Assessments API¶
Status: Current | Last reviewed: 2026-10-19
You use this inventory to locate Assessments HTTP operations and shared data contracts. Runtime Zod request validation remains authoritative in the source paths listed for each operation. The voice WebSocket protocol is described in the technical guide.
Regenerate from apps/proficiency with npm run openapi.
The inventory includes the BPaaS screener. Both assessment types use the shared __Host-proficiency session and CSRF token. Behavioral enrollment takes optional configId and newAttempt (default false), binds the signed-in identity and requires X-Operation-Id. For SSO users with newAttempt: true, a submitted attempt permits a separate fresh attempt; an unfinished attempt always resumes with its original answers and timers. Without it, enrollment opens the latest retained attempt. Retrying the same operation returns the same ID even after that attempt is submitted. attemptId selects only an owned candidate attempt.
GET /api/home adds canReview, English blueprint_id, and has_ai_result availability flags on both attempt lists. It never includes AI scores or assessment content. All admitted SSO users are reviewers by default; administration uses a separate elevated claim. Reviewer reveal is explicit, including when reviewing one’s own submission; human self-review is forbidden. Audio uploads are ordered, immutable PCM chunks; configuration, enrollment and answer-analysis schemas are included.
POST /api/auth/code accepts Name/Email/Code credentials with a required same-origin header and a ten-request-per-minute limit. It is anonymous and does not require a session CSRF token. Code users get candidate-only access and one attempt per assigned type. /api/home returns canRepeat: false and filters available types for them. Administrator-only invitation listing/issuance, replacement and revocation are included in the inventory. Issuance/replacement returns plaintext code once; these operations do not use command receipts. See the access guide.