API Keys
All REST API calls require a Bearer token:Scopes
Each API key can be granted one or more scopes:Rate Limits
Limits are applied per API key, on a rolling 60-second window:
When exceeded, the API returns
429 Too Many Requests with a Retry-After header indicating how many seconds to wait.
/check also carries a separate anti-brute-force limit: 3 checks per question, per session, per rolling hour (configurable per org). It is keyed on (api key, assessment, question, session_id), falling back to learner_ref when you omit session_id. Exceeding it also returns 429, with a Retry-After that can be up to an hour — so back off on the header value, never on a fixed schedule.
See Technical Limits for quotas and overage.
Response Envelope
All API responses use a consistent envelope:The learner_ref field
Every submission and session accepts a learner_ref — your internal identifier for the learner: