I can’t opt out of Aula. If I have children in a Danish public school, that’s where the school writes to me, where I report them sick, and where I find the weekly plan. Except the weekly plan isn’t even in Aula. It lives in Meebook, Min Uddannelse or EasyIQ, depending on what the school has picked. I can’t opt out of those either.
I’m fine with that. A shared channel between school and home makes sense, and someone has to choose it.
But when someone decides that I must use a particular portal, I think they owe me something in return: an official way to get to my own data. Not just through their screen, but through an API.
This isn’t a theoretical wish #
In Aula can’t win I wrote about my small app that shows my two kids’ homework side by side with a tick next to each item. It works. But look at what it rests on.
Aula has no official API. What I and others build on is the API Aula’s own app and website use. It isn’t documented, and nobody has promised it will keep working. It changes version a couple of times a year, and then the unofficial tools break until someone works out what changed.
Login goes through MitID, the Danish national digital ID. For a program to log in as me, the people behind aula-mcp have had to rebuild the entire MitID flow in code. It’s impressive work. And it can be stopped by bot protection that can’t tell a parent with a script from an attacker.
The homework sits with a third vendor. Aula issues a short-lived ticket for Meebook, and Meebook then wants a particular header containing my MitID username, or it won’t answer. You only find that out by watching over the shoulder of Aula’s website while it talks to Meebook. Someone has had to do that for every single vendor.
All of it is done by volunteers in their spare time. It’s not a foundation you can build anything lasting on. And it shouldn’t be necessary.
An API is also the safest option #
The objection I hear most is security. These are children’s data, after all.
But that’s exactly the point. Right now, the only way a tool can read my kids’ homework is by getting full access to my Aula login. The same login that can read every message, including the sensitive ones, and report my children sick. A tool that only needed to see the weekly plan gets the keys to the whole house.
An official API could do the opposite. It could give me a key that can only read homework and timetables, and can’t write anything. A key I can see in a list and revoke with one click. That’s how most large services work when you connect other programs to them. It’s far safer than what people do today, because they have no other choice.
And an API doesn’t open up anything new. It shows exactly what I can already see when I log in. The only difference is that a program reads it instead of my eyes.
The law doesn’t give it to us #
You’d think the GDPR would solve this. It gives a right to data portability: to receive your data in a machine-readable format. But that right doesn’t apply when a public authority processes data to carry out a task in the public interest. And that’s exactly what a municipality does in Aula.
The right of access still applies, but it gets me a printout, not access I can build on. So if we want APIs for the portals we’re required to use, they won’t come by themselves. Someone has to demand them. That’s true in Denmark, and it’s true anywhere else in the EU.
Who can do something #
Aula is bought by Denmark’s municipalities together, and it’s the schools and municipalities that pick Meebook and the others. Whoever pays can set requirements.
A requirement for an official API could be in every contract with a vendor of a portal citizens have to use. Yes, it costs something to build and maintain. But the vendors already have an API, because that’s what their own app talks to. What’s missing is documenting it, promising to keep it stable, and giving citizens a proper key.
What I’d ask for isn’t much:
- Documentation. Which data, which fields, what they mean.
- Stability. Changes announced well ahead, and old versions not shut down overnight.
- Scoped keys. Read access to what I choose and nothing else. Visible and easy to revoke.
- The same rules for vendors. Meebook, Min Uddannelse, EasyIQ and the others should meet the same bar when they sit behind a portal we can’t opt out of.
And it isn’t only about school. It applies everywhere the public sector has decided we must be.
What we’d get out of it #
When data is available, people build things no portal would ever prioritise. A homework list with ticks for two kids. A reminder when there’s a substitute in the first lesson. An overview for divorced parents that gathers everything in one place. Read-aloud for the dyslexic parent. A translation for the parent whose first language isn’t Danish.
Aula doesn’t have to build any of them. Aula just has to stop standing in the way.
The public sector has already shown it can do this. Denmark shares addresses, company registration numbers and other core data as open data, and a lot of good has been built on top. The only question is whether we may also build on the systems we’re required to use, with our own data.
I think the answer should be yes. If you agree, tell your municipality and your school board. And if you’d like to know more about what it takes technically, send me an email.