Enroll trust users with SIS ID via API

[Brandon_Brown]

Hello, We are looking for a way to enroll trust users via the API, using their sis_user_id (instead of Canvas user ID).

https://community.canvaslms.com/t5/Canvas-Admin-Blog/Trust-Account-User-Roles-and-Expectations/ba-p...

On the page above it states: "Trusts do not provide any automation for trust enrollments. Users are enrolled via CSV uploads or via the API." This seems to imply that it's possible to do, but there is no documentation on how to achieve it here: https://canvas.instructure.com/doc/api/enrollments.html. The missing piece seems to be passing the 'root_account' parameter that references the trusted/root account of the user. This is what enables trust enrollments to be processed via SIS upload using SIS ID. We've tried a few iterations of calls and none have worked for us yet.

Is there anyone who can confirm if this is possible and what the correct parameters are, if so? Here is an example call of what we're looking to do:

curl https://extendunh.test.instructure.com/api/v1/courses/618/enrollments \

-X POST \
-H 'Authorization: Bearer ABC123' \ (anonymized the token)
-F 'enrollment[user_id]=sis_user_id:923552219' \
-F 'enrollment[root_account]=unh.test.instructure.com' \
-F 'enrollment[type]=StudentEnrollment' \
-F 'enrollment[enrollment_state]=active' \
-F 'enrollment[course_section_id]=551' \
-F 'enrollment[notify]=false'

{"errors":[{"message":"The specified resource does not exist."}]}%

If we make the same call with a local (non-trust) user, omitting the [root account] parameter, the enrollment is processed successfully. If there is anyone out there that has accomplished trust enrollments via the API, we would be very appreciative to know how it was accomplished. If it's not possible, we will likely need to query to find the Canvas user id and enroll with that. 

Thanks in advance!

Brandon

Brandon Brown
Applications Administrator
Enterprise Technology & Services
University System of New Hampshire
Brandon.brown@unh.edu

[robotcars · Accepted solution]

@Brandon_Brown 

Have you tried the root account value without 'test'? Just use the production domain, even on test/beta.

edit:

While I recommend always using the production domain, even in test, this doesn't seem to be the cause of your troubles.

----

The api specifically uses root_account_id, not root_account, which will be in BIGINT. The easiest way I can suggest finding this is likely the link in the Admin Tray to the Root Account, while you're in the secondary instance dashboard. The link should contain the longid. Otherwise from the root account, open the Dev tools, and see ENV.DOMAIN_ROOT_ACCOUNT_ID.

Additionally. I was unable to use the sis_user_id helper in the enrollment[user_id] param, it only took my global id, and then root_account_id became unnecessary. Not sure root_account_id if passed is even used.

I'm submitting a ticket as this affects us (obviously and others) and the endpoint should utilize the helper and root account.

So the request will not work without the global id of the user.

If you want to enroll until this is fixed CSV Import will work if you use their SIS_ID and the Root_Account name.

[chriscas]

Hi @robotcars,

Did you every get any resolution to this issue?  I'm running into this exact problem now trying to enroll through a trust using the sis_user_id...  If you never got a resolution, would you be able to share your support ticket number so I can make a new support request and perhaps reference yours.

-Chris

[Brandon_Brown]

I really appreciate you taking a look at this - I'm still getting my feet wet working with the API! We may be able to accomplish what we need by querying the root account for the Canvas user ID, prepending the root_account_id value, and enrolling with that on the trust account side. That seems to be working properly and doesn't require the 'stub' user account to already exist in the secondary account. From what I can tell, the user doesn't show up in the secondary 'People' section until they've been enrolled in a course or have an admin role granted. 

Thanks again for the assist @robotcars!

[xcotto1]

Hi @Brandon_Brown 

I just made some testing on my end Beta instance and it worked for me using the SIS ID from the user. On my cURL command I use double quote on the Form to send the request.

curl https://jedi.beta.instructure.com/api/v1/courses/58794/enrollments -X POST -H "${LMS_JEDI_TOKEN}" -F "enrollment[user_id]=sis_user_id:xcotto" -F "enrollment[type]=StudentEnrollment" -F "enrollment[enrollment_state]=active" -F "enrollment[course_section_id]=61096" -F "enrollment[notify]=false" | json_pp

I hope this helps!

-Xavier 👾

[Brandon_Brown]

Thanks for also taking a look Xavier, much appreciated. Regular, single-instance enrollments work fine for us using the sis_id. That is actually what we use to process thousands of monthly enrollments.

We have a 'trust' set up between multiple instances and those enrollments aren't working the same way. We can use the enrollment API to enroll a user from instance A into instance B via Canvas global ID, but not by using sis_user_id. With a SIS .csv import/upload, there is a field for 'root_account' that you can use to query the sis_id on the root (non-local) instance. We were hoping that by including the root_account value as one of the request parameters it would help - but alas it did not. We have a workaround for now, but it would be great if that ability was added to the API in the future. 

[robotcars]

@xcotto1 

Is that a cross-shard request, involving 2 separate canvas databases?

ie. Is your user on one instance, but the enrollment is happening on another? In the Trust scenario there are 2 or more instances, where users may exist on 1 or another instance. I tried the example you shared against a second instance with my user is on another instance; and I got the same response, The specified resource does not exist.

[mary_speight]

We're looking to do the same thing. I'd love to know if anyone was able to get an API to enroll a student into their system with a different root account.

[chriscas]

Hi @mary_speight,

Assuming you have a trust set up, I'm told via my support ticket on this that a fix is in beta and if everything goes well it may be released to production next month.

-Chris

[edquistd]

I know I'm resurrecting this, but it seems to have been fixed. I enrolled someone from a trusted shard using the API, using only their sis_user_id and root_account to identify the user. Here's the curl, with the token stripped and any info stripped:

curl --location 'https://<url_of_shard_with_course>/api/v1/courses/210/enrollments' \
--header 'Authorization: ••••••' \
--form 'enrollment[type]="TeacherEnrollment"' \
--form 'enrollment[enrollment_state]="active"' \
--form 'root_account="<url_of_trusted_shard>"' \
--form 'enrollment[sis_user_id]="<sis_user_id>"'