Getting Started
Three steps to integrate NILVaultAI into your campus systems.
Generate API Key
Institution Admin → Settings → API Keys → Create
Make First Call
Test with curl against the athletes endpoint
Register Webhook
Receive real-time compliance alerts
Try It — Copy & Paste
curl -X GET "https://api.nilvaultai.com/v1/athletes?limit=1" \
-H "Authorization: Bearer nv_sk_live_YOUR_KEY_HERE" \
-H "Content-Type: application/json"API Overview
Base URL:
https://api.nilvaultai.com/v1Sandbox: https://api.sandbox.nilvaultai.com/v1
Free: 100/min · Institutional: 1,000/min · Enterprise: 5,000/min
application/json. Dates are ISO 8601. IDs are UUID v4.
X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset
Authentication
Include your API key in the Authorization header as a Bearer token.
Authorization: Bearer nv_sk_live_abc123def456API Keys
- • Scoped to a single institution
- • Generated in Dashboard → Settings → API Keys
- • Expire after 90 days with 14-day renewal reminder
- • Shown only once at creation — store in your secrets manager
SSO Options
- • OAuth 2.0 with PKCE for campus portal integrations
- • SAML 2.0 for Shibboleth, Okta, Azure AD
- • IP allowlisting for enterprise accounts
- • SSO = human login; API keys = server-to-server
Endpoints
8 core endpoints covering athletes, deals, compliance, webhooks, and tax.
SIS Integration
Connect NILVaultAI to your campus Student Information System in 2–3 business days.
Supported Systems
| SIS | Vendor | Method | Status |
|---|---|---|---|
| Banner | Ellucian | REST API + SFTP | Certified |
| Workday Student | Workday | REST API + Webhook | Certified |
| Colleague | Ellucian | REST API + SFTP | Certified |
| Campus Solutions | Oracle (PeopleSoft) | SFTP + REST API | Certified |
| PowerCampus | Ellucian | SFTP Batch | Certified |
| Custom / Homegrown | — | REST API + Webhook | Supported |
Integration Methods
SIS Security
All SIS data is encrypted in transit (TLS 1.3) and at rest (AES-256). No SIS credentials are stored by NILVaultAI — credentials are ephemeral, injected at runtime via a secrets manager. All traffic originates from static IP ranges provided during onboarding.
Data Mapping
SIS → NILVaultAI
├── Student Demographics
│ ├── student_id, first_name, last_name, email
│ └── date_of_birth
├── Enrollment
│ ├── enrollment_status (full_time, part_time, withdrawn)
│ └── academic_level, entry_date, expected_graduation_date
├── Athletics
│ ├── sport_code (NCAA standard: FB, MBB, WBB, etc.)
│ ├── position, roster_status
│ └── eligibility_status (eligible, ineligible, probation)
└── Academic
├── gpa_current, credit_hours_enrolled
└── academic_standingImplementation Timeline
| Day | Activity | Owner |
|---|---|---|
| 1 | Kickoff call: SIS type, auth method, data mapping review | NILVaultAI + IT Director |
| 1 | IP allowlisting & firewall rules (if applicable) | Campus IT |
| 2 | Connector configuration & test authentication | NILVaultAI Engineering |
| 2 | Sample data sync (test environment, ~10 records) | NILVaultAI + Campus IT |
| 3 | Full data sync validation & field mapping confirmation | NILVaultAI + Compliance |
| 3 | Go-live: production sync enabled, monitoring dashboard | NILVaultAI |
Webhooks & Events
Subscribe to real-time events for compliance, cap monitoring, and SIS sync.
Event Types
Payload Example
{
"id": "evt_1a2b3c4d...",
"type": "deal.created",
"created_at": "2025-06-25T16:45:00Z",
"data": {
"deal": {
"id": "deal_3f2e...",
"brand_name": "Local Auto Dealership",
"deal_value": 8500.00,
"status": "pending"
},
"athlete": {
"id": "ath_7f3a...",
"first_name": "Marcus",
"last_name": "Johnson",
"sport": "FB"
}
}
}Signature Verification (HMAC-SHA256)
Every webhook includes an X-NILVaultAI-Signature header. Verify it with your webhook secret.
const crypto = require('crypto');
function verifyWebhook(payload, signatureHeader, secret) {
const [tPart, v1Part] = signatureHeader.split(',');
const timestamp = tPart.split('=')[1];
const expectedSignature = v1Part.split('=')[1];
const signedPayload = `${timestamp}.${payload}`;
const expectedHash = crypto
.createHmac('sha256', secret)
.update(signedPayload)
.digest('hex');
return crypto.timingSafeEqual(
Buffer.from(expectedHash, 'hex'),
Buffer.from(expectedSignature, 'hex')
);
}Retry Logic
Failed deliveries are retried 3 times with exponential backoff: 1s, 5s, 25s. After final failure, the event is available for manual replay in the Dashboard. Your endpoint must return HTTP 200 within 30 seconds.
Security & Compliance
Data Retention
| Data Type | Retention |
|---|---|
| API logs | 90 days |
| Audit logs | 7 years (NCAA requirement) |
| Webhook logs | 30 days |
| SIS sync logs | 1 year |
SDKs & Libraries
Official SDKs coming Q3 2025: Node.js, Python, Ruby. Until then, use standard HTTP clients with our REST API.
Need a Technical Walkthrough?
Our integration engineers will review your SIS architecture, answer security questions, and provide a custom implementation timeline.
Book an Integration Call