The document and who it concerns.

An invalid, used or expired token gets exactly one answer and no detail, the way /auth/activation/{token} does. A guardian who mistyped and a stranger probing for links must not be able to tell each other apart.

The student is named, because a parent has to know which child this is about and already knows their name. Nothing else about the account is exposed: no email, no school identifiers beyond the school's name.