Free

Timora Open API

Connect university schedules to your bot, website or app. A student's personal data — profile, grades, deadlines and certificates — only with their consent, via “Sign in with Timora”. Read-only access.

Get access — @timora_support Rules

Tokens are not issued on the website. The Timora team grants API access personally — write on Telegram to @timora_support: who you are, what the project is, what data you need and where the code will live.

What you can get

Data the API provides

Public

A project token is enough. The same data that is visible on the website without signing in.

institutionsuniversities and colleges: name, city, what's available
groupsthe university's study groups
schedulea group's classes by day — up to 31 days per request
teachersteachers (SibSUTIS)
examsexams, pass/fail tests and consultations

With the student's consent

The student decides which sections to open access to and can revoke it at any time.

profilename, group and university
schedulethe student's group schedule
gradesgrades from EIOS
deadlinesunsubmitted assignments and tests from EIOS courses
certificatescertificate requests and their statuses

How to get access

Four steps to the first request

Write to @timora_support

Tell us about the project: what it does, what data it needs, where the code will live. If it's on GitHub, send the link.

Accept the rules

Crediting Timora, co-authorship on GitHub, security requirements — further down this page.

Get a project token

The tmr_… token is issued personally and shown once. Timora stores only its fingerprint — if you lose it, we'll issue a new one.

Make requests from your server

The API address is https://mytimora.ru/api/v1, the header is Authorization: Bearer tmr_….

Personal data — only with consent

The student confirms the sign-in wherever they are already signed in to Timora: in the iOS or Android app, in the Telegram bot or in the Telegram and VK mini apps. Your project sees neither passwords nor sign-in data.

Rules

Requirements for projects

By receiving a token you accept these terms. If they are broken, the token is revoked without warning — together with all students' access to your project.

Crediting Timora

In the project's interface — “Powered by Timora” with a link to mytimora.ru: on the “About” screen, in the website footer or in the bot's description.
In the README and description — that the project uses the Timora open API.
You may not present Timora's name, logo and design as your own. The project must not look like an official Timora client.

GitHub

If the project's code is on GitHub (public or private repository), add @y0rence as a collaborator: Settings → Collaborators → Add people.
Mention @y0rence in the contributors section of the README.

Token security

The project token is a secret. It lives only on your server: in environment variables or a secret store.
Not in code, not in git, not in a mobile app and not in browser or mini app JavaScript.
HTTPS only, with certificate verification. If a token leaks, write to @timora_support right away: we'll revoke the old one and issue a new one.

Students' data

Don't ask students for their EIOS passwords or Timora sign-in codes — only “Sign in with Timora”.
Request only the sections you need: the student sees them on the consent screen.
Store student tokens encrypted. If a student signs out, call POST /me/disconnect and delete the token.
Use the data only for the feature access was granted for. Don't share or sell it, don't use it for advertising or model training, delete it when the student asks. Comply with Russian Federal Law 152-FZ.
Show the student that they signed in with Timora and give them a sign-out button.

Limits and caching

Cache public data: a group's schedule — no more often than once every 10–15 minutes.
On a 429 response, wait as many seconds as the Retry-After header says.

Prohibited

Bypassing limits: multiple tokens, changing addresses.
Bulk data scraping.
Reselling API access.

Reference

For those who already have a token

The address is https://mytimora.ru/api/v1. Responses are JSON, dates in responses are dd.mm.yyyy, in parameters — yyyy-mm-dd or dd.mm.yyyy. Errors — {"detail": "text"}.

Headers

Header	When
`Authorization: Bearer tmr_…`	always — the project token
`X-Timora-User: tmu_…`	for `/me/…` — the student token from “Sign in with Timora”

Public data

Method	Returns
`GET /institutions`	universities: `id`, `name`, `short`, `city`, `features`
`GET /groups?institution=nstu`	the university's groups
`GET /schedule?institution=nstu&group=ПМИ-31&from=2026-10-05&to=2026-10-11`	classes by day, up to 31 days per request
`GET /teachers?institution=sibsutis`	teachers (SibSUTIS)
`GET /exams?institution=sibsutis&group=ИП-514`	exams, pass/fail tests, consultations

“Sign in with Timora”

POST /connect/start with the body {"scopes": ["profile", "schedule", "grades"]} → deviceCode, userCode (like ABCD-EFGH), expiresIn (600 s), interval (3 s) and links: telegram, vk, app — links the student uses to confirm the sign-in.

Show the student the code and the buttons “Confirm in Telegram”, “in the Timora app”. Every interval seconds call POST /connect/poll with {"deviceCode": "tmc_…"}: the response is pending, slow_down, denied, expired or approved with a userToken (tmu_…), which is issued once.

Without scopes, profile and schedule are requested.

Student data

Both headers are required. Access only to the sections the student allowed, otherwise 403.

Method	Section	Returns
`GET /me`	profile	`id` (unique per project), first name, surname, group, university, sign-in methods
`GET /me/schedule?from=…&to=…`	schedule	the student's group schedule
`GET /me/grades`	grades	grades (SibSUTIS, if the student keeps the EIOS password in Timora)
`GET /me/deadlines`	deadlines	unsubmitted assignments and tests from EIOS courses
`GET /me/certificates`	certificates	certificate requests and their statuses
`POST /me/disconnect`	—	sign-out: the project's access to the student's account ends

401 on /me/… — the student revoked access (in the Timora profile or with the /apps command in the bot) or the project token was revoked. 409 — the student lacks the data: no group selected or EIOS not connected.

Limits

300 requests per minute per token for public data, separately for each student;
grades — 30, deadlines — 40, certificates — 20 requests per hour per student: these are requests to the university website;
connect/start — 600 per hour per project.

Example request

curl -s https://mytimora.ru/api/v1/schedule \ -H "Authorization: Bearer $TIMORA_TOKEN" \ --get --data-urlencode "institution=nstu" --data-urlencode "group=ПМИ-31" \ --data-urlencode "from=2026-10-05" --data-urlencode "to=2026-10-11"