Changes to the API, SDKs, embeds, and question type platform, in chronological order.
The POST routes for updating a test or a folder — deprecated back in June — have now been removed, and return a 404.
Use PATCH /exams/{id} and PATCH /folders/{id} instead. The request body and the response are unchanged, so it's still the one-word fix we promised.
GET /exams/{id}/questions/{questionId}/quality returns Examplary's read on how well a question is written — the same analysis the editor shows.
Useful if you're generating questions programmatically and want to flag the weak ones for a human before a test goes out.
"Student level" doesn't fit every product. You can now override individual UI strings in any embed session by adding a strings object to theme:
{
"theme": {
"strings": {
"account.attributes.student-level-name": "Candidate level",
"account.attributes.subject-name": "Assessment field"
}
}
}
To find the key for a label, open the Examplary dev tools with Shift + Control + Tilde, click the language icon and switch to Translation keys. Anything you don't override keeps its normal wording.
More in theme options.
The generate-exam embed flow has five new presets for trimming down the form your users see: hideSubject, hideStudentLevel, hideDuration, hideTaxonomy and hideQuestionTypes.
They pair nicely with the presets you were already sending. Set studentLevel and hideStudentLevel together, for example, and the level is applied without your users ever seeing the field — handy when your product already knows the answer.
All of them are listed in the exam generation flow docs.
The AI summary of a class's results is now available over the API, so you can pull it into your own reporting instead of sending teachers to Examplary to read it.
POST /exams/{id}/sessions/summary generates one, and GET /exams/{id}/sessions/summary fetches the one you already have.
The API used to reflect any origin back in its CORS headers. It now only does that for first-party Examplary origins and an organization's own active custom domain.
If you were calling the API straight from browser JavaScript on your own domain, those requests will start failing. Server-to-server calls aren't affected — CORS is a browser-only restriction, so anything running on your backend carries on as before. If you need something in the browser, Embed Sessions are built for exactly that.
LTI, OAuth and the public endpoints stay open, since they're meant to be called from places we don't control.
Most API endpoints are rate limited, per user or per IP address depending on the endpoint. That's been true for a while — you just had to find out by running into one.
Every endpoint reference page now has a Rate limit section with its own limit, and there's a summary on the REST API overview. Go over it and you'll get a 429 with a Retry-After header telling you how long to wait.
We also tightened the limits on the AI and email endpoints, and loosened them on the student-facing ones — a whole class taking a test from one school building shares a single IP address, and that shouldn't look like abuse.
Two endpoints to round out the results flow:
POST /exams/{id}/sessions/release-grades publishes grades and feedback to students, once you're happy with the markingPUT /exams/{id}/sessions/{sessionId}/user attaches a session to a user account — handy for scanned paper results that came in without oneIf you're building your own scanning flow, two endpoints let you do it a page at a time instead of uploading a whole document:
POST /exams/{id}/sessions/scan-images sends photos of a student's pagesPOST /exams/{id}/sessions/scan-student-name reads the name off the first page, so you can confirm who you're looking at before you commit the restPOST /exams/{id}/sessions/scan-document is still there for whole PDFs.
Listing everything in a workspace used to mean calling /exams and /practice-spaces and merging the two yourself.
GET /items returns both in a single collection, so building a "recent activity" list or a picker takes one request. It needs the items:read scope.