Short answer (updated October 21, 2026)
Cubite LMS includes a headless API, signed webhooks and an MCP server in its Growth plan at $290 a month or $2,900 a year.
Your own site or app runs the catalog, sign-up, checkout and learner dashboard and calls the REST API to enroll learners and sign them in. Lessons play in Cubite's courseware on your domain, which records progress; completions and quiz and assignment results come back as signed webhooks, and progress through the read endpoints. The API has no endpoint for a custom player to record lesson progress, since its progress writes are staff overrides such as marking a gating block complete, so a fully custom course player is not supported today.
Three parts, and where each one runs.
The catalog, sign-up, checkout and learner dashboard live in your own site or app. One API call enrolls a buyer by email and returns a single-use sign-in link for a passwordless account on your site, which every account the API creates is, so there is no second password to manage.
Lessons, quizzes, assignments and SCORM or xAPI packages play in Cubite's courseware, on your own domain and in your branding. That is where progress, scores and completions are recorded.
Signed webhooks report enrollments, completions, certificates and quiz and assignment results as they happen, and the read endpoints return progress, transcripts and certificates whenever your code asks.
The API has 121 endpoint rows under https://cubite.io/api/v1. Every request carries a scoped key in the X-Cubite-Key header; the API reference lists every current route with the scope it needs.
| Resource | What your code can do | Scopes |
|---|---|---|
| Courses | Create, update, duplicate and delete courses; read the lessons and replace them as a new version, with the version history kept. | courses:read, courses:write |
| Enrollments | Enroll a learner by email, finding or creating the account; change or revoke an enrollment; read each learner's progress and completion date. | enrollments:read, enrollments:write |
| Users and sign-in links | Create passwordless learner accounts and mint a single-use sign-in link, valid for 24 hours, that opens the page you choose. Links are issued only for passwordless learners whose account is on your site alone. | users:read, users:write |
| Groups | Run cohorts with their members and leaders. | groups:read, groups:write |
| Learning paths | Build multi-course paths with steps and prerequisites, enroll learners and list their progress. | learning-paths:read, learning-paths:write |
| Certificates | Issue, list, revoke and re-render certificates; each has a statement code and a public verify URL, plus an expiry date when the course sets a validity period. | certificates:read, certificates:write |
| SCORM and xAPI packages | Upload a package as a file or from a hosted zip URL; Cubite validates it, detects SCORM or xAPI and returns the id to place in a lesson. | packages:read, packages:write |
| Reports | Fourteen reports, from the site overview and the completion funnel to at-risk learners and revenue. | reports:read for aggregates; members:read where learners are named; payments:read for revenue and paid-but-not-enrolled |
| Pages, blog and site | Publish blog posts, edit any page, rebuild the homepage and change an allow-list of site settings: branding, SEO, layout and flags. | pages:read, pages:write, site:read, site:write |
| Webhooks | List subscriptions and read each one's delivery log; subscriptions themselves are created in the admin. | webhooks:read |
| Search | Find courses, pages, blog posts and learning paths by keyword, with their public URLs. | any content read scope |
Also in the API: question banks, discussions, grading, forms, announcements, email templates and media.
Create a webhook in Admin, under your site's Integrations tab: an HTTPS endpoint, the events it wants or all of them, and a signing secret shown once. Each delivery is a JSON body with id, type, occurredAt, siteId and data, and three headers. In production, deliveries go through a queue that retries a failed delivery up to five times. The delivery log records each hand-off to that queue, not your endpoint's reply to each retry.
X-Cubite-Event: the event type.X-Cubite-Signature: sha256= followed by the hex HMAC-SHA256 of the raw body, keyed with the subscription's secret.X-Cubite-Delivery-Id: the delivery's id, the same one the delivery log shows.import { createHmac, timingSafeEqual } from "node:crypto";
// rawBody: the request body exactly as received; header: X-Cubite-Signature
const expected = "sha256=" + createHmac("sha256", secret).update(rawBody, "utf8").digest("hex");
const a = Buffer.from(expected);
const b = Buffer.from(header ?? "");
const ok = a.length === b.length && timingSafeEqual(a, b);enrollment.createdcourse.completedcertificate.issuedquiz.passedquiz.failedform.submittedassignment.submittedassignment.passedassignment.failedassignment.returnedopen_response.submittedopen_response.self_assessedopen_response.peer_assessedopen_response.staff_assessedopen_response.passedopen_response.failedopen_response.retriedcurl -X POST https://cubite.io/api/v1/enrollments \
-H "X-Cubite-Key: ck_..." \
-H "Content-Type: application/json" \
-d '{"email":"buyer@example.com","courseId":"...","redirectTo":"/course/your-course/courseware","externalReference":"order-1042"}'Cubite's hosted MCP server exposes 137 tools over the same API, so Claude, ChatGPT or your own agent can build a course, enroll a cohort or pull a report within the scopes you grant it. Claude and ChatGPT connect with a browser sign-in (OAuth 2.1, open to any client that supports it); other clients use a scoped key. See the MCP server or the tasks it runs, with a safety checklist.
A headless LMS, sometimes called a headless learning system, keeps courses, enrollments, progress and certificates in the platform and lets your own site or app build the experience around them through an API. Cubite LMS does this with a REST API, signed webhooks and an MCP server, included in its Growth plan at $290 a month or $2,900 a year.
Not through the public API today. Lessons, quizzes and SCORM or xAPI packages play in Cubite's courseware on your domain, which records progress; your front end sends learners there with a single-use sign-in link, reads their progress back through the API and receives completions and results as webhooks.
Each delivery carries an X-Cubite-Signature header: sha256= followed by the hex HMAC-SHA256 of the raw JSON body, keyed with the subscription's secret, which the admin shows once. Compare it in constant time before you trust the payload.
Enrolling a learner through the API returns magicLinkUrl, a single-use sign-in link valid for 24 hours, or 7 days when you send sendInvite: true and Cubite emails it. It is issued for a passwordless account that belongs to your site only, which every account the API creates is; for any other account magicLinkUrl is null and the learner signs in their usual way. POST /api/v1/users/invite mints a new link for an existing learner, with a redirectTo path to open, and the new link replaces any earlier one.
Yes. https://cubite.io/developers lists all 121 endpoint rows under /api/v1 with the scope each needs, the error and rate-limit conventions and the webhook headers.
No. The REST API, the webhooks and the MCP server are included in Cubite LMS Growth at $290 a month or $2,900 a year, with unlimited learners.
120 writes and 600 reads a minute per API key. A key past either limit gets a 429 response with a Retry-After header.
Book a 30-minute walkthrough of the API, the webhooks and the MCP server, and bring the flow your own front end needs. The API is included in Growth at $290 a month.
Send us a message and we'll get back to you shortly.