GET	/sessions/{id}/recitations	recitations:read
POST	/sessions/{id}/recitations	recitations:write
GET	/surahs	authenticated
GET	/surahs/{number}	authenticated

authenticated means a valid API key is required but no additional resource scope is attached to that operation.

• Retrieve the current machine contract from /api/openapi.yaml.
• Use /api/docs for rendered schemas, parameters, enums, examples, and response status definitions.
• Do not infer a method that is absent from this matrix.
• Supply only the filters listed for the chosen operation.
• Use the resource guide for semantics and the OpenAPI schema for exact fields.
• Treat stable paths, scope names, enum values, and error codes as language-neutral machine identifiers.

See resources, authentication and scopes, and idempotent writes.