LMS connectors

Connection model

A facoolta LMS connector talks to the LMS service boundary, not to rendered course pages. The setup differs by vendor, but the operating model stays the same:

1. Approve the integration

   A campus administrator reviews the requested data surface and creates the integration.

2. Issue least-privilege credentials

   Use a dedicated service or user context with only the capabilities needed for the pilot.

3. Validate in a non-production course

   Confirm membership filtering, dates, files, pagination, and revoked access before rollout.

4. Operate and revoke

   Monitor failures, rotate credentials, and remove access when the connector is disconnected.

Data surface

Keep vendor IDs as source identifiers and store the LMS base URL with them. Do not infer a course or user from a display name. When an enrollment disappears or access is revoked, stop refreshing protected resources and invalidate derived access.

Sync lifecycle

Initial sync

Fetch the connected identity, active enrollments, and bounded course metadata.

Incremental sync

Use vendor pagination and modification markers where available; bound every polling job.

Partial failure

Retain the last successful result, expose its timestamp, and retry with backoff.

Disconnect

Revoke or delete the credential and stop scheduled work before clearing cached LMS data.

Security baseline

• Require HTTPS for the LMS base URL and reject unexpected redirects to another origin.
• Encrypt tokens and client secrets at rest; never return them to the browser after setup.
• Keep production, sandbox, and test credentials separate.
• Redact authorization headers, query-string tokens, and student content from logs.
• Apply the LMS permission check again when serving synchronized files or course data.

Choose a connector