Am I missing it or might it be something coming in the future?

Related, it would be amazing to have the ability to make intelligent agents student specific. So, students could choose how frequently they like to receive reminders about assignments, etc.

Auth 2.0 doesn't fit the task.

I used the instructions from the following link.

https://community.brightspace.com/s/article/API-Cookbook-Headless-Non-Interactive-Web-Service-Workflow

It says:
"You need to manually harvest the user tokens using a utility such as the API Test Tool (https://apitesttool.desire2learnvalence.com/) to authenticate with your LMS."

This is where I am stuck. The tool does NOT return the token, and it doesn't store the token in the cache either. The token in Local Storage expires in an hour.

Please, help.

What happens

The OIDC login initiation works correctly — Brightspace POSTs to our /login endpoint, we build the auth redirect with all required parameters and send the browser to /d2l/lti/authenticate. Instead of form-posting the id_token back to our redirect URI, the auth endpoint immediately returns a 302 to an error page:

/d2l/error/404/log?targetUrl=http://[instance]:80/d2l/lti/authenticate?[same params]

The targetUrl in the error redirect is our original request URL but with http:// and :80 substituted for https://.

Parameters we send to the auth endpoint

response_type=id_token
response_mode=form_post
prompt=none
scope=openid
client_id=…
redirect_uri=https://[our-tool]/api/lti/launch
login_hint=...
state=...
nonce=...
lti_message_hint=...

What we have ruled out

- redirect_uri matches the registration exactly
- client_id and deployment ID match the registration
- Tool registration is enabled
- Tested both iframe (with lti_storage_target) and new window (without) — same result both ways
- Removed Keyset URL and NRPS from the registration — no change
- D2L System Log on the instance shows no entries at all for these attempts
- Our server logs confirm the login route receives the request and issues the redirect correctly every time

What the error URL suggests

The instance sits behind a load balancer that terminates TLS, so internally the app server sees http://. The http://:80 in the error's targetUrl looks like Brightspace is constructing an internal redirect URL using the raw app-server base URL rather than the external HTTPS URL. We suspect this is a misconfiguration specific to the LTI auth endpoint on this instance rather than anything in our tool, but we'd like to rule out the tool side first.

Has anyone seen this pattern on a d2l-partners hosted instance? Specifically the http://hostname:80 appearing in the error redirect URL? Any known instance-level config that affects how the auth endpoint constructs internal URLs?

Does Brightspace have a process for service-to-service (S2S) authentication? To reiterate, we need to integrate with Brightspace's API without user interaction, using something like the client credentials OAuth 2.0 flow.

I can authenticate and get an access token if I log in as a user, but I can't find any documentation on how to authenticate machine-to-machine.

Thanks,
Richard

//Create User with guest role 109
URI createUserUri = userContext.createAuthenticatedUri("/d2l/api/lp/1.59/users/", "POST");
String screateUserUri = createUserUri.toString();
String createUserData = "{\n  \"OrgDefinedId\": \"" + strEmail +"\",\n  \"FirstName\": \"" + strFirstName + "\",\n  \"MiddleName\": \"\",\n  \"LastName\": \"" + strLastName +"\",\n  \"ExternalEmail\": \"" + strEmail + "\",\n  \"UserName\": \"" + strEmail + "\",\n  \"RoleId\": \"109\",\n  \"IsActive\": \"true\",\n  \"SendCreationEmail\": \"false\"\n}";
try {
String createResult = postData(screateUserUri,createUserData, "POST");
} catch (Exception e1) {
e1.printStackTrace();
}

//Assign a temporary password and turn on ForcePasswordReset
URI updateUserUri = userContext.createAuthenticatedUri("/d2l/api/lp/1.59/users/"+userId+"/password", "PUT");
String supdateUserUri = updateUserUri.toString();
String updateData = "{\n \"Password\": \"" + strEmail + "\", \n \"ForcePasswordReset\": true \n}";

try {
String updateResult = postData(supdateUserUri,updateData, "PUT");
} catch (Exception e2) {
 e2.printStackTrace();
}

In the D2L user configuration, the guest account was created by API call successfully with the option checked: Force password change on login.

What factors could cause the guest user login without password change prompted?

Thank you,
Phyllis

The .zip file DOES import through the Import/Export/Copy Components tool in Course Admin, but takes much longer, I'm assuming at the "conversion" step.

I assume the quizzes QTI import is much narrower than the Import/Export tool, but is there a specification for what's accepted there?

Any guidance is appreciated. thanks!

We are working on a requirement to integrate a third-party accessibility tool in our Brightspace environment. This integration requires loading a custom JavaScript file across course pages.

We would like to confirm whether Brightspace supports adding custom JavaScript at the theme level (for example, via the Theme Editor or any configuration setting).

Specifically, could you please clarify:

• Whether custom JavaScript can be enabled in the Brightspace theme
• If there is any configuration or supported method to include external JavaScript globally
• Any security restrictions or limitations associated with this
• Recommended alternatives if direct JavaScript injection is not supported

Our instance details are as follows:

• Brightspace URL: https://syllaworks.d2l-partners.brightspace.com
• Organization: Syllaworks

For context, this request is related to integrating an accessibility tool that requires frontend script execution.

We would appreciate your guidance on the supported approach.

Thank you for your assistance.

Best regards,
Kishan Kumar Yadav
Sr. Software Developer

Based on the documentation, it would appear that the only thing that should change is instead of using the GET verb, it should instead use DELETE. However, when trying to do this, it returns a 403 Forbidden error, despite using an administrator account and ensuring that the Role Permissions allowed for file creation and deletion.

Is there something I'm missing? I note that the documentation references JSON Parameters: DeleteFile -Delete file properties, although it doesn't actually provide any reference as to what this body should contain.

Thanks in advance!

Currently, the API calls within the widget function correctly when executed by a Super Admin, but they fail when initiated by a Module Leader.

Which specific roles and permissions in Brightspace need to be adjusted to allow the Module Leader to toggle this deployment via the API, without granting them full administrative access to the Tool Deployment area at the Org Unit level?

Reflection

📓 Consider the following: What type of digital media do you create or consume most — and why?

I don't want to link out to a survey for the response, but would love to have students write directly on the lesson page. I do not want this to be an assignment that teachers have to review/grade.