Cards API Overview

The Cards API manages interactive learning cards (quiz, content, boolean, image match, and more), decks, and trails (deckgroups) used by Card Creator and the course player.

Note: Served by Toolzz LXP API (Encore cards service), not by the institution monolith domain. Use the LXP API base URL (e.g. https://lxp.prod.api.toolzz.media). Paths are at the Encore root (no /api prefix).

Warning: Most Card Creator endpoints require an admin JWT. Player endpoints require a player JWT (local cards user). Institution scope always comes from the token.

Base URL

Environment	Example
Production	https://lxp.prod.api.toolzz.media
Local	http://localhost:4000

Authentication models

Role	How	Used for
Admin	LXP admin JWT (Authorization: Bearer) with institution privilege	Card Creator CRUD, uploads
Service account	POST /authenticate with cards admin credentials + institution_id	Monolith EncoreCardsGateway / service-to-service reads
Player	JWT that resolves to a local cards users row	Deckgroups, decks, progress, complete/uncomplete

Card types (source path segment)

type (path)	Description
quiz	Multiple choice
content	Text / video / audio content
images	Image correlation
boolean	True / false
words	Word correlation
gibbet	Hangman / discover the word
crosswords	Word search
phrase	Complete the sentence

Main resource groups

Group	Paths
Auth	POST /authenticate
Cards	/cards, /cards/:type, /cards/:id
Decks (admin)	/admin/decks
Trails (Edulabzz)	/trails
Upload	/upload/image, /upload/image/register
Player	/deckgroups, /decks/:id, /progress

Note: Edulabzz trails (/trails, deckgroups) are not the same as LXP course Trails documented under the Trails section.

Security

• HTTPS/TLS in all cloud environments.
• Data is scoped to the institution from the JWT.
• Admin writes stamp toolzz_institution_id from auth (body override must match when provided).