Hi Linh,

That is correct. We consider our "AJAX" GraphQL API to be per-user communication. It does, however, assume that the user has an active session cookie for Totara, and that the cookie is being supplied with the request.

It is also considered to be an internal API, so not very well-documented and subject to change.

I'm sure our product team would be interested in knowing what you were hoping to implement.

Many thanks!