Blackbaud Authorization

The Blackbaud SKY API uses the OAuth 2.0 protocol to authorize API requests. This provides a mechanism for any application to access your Blackbaud data without exposing any user credentials (username/password) to your application. Instead, users must provide consent to your application to access data on their behalf.

That means, no users are required to be set up inside your School Information Management System(MySchoolApp) unlike in the ON API setup.

The BrightArrow Application is a verified registered application with the Blackbaud Marketplace. Your school administrator can add BrightArrow from market place and provide approval by activating the application within the Applications area. This is where School Admins can control which applications have access to their data, and at any time an administrator can de-activate any application and prevent future data access via the SKY API.

After our application is connected, We obtain consent from an authenticated Blackbaud user/Admin. Upon consent, an OAuth 2.0 access token will be issued to our application. This token is what gives us access to your School data’. This token is tied to the authenticated user's account and organization who gives us the consent, which means that our application can only access data to which the authenticated user can access within the system. This is where the SKY and ON API do things differently. In ON API a new user had to be created within your School’s SSMS and given certain roles which controlled what data access the user had. However, in SKY since no users are involved, the permission to access data is rather inherited from the Admin user that authenticates and gives consent to the BrightArrow Application.

Step 1: Check that the Blackbaud Admin account is connected to a Blackbaud ID

To authorize BrightArrow (or any other applications) to access your school’s data on behalf of you, SKY API requires at least one admin user to be authenticated with Blackbaud ID.

You can see whether your myschoolapp user account is connected to Blackbaud ID or not by viewing User information from People Finder within your myschoolapp admin account and scroll down to see the Login In Information section. If you see the following option it means this user account is not connected to the Blackbaud ID and you will need to connect it.

Click the ‘ Connect to Blackbaud ID’ button and follow the prompts. You will get an email invite which may take 5 or more minutes to arrive, and you may need to sign out of Blackbaud to be able to accept the invitation link you received in your email.

Check out the following Blackbaud documentation for detailed instruction on how you can enable Blackbaud ID for your school’s admin account:

Set up admin user to authenticate with Blackbaud ID

Step 2: Check the Role Setup inside of Blackbaud Education Management Core.

For the Blackbaud admin account from above:
Platform Manager role (security group) in Education Management's Core.
For the Blackbaud admin account above and BrightArrow user account in Blackbaud:
Must have the SKY API Basic, SKY API Data Sync, Sky Reporting roles (security groups). Please leave any other roles such as ON API access in place.

Step 3: Check to see if your Blackbaud’s Admin account is an Environment Admin of the Blackbaud instance

Your Blackbaud admin account from above also needs to be set as an Environment Admin within your school’s Blackbaud instance. You may have more than one instance depending on the products you use or any test databases you may have. To see if you have the required Environment Admin privilege, the easiest way is to go to the app marketplace and see if you can install the BrightArrow app. You can access the marketplace at:
https://app.blackbaud.com/marketplace/

Once there, find the tile for BrightArrow Mass Notifications and click on it. Once the page opens, if the blue button on the left says Connect, then you are an Environment Admin. Click on connect and follow the prompts. Be sure to link the correct instance for your Education Management. If you do not see the instance for your Education Management, then you are not an Environment Admin and need to follow the steps below.

If the blue button on the left says Get Started then you will need to add yourself as an Environment Admin

From your Admin page for Blackbaud, click on Settings, then Environment:

Your Environment(s) will now load:

To see who is currently an Environment Admin, click on the link Environment admins. To invite yourself as an Environment admin, click on the three dots and choose Invite environment admin:

Then fill out the form:

For detailed instruction on how you can view and manage Environment Admins checkout the following Blackbaud documentation: Become an Environment admin
You will then get an email to finish the process. Once you finish with the steps in the email you can return to the app Marketplace and the blue button for BrightArrow will say Connect.

You can access the marketplace at: https://app.blackbaud.com/marketplace/ Once there, find the tile for BrightArrow Mass Notifications and click on it. Once the page opens, if the blue button on the left says Connect, then you are an Environment Admin. Click on connect and follow the prompts. Be sure to link the correct instance for your Education Management. Make sure you use the same Blackbaud user account from steps 1-3 from above.

Step 4: Authenticate BrightArrow to use SKY API.

Once you have the BrightArrow app connected from the Marketplace, you can proceed with allowing BrightArrow to use the SKY API. This is done from the list settings page. Please sign in to BrightArrow with your Admin account, the one that is used to set up and modify users. If you do not know what account this is, please contact technical support.

This next step only needs to be completed once for your account, not once per list so BrightArrow has access to use the SKY API. After signing into BrightArrow, please click on a list name with the word (sync) behind it, such as All Students (sync) or All Faculty/Staff (sync) or All Staff (sync). This will vary depending on what was set up for your account. Once you are on the List Details page, please select List Settings:

Once you're on List Settings, click the "Reset BlackBaud SKY API" at the bottom of the page.

You will then be prompted to sign in to Blackbaud, please use the Account from steps 1-3 above. Once signed in, if everything is successful, you will see this:

When you click “Close” you will be brought back to the BrightArrow. Once all of the above steps are complete, please let BrightArrow Support know so we can test your setup and make sure your data is loading as expected. Please email them at gettechsupport@brightarrow.com.

Possible Errors

If you get the following error, there may be a step above that was not completed successfully:

Please review the steps outlined in the document and contact gettechsupport@brightarrow.com for further assistance. If needed we can set up a meeting to review your connection.