Blackboard

This step requires a Blackboard System Administrator — a developer cannot perform it. Have your institution's Blackboard SysAdmin log in to the Blackboard Admin Panel. Navigate to Integrations → REST API Integrations (the exact menu path may vary slightly between Blackboard Learn versions — search for 'REST API Integrations' in the admin search bar if needed). Click 'Create Integration.' Complete the required fields: Application ID (this will be system-generated or manually entered depending on your version), Description (name the integration clearly, e.g., 'Bubble Dashboard — IT Dept'), User (assign the integration to a system admin account that has the appropriate course and grade access), End User Access (typically 'Yes' for server-to-server integrations), and Authorized To Act As User (set to 'Service Document' for client credentials flow). After clicking Submit, the Admin Panel displays the Application ID and Application Secret. The Application Secret is shown **only at this moment** — it is never displayed again in the UI. The SysAdmin must copy and securely transmit the Application ID and Application Secret to the development team immediately. If the secret is lost, the SysAdmin must delete the integration record and create a new one to generate fresh credentials. This institutional registration step is the single most common project blocker for Blackboard integrations — schedule it well in advance of your development start date.

1// Blackboard REST API Integration registration
2// Location: Blackboard Admin Panel → Integrations → REST API Integrations
3//
4// Fields to complete:
5//   Application ID:       system-generated or enter from your developer portal
6//   Description:          'Bubble Dashboard - [Department Name]'
7//   User:                 service account with System Administrator role
8//   End User Access:      Yes
9//   Authorized To Act As User: Service Document
10//
11// After clicking Submit:
12//   Application ID:     abc12345-xxxx-xxxx-xxxx-xxxxxxxxxxxx
13//   Application Secret: [shown ONCE — copy immediately]
14//
15// Blackboard Learn base URL for API calls:
16//   https://learn.youruniversity.edu  (your institution's hostname)
17//
18// OAuth 2.0 token endpoint:
19//   POST https://learn.youruniversity.edu/learn/api/public/v1/oauth2/token

With your Application ID and Application Secret in hand, open your Bubble app. Click 'App Data' → 'Environment Variables' in the left sidebar. Click 'Add a new environment variable.' Name: `BB_APPLICATION_ID`, Value: your Blackboard Application ID. Save. Add a second variable. Name: `BB_APPLICATION_SECRET`, Value: your Application Secret. Save. These are now accessible in Backend Workflow steps as `App variable - BB_APPLICATION_ID` and `App variable - BB_APPLICATION_SECRET`. Next, install the API Connector: Plugins tab → 'Add plugins' → search 'API Connector' → Install. It is free. Return to the Plugins tab and click 'API Connector' → 'Add another API.' Name it 'Blackboard.' Root URL: `https://learn.youruniversity.edu/learn/api/public` (replace with your institution's actual hostname). This root URL includes the `/learn/api/public` path prefix that all Blackboard REST API endpoints share. You will add individual version-specific calls under this group.

1// Bubble Environment Variables
2// App Data → Environment Variables
3//
4// Variable 1:
5//   Name:  BB_APPLICATION_ID
6//   Value: your-application-id-here
7//
8// Variable 2:
9//   Name:  BB_APPLICATION_SECRET
10//   Value: your-application-secret-here
11//
12// Bubble API Connector — Blackboard group
13{
14  "api_group_name": "Blackboard",
15  "root_url": "https://learn.youruniversity.edu/learn/api/public",
16  "note": "All Blackboard REST API calls start with this base path.",
17  "api_versions": {
18    "v1": "users, legacy course data",
19    "v2": "gradebook, Grade Journey API",
20    "v3": "courses with best pagination"
21  }
22}

Inside the Blackboard API group, click 'Add call.' Name it 'Get Blackboard Token.' Set the method to POST. Set the endpoint to `/v1/oauth2/token` (appended to your root URL, the full call is `https://learn.youruniversity.edu/learn/api/public/v1/oauth2/token`). In Bubble's API Connector, find the 'Authentication' section for this call. Select 'Basic Auth.' Enter the Application ID as the Username and the Application Secret as the Password — or, to use Environment Variables, enter `[App variable - BB_APPLICATION_ID]` and `[App variable - BB_APPLICATION_SECRET]` using Bubble's dynamic expression syntax in those fields. This is Bubble's built-in Basic Auth support, which automatically encodes the credentials in the Authorization header as Base64. Set the body type to 'Form Data' (NOT JSON). Add one body parameter: Key = `grant_type`, Value = `client_credentials`. Set 'Use as' to 'Action' (since this call returns an auth token, not data to display). Click 'Initialize call.' Bubble sends the POST with your Basic Auth credentials and the form body. Blackboard's token endpoint should return `{"access_token": "...", "token_type": "bearer", "expires_in": 3600}`. Bubble detects these fields. Click 'Save.' This 'Get Blackboard Token' call is the entry point for every Blackboard session in your Bubble app — you will call it at page load before making any data queries.

1// Bubble API Connector — 'Get Blackboard Token' call
2{
3  "call_name": "Get Blackboard Token",
4  "method": "POST",
5  "endpoint": "/v1/oauth2/token",
6  "use_as": "Action",
7  "authentication": {
8    "type": "Basic Auth",
9    "username": "[App variable - BB_APPLICATION_ID]",
10    "password": "[App variable - BB_APPLICATION_SECRET]"
11  },
12  "body_type": "Form Data",
13  "body_params": [
14    { "key": "grant_type", "value": "client_credentials" }
15  ]
16}
17
18// Expected Blackboard response (200 OK):
19{
20  "access_token": "eyJhbGciOiJIUzI1NiJ9...",
21  "token_type": "bearer",
22  "expires_in": 3600,
23  "scope": "read"
24}
25
26// Token is valid for 3600 seconds (1 hour)
27// Store in Custom State: Page's access_token (text)
28// All subsequent calls use: Authorization: Bearer [access_token state]

Now add the data retrieval calls under the Blackboard API group. First, add a shared header at the group level that will use the token. In the Blackboard API group, under 'Shared headers,' add: Key = `Authorization`, Value = leave it empty or `Bearer <dynamic>` — mark this header as 'Private.' For each API call, you will override this with the actual token value from the page's Custom State. Now add the first data call: name it 'Get Courses (v3).' Method: GET. Endpoint: `/v3/courses`. Add query parameters: `limit` (default value `100`), `offset` (for pagination, default `0`), `fields` (optional: `id,courseId,name,description,enrollment.count`). Set 'Use as' to 'Data.' For the Authorization header in this specific call, set the value to dynamically reference your page's Custom State that stores the access token: `Bearer [Custom State access_token's value]`. Mark it Private. Add a second data call: 'Get Course Enrollments (v1).' Method: GET. Endpoint: `/v1/courses/<id>/users`. Add a `id` path parameter (dynamic). Add query parameters: `role` (optional: `Student`), `limit` (`100`). Set 'Use as' to 'Data.' On your Bubble page, create a Custom State: name it `bb_access_token`, type: text. Create a second Custom State: `bb_token_expires_at`, type: date. In the page's workflow for 'When Page is Loaded,' add: Call Blackboard - Get Blackboard Token; then 'Set state' → `bb_access_token = result of step 1's access_token`; `bb_token_expires_at = Current date/time + 3600 seconds`.

1// Bubble API Connector — Blackboard data calls
2
3// Call 1: Get Courses (v3)
4{
5  "call_name": "Get Courses v3",
6  "method": "GET",
7  "endpoint": "/v3/courses",
8  "use_as": "Data",
9  "headers": [
10    {
11      "key": "Authorization",
12      "value": "Bearer <dynamic — Custom State bb_access_token>",
13      "private": true
14    }
15  ],
16  "parameters": [
17    { "key": "limit", "value": "100" },
18    { "key": "offset", "value": "0" },
19    { "key": "fields", "value": "id,courseId,name,description" }
20  ]
21}
22
23// Blackboard v3 course response:
24{
25  "results": [
26    {
27      "id": "_12345_1",
28      "courseId": "CS101-Fall2026",
29      "name": "Introduction to Computer Science",
30      "description": "...",
31      "enrollment": { "count": 45 }
32    }
33  ],
34  "paging": {
35    "nextPage": "/v3/courses?offset=100&limit=100"
36  }
37}
38
39// ID TYPES — critical distinction:
40// id: '_12345_1'       → use in API PATH PARAMETERS
41// courseId: 'CS101-...' → use for DISPLAY only
42// Wrong: /v3/courses/CS101-Fall2026/users → 'course not found' error
43// Correct: /v3/courses/_12345_1/users

Blackboard bearer tokens expire after exactly 3600 seconds (one hour). A Bubble dashboard session that runs longer than one hour will silently fail all Blackboard API calls — Blackboard returns 401 Unauthorized, which in Bubble typically results in empty Repeating Groups or silent no-results rather than a visible error message. Build a visible expiration indicator and a refresh mechanism. On your dashboard page header, add a Text element showing 'Session expires at: [bb_token_expires_at formatted as HH:MM AM/PM].' Add a Button labeled 'Reconnect Blackboard Session.' This button's workflow: Call Blackboard - Get Blackboard Token → Set state bb_access_token = result's access_token → Set state bb_token_expires_at = Current date/time + 3600 seconds. Optionally, add a visible countdown using a condition: when Current date/time > bb_token_expires_at - 5 minutes, show a 'Session expiring soon — click Reconnect' alert element. For the course catalog Repeating Group: set 'Type of content' to the Blackboard Get Courses v3 result type. Set 'Data source' to 'Get data from external API → Blackboard → Get Courses v3.' Add filtering and sorting controls as needed. When displaying a course's ID in a CTA button that links to Blackboard Learn's web interface, use the `courseId` field (human-readable like 'CS101-Fall2026') to construct the Blackboard web URL. Use the `id` field (like `_12345_1`) only when making API path parameter calls.

1// Bubble page — token lifecycle management
2
3// Custom States on page:
4//   bb_access_token     (text)   — current bearer token
5//   bb_token_expires_at (date)   — when token expires
6
7// 'When Page is Loaded' workflow:
8//   Step 1: Call Blackboard - Get Blackboard Token (Action)
9//   Step 2: Set state bb_access_token = Step 1's access_token
10//   Step 3: Set state bb_token_expires_at = Current date/time + 3600 seconds
11
12// 'Reconnect' button workflow (identical to page load):
13//   Step 1: Call Blackboard - Get Blackboard Token
14//   Step 2: Set state bb_access_token = Step 1's access_token
15//   Step 3: Set state bb_token_expires_at = Current date/time + 3600 seconds
16
17// Expiry alert condition:
18// Show 'Session expiring soon' element when:
19//   Current date/time > bb_token_expires_at - 5 minutes
20
21// Course Repeating Group data source:
22//   Get data from external API → Blackboard → Get Courses v3
23//   Authorization: Bearer [bb_access_token Custom State]
24
25// Display courseId (human-readable) for UI labels
26// Use id (internal, starts with _) for API path parameters only

Student enrollment records, grade data, and personal information retrieved from Blackboard are governed by FERPA in the United States. Any Bubble Data Type that stores synced Blackboard data must have strict privacy rules preventing unauthorized access. In Bubble's Data tab → Privacy, for each Data Type that holds Blackboard data (course records, enrollment records, grade snapshots): create a rule that restricts 'Find this in searches' and 'See all fields' to users with the appropriate role. Add a `role` field to the Bubble User type (an Option Set with values: SystemAdmin, DepartmentHead, Advisor, Viewer) or a simpler `is_authorized_staff` yes/no field. Set the privacy rule condition: 'Current User is logged in AND Current User's is_authorized_staff = yes.' Under 'When rule does NOT apply' — uncheck everything: anonymous users and non-staff logged-in users cannot see any Blackboard data. Additionally, protect the entire Bubble app: add a 'When Page is Loaded' condition on every page that checks whether the current user is logged in and is authorized staff — redirect to a login page if not. Because this Bubble app handles FERPA-protected student records, consult your institution's data privacy officer before deploying. If RapidDev can assist you design the role-based access model for your institution's requirements, reach out for a free scoping call at rapidevelopers.com/contact.

1// Bubble Data tab → Privacy
2// Apply to: every Data Type storing Blackboard data
3
4// Privacy Rule: 'Authorized Staff Only'
5// Condition: Current User is logged in
6//        AND Current User's is_authorized_staff = yes
7//
8// When rule applies:
9//   [x] Find this in searches
10//   [x] See these fields → All Fields
11//
12// When rule does NOT apply:
13//   [ ] Find this in searches    (blocked)
14//   [ ] See any fields           (blocked)
15//
16// Bubble User type additions:
17//   is_authorized_staff  (yes/no, default: no)
18//   role  (Option Set: SystemAdmin, DepartmentHead, Advisor, Viewer)
19//
20// Page-level access control (every page):
21// 'When Page is Loaded' condition:
22//   When Current User is logged out OR Current User's is_authorized_staff = no
23//   → Redirect to /login
24//
25// FERPA note:
26// Never expose student grade, enrollment, or PII data
27// to any user without verified institutional authorization.