# Build Secure Moodle External APIs

Custom Moodle web services are easy to expose incorrectly or structure inconsistently. This skill provides patterns for parameters, permissions, registration, database access, testing, and troubleshooting.

## Install

```bash
npx skillstore add sickn33/moodle-external-api-development
```

## Metadata

- Status: approved
- Slug: sickn33-moodle-external-api-development
- Skillstore revision: r2
- Version status: missing
- Tree hash: 73cbbd6086cc2ccbe46e0d7199c27ab44f4455caea85d621596c6f6d407c765d
- Author: sickn33
- GitHub username: sickn33
- License: MIT
- Repository: https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/moodle-external-api-development
- Ref: 81e05e636292629114b76cbb3922fbe57672fc02
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: confirmation\_required
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: scripts, external\_commands, network
- Quality score: 38
- Quality tier: warning
- Public page: https://skillstore.pages.dev/skills/sickn33-moodle-external-api-development
- Manifest: https://skillstore.pages.dev/api/skills/sickn33-moodle-external-api-development/manifest

## Capabilities

- Explains the three-method Moodle external API structure.
- Shows parameter and return schemas for simple and nested values.
- Demonstrates context validation, capability checks, and parameterized queries.
- Covers service registration for REST and AJAX access.
- Provides testing, transaction, course module, group, and troubleshooting patterns.

## Use Cases

- Create a Plugin Endpoint: Draft a Moodle external function with validated parameters, permissions, return definitions, and service registration.
- Review an Existing Service: Check an endpoint for framework structure, database safety, permission enforcement, and response consistency.
- Connect an External Client: Plan REST or AJAX access, token usage, testing steps, and expected Moodle configuration.

## Prompt Templates

### Draft a Read Endpoint

```
Create a read-only Moodle endpoint for [resource]. Include parameter definitions, context validation, capability checks, return structure, and service registration.
```

### Review Endpoint Security

```
Review this Moodle endpoint for validation, context, capabilities, SQL safety, return accuracy, and information disclosure. Explain each required change.
```

### Design a Write Workflow

```
Design a transactional Moodle API that creates [activity]. Include rollback behavior, capability checks, idempotency decisions, and tests.
```

### Threat Model API Exposure

```
Compare REST and AJAX exposure for this Moodle function. Cover tokens, authorization, sensitive logging, rate limits, and failure responses.
```

## Limitations

- Examples use placeholders and require adaptation to each plugin and Moodle version.
- The skill does not inspect a live Moodle installation or execute tests.
- Some examples need stronger authorization, logging, and credential handling before production use.
- The referenced comprehensive quiz creation file is not included.

## Best Practices

- Validate parameters, context, and capabilities inside every endpoint.
- Use parameterized Moodle database methods and short transactions.
- Test authorized and unauthorized roles with production-safe logging enabled.

## Anti Patterns

- Do not trust a user identifier merely because it passed type validation.
- Do not log tokens, full SQL statements, or stack traces in production.
- Do not expose write functions without explicit capabilities and rollback tests.

## Security Audit

- Audited at: 2026-08-04T15:00:03.447\+00:00
- Summary: All 109 static findings are false positives caused by Markdown syntax, fixed Moodle examples, placeholder endpoints, or official documentation links. Semantic review found a high-severity authorization omission plus medium-severity logging and credential-handling risks in the guidance.

## Stats

- Views: 231
- Downloads: 8
- Favorites: 0
- Popularity score: 0