v0.11.0 — the asset library

The asset library — the files courses are built from. list_assets and get_asset, over Skilljar's v1 API, because v2 has no assets endpoint at all. This is what resolves the content_asset_id that list_lessons returns.

Read this before using get_asset

get_asset returns a download_url, and that URL is the file, not a reference to it.

It is a presigned S3 link. Verified against the live API with a ranged GET carrying no authorization header: 206, application/pdf. It needs no Skilljar credentials, works for about an hour, and is different every time it is fetched.

So anyone who reads the URL can download the content — and none of this project's controls reach that far: not the capability profile, not the OAuth scope, not the API key. The exposure happens wherever the URL is read. Do not paste one into a transcript, a ticket or a screenshot, and do not store it, because it expires and then reads as a broken asset rather than an expired link.

Three things bound it: the listing carries no link at all, the warning travels in the payload rather than only the description, and it expires. Nothing prevents a model repeating the URL, which is recorded as an accepted risk rather than claimed as handled.

Also

aspect_ratio is not surfaced — it is 16:9 on all 157 assets in the reference organization, PDFs included, so it is a default rather than a measurement. type is returned as asset_type, because every v2 resource carries a JSON:API type.

v1's web-package endpoints are deliberately not added: v2 owns list, get and delete, and putting one capability on two backends with two data shapes is what ADR-002 forbids.

89 tools, 1095 tests. Python 3.10–3.14, Apache-2.0.