Creating Dispatch Packages

Step-by-step guide to creating SCORM dispatch packages for third-party LMS distribution.

Table of Contents

• Prerequisites
• Creating via Dashboard
• Creating via API
• Configuration Options
• Downloading the Package
• Best Practices

Prerequisites

• SCORM API account with active subscription
• At least one uploaded SCORM package
• API key with public_api, internal_product, or admin scope (for API method)

Creating via Dashboard

Step 1: Navigate to Dispatch Page

1. Sign in to your SCORM API dashboard
2. Navigate to Dashboard → Dispatch
3. Click "Create Dispatch"

Step 2: Select Source Package

1. Choose a SCORM package from the dropdown
2. Packages are listed by title and version
3. Only packages you own are available

Step 3: Configure Dispatch

Fill in the dispatch configuration:

• Dispatch Name (optional): Friendly name for this dispatch
• Client Name (optional): Name to distinguish multiple dispatches of the same package
• Registration Limit (optional): Maximum number of unique registrations
• Expires In Hours (optional): Hours until dispatch expires
• Allowed Domains (optional): List of allowed domain names
• Access Password (optional): Learner challenge before a protected launch
• Postback URL + Secret (optional): Signed completion callback to your system

Step 4: Create and Download

1. Click "Create Dispatch"
2. Wait for package generation (typically <5 seconds)
3. Click "Download ZIP" to download the dispatch package
4. Copy the Launch URL for reference

Creating via API

Create Dispatch Endpoint

curl -X POST https://app.allureconnect.com/api/v1/packages/pkg_abc123/dispatches \
  -H "Authorization: Bearer your-api-key" \
  -H "Content-Type: application/json" \
  -d '{
    "label": "Safety Training - Client A",
    "destination": "client-a-lms",
    "registration_limit": 1000,
    "expires_in_hours": 8760,
    "allowed_domains": ["client-a-lms.com", "training.client-a.com"]
  }'

Response:

{
  "dispatch": {
    "id": "dispatch_xyz789",
    "packageId": "pkg_abc123",
    "status": "active",
    "launchUrl": "https://app.allureconnect.com/player/dispatch/dispatch_xyz789",
    "expiresAt": "2027-01-15T10:30:00.000Z",
    "registrationLimit": 1000
  },
  "dispatch_url": "https://app.allureconnect.com/player/dispatch/dispatch_xyz789"
}

dispatch_url / dispatch.launchUrl is a durable record-backed handoff URL. Store that URL in the external LMS or dispatch ZIP; Connect mints the short-lived learner session only when the learner launches.

Dispatch ZIP

ZIP export is available from the customer dashboard. API clients should persist dispatch_url / dispatch.launchUrl as the stable LMS handoff URL; do not persist a learner session launch_url.

Configuration Options

Dispatch Name

Purpose: Friendly identifier for the dispatch package.

Example: "Safety Training - Q1 2025"

Use When:

• You have multiple dispatches of the same package
• You want to distinguish dispatches in your dashboard
• You need human-readable identifiers

Client Name

Purpose: Distinguish multiple dispatches of the same package to different clients.

Example: "Client A", "Client B"

Use When:

• Distributing same package to multiple clients
• Need to track usage per client
• Want to generate client-specific reports

Registration Limit

Purpose: Maximum number of unique registrations allowed.

Example: 1000 registrations

What Counts:

• Each unique user_id that launches the dispatch
• Counted across all LMSs using this dispatch
• Increments on first launch per user

Use When:

• You want to limit total usage
• You have usage-based pricing
• You need to control distribution scope

Expires In Hours

Purpose: Set expiration time for the dispatch package.

Example: 8760 hours (1 year)

Behavior:

• Dispatch becomes inactive after expiration
• Existing launches may continue
• New launches are blocked

Use When:

• You have time-limited content
• You want to enforce subscription periods
• You need to control access duration

Allowed Domains

Purpose: Restrict which domains can launch the dispatch.

Example: ["client-a-lms.com", "training.client-a.com"]

Behavior:

• Only requests from allowed domains are accepted
• Referrer header is checked
• Helps prevent unauthorized usage

Use When:

• You want to restrict to specific LMSs
• You need domain-based access control
• You want to prevent unauthorized distribution

Access Password

Set an access password when the learner must pass an additional challenge at /player/dispatch/{dispatchId}. Connect stores a peppered HMAC, never the plaintext password. Set a new password or clear the existing one from the signed-in dispatch detail panel.

Signed Postback

Provide both postback_url and a postback_secret of at least 16 characters. Connect signs the completion payload and records delivery status. Partner API clients can retry the latest failed delivery with POST /api/v1/dispatches/{id}/retry.

Downloading the Package

Via Dashboard

1. Navigate to Dashboard → Dispatch
2. Find your dispatch package
3. Click "Download ZIP"
4. Save the file to your computer

Via API

Create the durable dispatch record with POST /api/v1/packages/{packageId}/dispatches, then place the returned dispatch_url in your LMS launch wrapper or SCORM manifest. Do not call dashboard-only customer routes with API keys.

Best Practices

1. Use Descriptive Names

{
  "label": "Safety Training - Client A - Q1 2025",
  "destination": "client-a-lms"
}

2. Set Appropriate Limits

• Registration Limit: Based on expected usage
• Expiration: Based on content lifecycle

3. Plan the Lifecycle

The dashboard supports pause, resume, archive, restore, extend, and delete. When no dispatch expiry is set, the signed handoff token is capped at 90 days; the durable dispatch URL continues to mint fresh learner sessions while the dispatch remains active.

4. Use Destinations for Multi-Client Distribution

{
  "label": "Safety Training - Client A",
  "destination": "client-a-lms"
}

{
  "label": "Safety Training - Client B",
  "destination": "client-b-lms"
}

4. Set Domain Restrictions

{
  "allowed_domains": ["client-a-lms.com"]
}

Complete Example

async function createDispatchPackage(
  packageId: string,
  clientName: string,
  apiKey: string
) {
  const response = await fetch(
    `https://app.allureconnect.com/api/v1/packages/${encodeURIComponent(packageId)}/dispatches`,
    {
      method: 'POST',
      headers: {
        Authorization: `Bearer ${apiKey}`,
        'Content-Type': 'application/json',
      },
      body: JSON.stringify({
        label: `Training Package - ${clientName}`,
        destination: `${clientName.toLowerCase()}-lms`,
        registration_limit: 1000,
        expires_in_hours: 8760, // 1 year
        allowed_domains: [`${clientName.toLowerCase()}-lms.com`],
      }),
    }
  );

  const { dispatch } = await response.json();

  return {
    dispatchId: dispatch.id,
    lmsLaunchUrl: dispatch.launchUrl,
  };
}

Related Documentation

• Dispatch Overview - Understanding dispatch packages
• Distributing Dispatch Packages - Distribution guide
• API Reference - Complete API docs