Skip to content
Developer Portal

Integrate NILVaultAI Into Your Campus Stack

REST API, SIS connectors, and real-time webhooks for NCAA compliance — built for IT Directors, loved by developers.

Getting Started

Three steps to integrate NILVaultAI into your campus systems.

Step 1

Generate API Key

Institution Admin → Settings → API Keys → Create

Step 2

Make First Call

Test with curl against the athletes endpoint

Step 3

Register Webhook

Receive real-time compliance alerts

Try It — Copy & Paste

curl -X GET "https://api.nilvaultai.com/v1/athletes?limit=1" \
  -H "Authorization: Bearer nv_sk_live_YOUR_KEY_HERE" \
  -H "Content-Type: application/json"

API Overview

Base URL:

https://api.nilvaultai.com/v1

Sandbox: https://api.sandbox.nilvaultai.com/v1

Rate Limits

Free: 100/min · Institutional: 1,000/min · Enterprise: 5,000/min

Content-Type

application/json. Dates are ISO 8601. IDs are UUID v4.

Rate Limit Headers

X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset

Authentication

Include your API key in the Authorization header as a Bearer token.

Authorization: Bearer nv_sk_live_abc123def456

API Keys

  • • Scoped to a single institution
  • • Generated in Dashboard → Settings → API Keys
  • • Expire after 90 days with 14-day renewal reminder
  • • Shown only once at creation — store in your secrets manager

SSO Options

  • • OAuth 2.0 with PKCE for campus portal integrations
  • • SAML 2.0 for Shibboleth, Okta, Azure AD
  • • IP allowlisting for enterprise accounts
  • • SSO = human login; API keys = server-to-server

Endpoints

8 core endpoints covering athletes, deals, compliance, webhooks, and tax.

SIS Integration

Connect NILVaultAI to your campus Student Information System in 2–3 business days.

Supported Systems

SISVendorMethodStatus
BannerEllucianREST API + SFTPCertified
Workday StudentWorkdayREST API + WebhookCertified
ColleagueEllucianREST API + SFTPCertified
Campus SolutionsOracle (PeopleSoft)SFTP + REST APICertified
PowerCampusEllucianSFTP BatchCertified
Custom / HomegrownREST API + WebhookSupported

Integration Methods

REST API (Real-Time)
NILVaultAI polls your SIS API endpoints at configurable intervals (default: every 15 minutes). Supports OAuth 2.0, API key, or Basic Auth.
SFTP Drop (Batch)
Your IT team exports scheduled CSV/JSON files to NILVaultAI’s SFTP endpoint. Files processed within 5 minutes of ingestion.
Real-Time Webhook (Push)
Your SIS pushes change events to NILVaultAI webhook endpoints. Lowest latency for critical events like eligibility changes.

SIS Security

All SIS data is encrypted in transit (TLS 1.3) and at rest (AES-256). No SIS credentials are stored by NILVaultAI — credentials are ephemeral, injected at runtime via a secrets manager. All traffic originates from static IP ranges provided during onboarding.

Data Mapping

SIS → NILVaultAI
├── Student Demographics
│   ├── student_id, first_name, last_name, email
│   └── date_of_birth
├── Enrollment
│   ├── enrollment_status (full_time, part_time, withdrawn)
│   └── academic_level, entry_date, expected_graduation_date
├── Athletics
│   ├── sport_code (NCAA standard: FB, MBB, WBB, etc.)
│   ├── position, roster_status
│   └── eligibility_status (eligible, ineligible, probation)
└── Academic
    ├── gpa_current, credit_hours_enrolled
    └── academic_standing

Implementation Timeline

DayActivityOwner
1Kickoff call: SIS type, auth method, data mapping reviewNILVaultAI + IT Director
1IP allowlisting & firewall rules (if applicable)Campus IT
2Connector configuration & test authenticationNILVaultAI Engineering
2Sample data sync (test environment, ~10 records)NILVaultAI + Campus IT
3Full data sync validation & field mapping confirmationNILVaultAI + Compliance
3Go-live: production sync enabled, monitoring dashboardNILVaultAI

Webhooks & Events

Subscribe to real-time events for compliance, cap monitoring, and SIS sync.

Event Types

deal.createdNormal
A new NIL deal has been submitted for an athlete
deal.approvedNormal
A deal has been approved by the compliance office
deal.flaggedHigh
A deal has been flagged for manual review
cap.threshold.reachedHigh
Roster cap is approaching its limit (≥80% used)
cap.exceededCritical
Roster cap has been exceeded — immediate action required
tax.filing.dueNormal
Quarterly tax filing deadline approaching for an athlete
audit.log.exportedNormal
A compliance audit log has been generated
sis.sync.completedNormal
SIS data sync has finished (success or failure)

Payload Example

{
  "id": "evt_1a2b3c4d...",
  "type": "deal.created",
  "created_at": "2025-06-25T16:45:00Z",
  "data": {
    "deal": {
      "id": "deal_3f2e...",
      "brand_name": "Local Auto Dealership",
      "deal_value": 8500.00,
      "status": "pending"
    },
    "athlete": {
      "id": "ath_7f3a...",
      "first_name": "Marcus",
      "last_name": "Johnson",
      "sport": "FB"
    }
  }
}

Signature Verification (HMAC-SHA256)

Every webhook includes an X-NILVaultAI-Signature header. Verify it with your webhook secret.

const crypto = require('crypto');

function verifyWebhook(payload, signatureHeader, secret) {
  const [tPart, v1Part] = signatureHeader.split(',');
  const timestamp = tPart.split('=')[1];
  const expectedSignature = v1Part.split('=')[1];
  const signedPayload = `${timestamp}.${payload}`;
  const expectedHash = crypto
    .createHmac('sha256', secret)
    .update(signedPayload)
    .digest('hex');
  return crypto.timingSafeEqual(
    Buffer.from(expectedHash, 'hex'),
    Buffer.from(expectedSignature, 'hex')
  );
}

Retry Logic

Failed deliveries are retried 3 times with exponential backoff: 1s, 5s, 25s. After final failure, the event is available for manual replay in the Dashboard. Your endpoint must return HTTP 200 within 30 seconds.

Security & Compliance

Annual Pen Testing
Independent security audits, report available under NDA
FERPA
Designated School Official for athletics compliance
TLS 1.3
All API and SIS traffic encrypted in transit
AES-256
All data encrypted at rest
API Key Rotation
90-day expiration with 14-day reminder
Audit Logs
Retained 7 years per NCAA requirements
HSM-Backed Keys
AWS KMS / Cloudflare Key Management
Pen Testing
Annual third-party security firm assessment

Data Retention

Data TypeRetention
API logs90 days
Audit logs7 years (NCAA requirement)
Webhook logs30 days
SIS sync logs1 year

SDKs & Libraries

Official SDKs coming Q3 2025: Node.js, Python, Ruby. Until then, use standard HTTP clients with our REST API.

Node.js
axios, fetch, undici
Python
requests, httpx
Ruby
httparty, faraday
Go
net/http, resty
Java
OkHttp, Spring WebClient
cURL
All endpoints documented with curl examples

Need a Technical Walkthrough?

Our integration engineers will review your SIS architecture, answer security questions, and provide a custom implementation timeline.

Book an Integration Call