API Overview

Introduction to the SkillRise API, base URLs, response formats, and core architecture

Introduction

The SkillRise API is a RESTful API that powers the SkillRise e-learning platform. It provides endpoints for course management, user enrollment, AI-powered learning assistance, community features, quiz generation, and payment processing.

The API is built with Express.js and uses MongoDB for data persistence, with integrations for:

• Clerk for authentication
• Razorpay for payment processing
• Cloudinary for media storage
• Groq SDK for AI features

Base URL

The API base URL varies by environment:

Production

https://api.skillrise.com

All API routes are prefixed with /api followed by the resource category:

• /api/course - Public course endpoints
• /api/user - User-specific endpoints (protected)
• /api/educator - Educator endpoints (role-protected)
• /api/admin - Admin endpoints (role-protected)
• /api/community - Community posts and groups
• /api/quiz - Quiz generation and submission

API Architecture

Route Structure

The SkillRise API follows a modular route structure organized by resource type:

server.js
├── /api/course        // Course browsing (public)
├── /api/user          // User actions (authenticated)
├── /api/educator      // Educator features (role-based)
├── /api/admin         // Admin panel (role-based)
├── /api/community     // Community features
└── /api/quiz          // Quiz system

Middleware Stack

Every request passes through a middleware stack:

1. Helmet - Security headers
2. CORS - Cross-origin resource sharing
3. Clerk Middleware - Auth context injection
4. Rate Limiters - Request throttling (route-specific)
5. Express JSON - Request body parsing

Rate Limiting

The API implements intelligent rate limiting based on userId (when authenticated) or IP address (for guests):

AI Chat · 30 requests / 10 minutes

Applied to /api/user/ai-chat - Generous limit for frequent chatbot usage

Payments · 10 requests / 15 minutes

Applied to /api/user/purchase and /api/user/verify-razorpay - Tight limit to prevent fraud

AI Generation · 10 requests / hour

Applied to quiz generation and roadmap endpoints - Prevents API cost abuse

Quiz Submission · 30 requests / 10 minutes

Applied to /api/quiz/submit - Prevents brute-forcing quiz answers

Community Writes · 20 requests / 10 minutes

Applied to POST operations on /api/community/posts and replies - Spam protection

Admin Panel · 100 requests / 15 minutes

Applied to /api/admin/* - Extra safety layer for admin operations

Rate limits track by userId when authenticated, preventing limit bypass through IP switching.

Response Format

All API responses follow a consistent JSON format:

Success Response

{
  "success": true,
  "message": "Operation completed successfully", // Optional
  "data": { /* Response payload */ }
}

Error Response

{
  "success": false,
  "message": "Error description"
}

Common Status Codes

200 OK · Success

Request successful, data returned in response body

400 Bad Request · Client Error

Invalid request data (validation failed)

401 Unauthorized · Auth Error

Missing or invalid authentication token

403 Forbidden · Auth Error

User lacks required role/permissions for this endpoint

404 Not Found · Client Error

Resource not found

409 Conflict · Client Error

Request conflicts with current state (e.g., duplicate purchase)

429 Too Many Requests · Rate Limit

Rate limit exceeded, includes RateLimit-* headers for retry timing

500 Internal Server Error · Server Error

Unexpected server error occurred

Request Validation

The API uses Zod schemas for request body validation. Invalid requests receive a 400 Bad Request response:

{
  "success": false,
  "message": "Invalid request data"
}

Validation rules are enforced at the controller level before processing requests.

Data Models

The API works with the following core data models:

Course

Courses with chapters, lectures, ratings, and enrollment data

User

Student profiles with enrolled courses and progress tracking

CourseProgress

Tracks completed lectures and course completion status

Purchase

Payment transactions (Razorpay integration)

Certificate

Generated PDF certificates for completed courses

CommunityPost & Reply

Discussion posts with upvotes and answers

Quiz & QuizResult

AI-generated quizzes with performance tracking

ChatSession

AI chatbot conversation history

Error Handling

The API includes a global error handler that:

• Logs full stack traces in development
• Logs error messages only in production (security)
• Returns standardized error responses
• Catches unhandled errors with 500 status

// Global error handler (server.js:146)
app.use((err, _req, res, _next) => {
  if (process.env.NODE_ENV !== 'production') {
    console.error(err) // Full trace in dev
  } else {
    console.error(`[Error] ${err.message}`) // Message only in prod
  }
  res.status(500).json({ 
    success: false, 
    message: 'Internal server error' 
  })
})

Pagination

Currently, the API does not implement cursor-based pagination. Large collections return all results. Future versions may add pagination for:

• Course listings
• Community posts
• Enrollment data

CORS Configuration

CORS is configured to accept requests from the frontend URL specified in environment variables:

app.use(cors({ 
  origin: process.env.FRONTEND_URL || 'http://localhost:5173' 
}))

In production, FRONTEND_URL environment variable is required. The server will throw an error on startup if it’s missing.

Webhooks

The API exposes webhook endpoints for external services:

Clerk Webhooks

POST /clerk - Handles user lifecycle events (user.created, user.updated, user.deleted)

Razorpay Webhooks

POST /razorpay - Processes payment confirmation events (uses raw body parser)

Razorpay webhooks require raw body for signature verification, so they’re processed before the JSON body parser middleware.

Health Check

A simple health check endpoint is available:

GET /

Returns: "API Working"

SDK & Client Libraries

Currently, no official SDKs are provided. The frontend client uses direct fetch calls to the API endpoints.

Next Steps

Authentication

Learn how to authenticate requests using Clerk tokens

Endpoints

Browse all available API endpoints