Casa Academy API and developer docs

Casa Academy publishes a public, unauthenticated catalog API so agents and developers can discover products without scraping HTML. The OpenAPI 3.1 specification is at /openapi.json and /api/openapi.json. Human docs live on this /developers page. The RFC 9727 API catalog is at /.well-known/api-catalog. When-to-use guidance is at /agent-instructions.md and in /llms.txt.

Authentication: the public catalog (REST, GraphQL, MCP, OpenAPI, health) requires no API key. Student LMS routes under /api/lms require a Casa Academy session cookie after login and are not part of the public spec. Do not send invented Bearer tokens.

Webhooks: Stripe sends inbound checkout and subscription events to Casa Academy. There is no public outbound webhook subscription API for third-party agents. Do not POST to /api/stripe/webhook.

Rate limits: 120 requests per 60 seconds per client IP. Successful responses include RateLimit, RateLimit-Policy, and X-RateLimit-* headers. HTTP 429 includes Retry-After. Policy is also advertised on /api/* via RateLimit-Policy.

Catalog REST: GET /api/catalog/courses, GET /api/catalog/exam-prep, GET /api/catalog/enrollment?slug=. Catalog GraphQL (introspection enabled): GET or POST /api/catalog/graphql. Do not use Payload CMS GraphQL at /api/graphql; introspection there is disabled on purpose.

MCP: POST JSON-RPC 2.0 to /api/mcp. Tools: list_courses, get_exam_prep_info, get_enrollment_url. Server card: /.well-known/mcp/server-card.json (alias /.well-known/mcp.json).

Never invent Core, Pass Guarantee, or Florida tuition amounts. Fetch the live enroll page or the catalog note.