AI Testing, Search & Indexing

Semantic/vector search over indexed documents, natural-language and hybrid (dense + ColBERT) retrieval, the AI test center (scenarios/personalities/test-data assets + runs), vector-index benchmarking, content-indexing status, and the in-app training & courseware platform.

37 endpoints. Generated from the OpenAPI 3.1 specification.

POST /v1/ai-testing/assets

Create a test asset

Creates a scenario, personality, or test-data asset. Requires AI-testing author permission.

Auth Session JWT (Bearer)

Request Body

Field	Type	Required	Description
`asset_type`	string (enum) `scenariopersonalitytest_data`	yes	Kind of asset.
`name`	string	yes	Asset name.
`description`	string	no	Optional description.
`draft_snapshot`	any	yes	Draft content; shape depends on asset_type (scenario graph, personality prompt, or test-data values).
`live_snapshot`	any	no	Optional live content of the same shape.
`is_enabled`	boolean	no	Whether the asset is active.

Responses

Status	Description
`201`	The created asset.
`400`	400 Bad Request — a request parameter, body field, or the JSON body itself failed validation.
`401`	401 Unauthorized — missing, expired, malformed, or revoked credentials.
`403`	`FORBIDDEN` — missing AI-testing author permission.
`500`	500 Internal Server Error — an unexpected server-side error. The message is sanitized; the correlation id is logged server-side.

PUT /v1/ai-testing/assets/{id}

Update a test asset

Updates a draft/live snapshot or metadata of a test asset. Requires AI-testing author permission.

Auth Session JWT (Bearer)

Parameters

Name	In	Type	Required	Description
`id`	path	string<uuid>	yes	Asset identifier (UUIDv7).

Request Body

Field	Type	Required	Description
`name`	string	no
`description`	string	no
`draft_snapshot`	any	no	Replacement draft content.
`live_snapshot`	any	no	Replacement live content.
`is_enabled`	boolean	no

Responses

Status	Description
`200`	The updated asset.
`400`	400 Bad Request — a request parameter, body field, or the JSON body itself failed validation.
`401`	401 Unauthorized — missing, expired, malformed, or revoked credentials.
`403`	403 Forbidden — authenticated but lacking the required membership, role, permission, MFA step-up, or feature entitlement.
`404`	404 Not Found — the requested resource does not exist or is not visible to the caller.
`500`	500 Internal Server Error — an unexpected server-side error. The message is sanitized; the correlation id is logged server-side.

POST /v1/ai-testing/assets/{id}/publish

Publish a test asset

Promotes a test asset's draft snapshot to its live stage. Requires AI-testing author permission.

Auth Session JWT (Bearer)

Parameters

Name	In	Type	Required	Description
`id`	path	string<uuid>	yes	Asset identifier (UUIDv7).

Responses

Status	Description
`200`	The published asset.
`401`	401 Unauthorized — missing, expired, malformed, or revoked credentials.
`403`	403 Forbidden — authenticated but lacking the required membership, role, permission, MFA step-up, or feature entitlement.
`404`	404 Not Found — the requested resource does not exist or is not visible to the caller.
`500`	500 Internal Server Error — an unexpected server-side error. The message is sanitized; the correlation id is logged server-side.

GET /v1/ai-testing/results/{id}

Get a test run result

Returns the stored result of a previous scenario or run-all execution.

Auth Session JWT (Bearer)

Parameters

Name	In	Type	Required	Description
`id`	path	string<uuid>	yes	Run result identifier (UUIDv7).

Responses

Status	Description
`200`	The run result.
`401`	401 Unauthorized — missing, expired, malformed, or revoked credentials.
`404`	404 Not Found — the requested resource does not exist or is not visible to the caller.
`500`	500 Internal Server Error — an unexpected server-side error. The message is sanitized; the correlation id is logged server-side.

POST /v1/ai-testing/run-all

Run all test scenarios

Runs every scenario in the workspace at the requested stage (draft, live, or mixed). Requires AI-testing author permission.

Auth Session JWT (Bearer)

Request Body

Field	Type	Required	Description
`stage`	string (enum) `draftlivemixed`	no	Which stage(s) to execute across all scenarios.

Responses

Status	Description
`200`	The aggregate run result.
`400`	400 Bad Request — a request parameter, body field, or the JSON body itself failed validation.
`401`	401 Unauthorized — missing, expired, malformed, or revoked credentials.
`403`	403 Forbidden — authenticated but lacking the required membership, role, permission, MFA step-up, or feature entitlement.
`500`	500 Internal Server Error — an unexpected server-side error. The message is sanitized; the correlation id is logged server-side.

POST /v1/ai-testing/scenarios/{id}/run

Run a test scenario

Executes a single test scenario against the target assistant or skill at the chosen stage, returning the run result. Requires AI-testing author permission.

Auth Session JWT (Bearer)

Parameters

Name	In	Type	Required	Description
`id`	path	string<uuid>	yes	Scenario asset identifier (UUIDv7).

Request Body

Field	Type	Required	Description
`stage`	string (enum) `draftlive`	no	Which asset stage to execute.

Responses

Status	Description
`200`	The scenario run result.
`400`	400 Bad Request — a request parameter, body field, or the JSON body itself failed validation.
`401`	401 Unauthorized — missing, expired, malformed, or revoked credentials.
`403`	403 Forbidden — authenticated but lacking the required membership, role, permission, MFA step-up, or feature entitlement.
`404`	404 Not Found — the requested resource does not exist or is not visible to the caller.
`500`	500 Internal Server Error — an unexpected server-side error. The message is sanitized; the correlation id is logged server-side.

GET /v1/ai-testing/workspace

Get the AI test workspace

Returns the caller's AI-testing workspace: scenarios, personality assets, and test-data assets (draft + live stages).

Auth Session JWT (Bearer)

Responses

Status	Description
`200`	Workspace assets.
`401`	401 Unauthorized — missing, expired, malformed, or revoked credentials.
`403`	403 Forbidden — authenticated but lacking the required membership, role, permission, MFA step-up, or feature entitlement.
`500`	500 Internal Server Error — an unexpected server-side error. The message is sanitized; the correlation id is logged server-side.

POST /v1/benchmarks/generate

Generate a synthetic vector dataset

Generates a synthetic embedding dataset for benchmarking vector-index techniques. Requires the `benchmark.run` permission.

Auth Session JWT (Bearer)

Request Body

Field	Type	Required	Description
`name`	string	yes	Dataset name.
`vector_count`	integer	yes	Number of vectors to generate.
`dimensions`	integer	no	Vector dimensionality.
`distribution`	string (enum) `uniformgaussianclustered`	no	Synthetic value distribution.
`seed`	integer	no	Deterministic RNG seed.

Responses

Status	Description
`201`	The generated dataset record.
`400`	400 Bad Request — a request parameter, body field, or the JSON body itself failed validation.
`401`	401 Unauthorized — missing, expired, malformed, or revoked credentials.
`403`	`FORBIDDEN` — missing the `benchmark.run` permission.
`500`	500 Internal Server Error — an unexpected server-side error. The message is sanitized; the correlation id is logged server-side.

GET /v1/benchmarks/results

List benchmark results

Lists benchmark results for the organization, optionally filtered by run or technique, with page/pageSize pagination.

Auth Session JWT (Bearer)

Parameters

Name	In	Type	Required	Description
`run_id`	query	string<uuid>	no	Filter to a single benchmark run.
`technique`	query	string (enum)	no	Filter by index technique.
`page`	query	integer	no	1-based page number.
`page_size`	query	integer	no	Records per page (1–200).

Responses

Status	Description
`200`	Benchmark results.
`400`	400 Bad Request — a request parameter, body field, or the JSON body itself failed validation.
`401`	401 Unauthorized — missing, expired, malformed, or revoked credentials.
`500`	500 Internal Server Error — an unexpected server-side error. The message is sanitized; the correlation id is logged server-side.

POST /v1/benchmarks/run

Run a benchmark suite

Runs a benchmark suite against a generated dataset across one or more vector-index techniques. Requires the `benchmark.run` permission.

Auth Session JWT (Bearer)

Request Body

Field	Type	Required	Description
`dataset_id`	string<uuid>	yes	Dataset to benchmark against.
`techniques`	array of enum `hnswdiskannvchordrqvchordgcolbert_maxsimhybrid_dense_colbert`	no	Index techniques to benchmark.
`query_count`	integer	no	Number of query vectors per technique.
`k`	integer	no	Top-k neighbours to retrieve.

Responses

Status	Description
`200`	The benchmark run result.
`400`	400 Bad Request — a request parameter, body field, or the JSON body itself failed validation.
`401`	401 Unauthorized — missing, expired, malformed, or revoked credentials.
`403`	`FORBIDDEN` — missing the `benchmark.run` permission.
`404`	`NOT_FOUND` — the dataset does not exist.
`500`	500 Internal Server Error — an unexpected server-side error. The message is sanitized; the correlation id is logged server-side.

GET /v1/benchmarks/runs/{runId}/charts

Get chart data for a benchmark run

Returns chart-ready data for a benchmark run for the chosen metric.

Auth Session JWT (Bearer)

Parameters

Name	In	Type	Required	Description
`runId`	path	string<uuid>	yes	Benchmark run identifier (UUIDv7).
`chart`	query	string (enum)	no	Which metric to chart (default `speed`).

Responses

Status	Description
`200`	Chart data.
`400`	`INVALID_ID_FORMAT` (bad run id) or `VALIDATION_ERROR`.
`401`	401 Unauthorized — missing, expired, malformed, or revoked credentials.
`500`	500 Internal Server Error — an unexpected server-side error. The message is sanitized; the correlation id is logged server-side.

GET /v1/indexing/ws

Indexing status WebSocket

WebSocket upgrade that streams live content-indexing/embedding progress. The connection authenticates in-handler via the connection token; this is not a JSON endpoint.

Auth One-time ?token= ticket

Responses

Status	Description
`101`	Switching Protocols — the WebSocket connection is established.
`401`	401 Unauthorized — missing, expired, malformed, or revoked credentials.
`426`	Upgrade Required — the request was not a WebSocket upgrade.

POST /v1/search/fulltext

Full-text search (retired)

This endpoint is not implemented. It always returns 501 with `Sunset` and `Link: rel="successor-version"` headers pointing to `/v1/search/hybrid`. Use `/v1/search/hybrid` (dense + ColBERT) or `/v1/search/natural` (natural-language) instead.

Auth Session JWT (Bearer)

Responses

Status	Description
`401`	401 Unauthorized — missing, expired, malformed, or revoked credentials.
`501`	`NOT_IMPLEMENTED` — the route is retired; migrate to `/v1/search/hybrid`.

POST /v1/search/hybrid

Hybrid search (dense + optional ColBERT rerank)

Dense vector retrieval with optional ColBERT late-interaction reranking for higher precision. Results are nonce-wrapped. Per-user rate limit of 60 requests/minute.

Auth Session JWT (Bearer)

Request Body

Field	Type	Required	Description
`embedding`	string	yes	Serialized dense query embedding.
`limit`	integer	no	Maximum chunks to return.
`threshold`	number	no	Minimum cosine similarity (default 0.65).
`project_id`	string<uuid>	no	Restrict the search to a single project.
`rerank`	boolean	no	When true, rerank dense candidates with ColBERT late interaction.
`colbert_embedding`	array of string	no	Per-token ColBERT query embeddings used when reranking.

Responses

Status	Description
`200`	Wrapped search results.
`400`	`INVALID_JSON` or `VALIDATION_ERROR`.
`401`	401 Unauthorized — missing, expired, malformed, or revoked credentials.
`429`	429 Too Many Requests — a rate limit or usage quota was exceeded. Retry after the indicated window.
`500`	500 Internal Server Error — an unexpected server-side error. The message is sanitized; the correlation id is logged server-side.

200 response body: data fields

Field	Type	Description
`safety_notice`	string	Human/LLM-facing notice describing the nonce-wrapping contract.
`delimiter_nonce`	string	Per-response nonce delimiting wrapped chunk content.
`chunkCount`	integer	Number of returned chunks.
`chunks`	array of object	Matched document chunks (metadata + wrapped content).
`raw`	object	Any additional top-level fields the search returned (e.g. pagination).

POST /v1/search/natural

Natural-language search

Embeds the supplied natural-language query server-side (Workers AI bge-large-en-v1.5) and runs hybrid retrieval. Counts against the daily embedding budget and a per-user 60/minute rate limit. Results are nonce-wrapped.

Auth Session JWT (Bearer)

Request Body

Field	Type	Required	Description
`query`	string	yes	Natural-language query text.
`limit`	integer	no	Maximum chunks to return (default 8).
`threshold`	number	no	Minimum cosine similarity (default 0.65).
`project_id`	string<uuid>	no	Restrict the search to a single project.

Responses

Status	Description
`200`	Wrapped search results, echoing the `query`.
`400`	`INVALID_JSON` or `VALIDATION_ERROR`.
`401`	401 Unauthorized — missing, expired, malformed, or revoked credentials.
`429`	`RATE_LIMIT_EXCEEDED` — per-user rate limit or the daily embedding budget was exceeded.
`500`	`INTERNAL_ERROR` — the embedding model produced no vector or another server fault.
`503`	`INTERNAL_ERROR` — the AI budget gate is temporarily unavailable.

200 response body: data fields

Field	Type	Description
`query`	string
`safety_notice`	string	Human/LLM-facing notice describing the nonce-wrapping contract.
`delimiter_nonce`	string	Per-response nonce delimiting wrapped chunk content.
`chunkCount`	integer	Number of returned chunks.
`chunks`	array of object	Matched document chunks (metadata + wrapped content).
`raw`	object	Any additional top-level fields the search returned (e.g. pagination).

POST /v1/search/vector

Dense vector search

Cosine-similarity search over indexed document chunks using a caller-supplied embedding. Results are nonce-wrapped for safe downstream LLM consumption. Per-user rate limit of 60 requests/minute.

Auth Session JWT (Bearer)

Request Body

Field	Type	Required	Description
`embedding`	string	yes	Serialized query embedding, e.g. "[0.1,0.2,...]" or a bare comma-separated list.
`limit`	integer	no	Maximum chunks to return.
`threshold`	number	no	Minimum cosine similarity (default 0.65). Values below the 0.55 floor are rejected to prevent fishing.
`project_id`	string<uuid>	no	Restrict the search to a single project.

Responses

Status	Description
`200`	Wrapped search results.
`400`	`INVALID_JSON` (unparseable body) or `VALIDATION_ERROR` (a field failed validation, e.g. `threshold` below the 0.55 floor, or a stored-procedure input fault surfaced with `details.spCode`).
`401`	401 Unauthorized — missing, expired, malformed, or revoked credentials.
`429`	`RATE_LIMIT_EXCEEDED` — more than 60 search requests in the rolling minute.
`500`	500 Internal Server Error — an unexpected server-side error. The message is sanitized; the correlation id is logged server-side.

200 response body: data fields

Field	Type	Description
`safety_notice`	string	Human/LLM-facing notice describing the nonce-wrapping contract.
`delimiter_nonce`	string	Per-response nonce delimiting wrapped chunk content.
`chunkCount`	integer	Number of returned chunks.
`chunks`	array of object	Matched document chunks (metadata + wrapped content).
`raw`	object	Any additional top-level fields the search returned (e.g. pagination).

POST /v1/training/assign

Bulk-assign learners

Assigns up to 1000 users to a course with an optional due date. Requires `training.assign`.

Auth Session JWT (Bearer)

Request Body

Field	Type	Required
`course_id`	string<uuid>	yes
`user_ids`	array of string	yes
`due_at`	string<date-time>	no

Responses

Status	Description
`200`	Success.
`400`	400 Bad Request — a request parameter, body field, or the JSON body itself failed validation.
`401`	401 Unauthorized — missing, expired, malformed, or revoked credentials.
`403`	FORBIDDEN — missing the `training.assign` permission or not entitled.
`404`	404 Not Found — the requested resource does not exist or is not visible to the caller.
`500`	500 Internal Server Error — an unexpected server-side error. The message is sanitized; the correlation id is logged server-side.

POST /v1/training/attempts

Submit a graded attempt

Submits an answer for grading (auto-graded, including HOL-kernel equation equivalence where applicable). Requires `training.learn`.

Auth Session JWT (Bearer)

Request Body

Field	Type	Required	Description
`enrollment_id`	string<uuid>	yes
`entity_id`	string<uuid>	yes
`submitted_answer`	object	yes	The learner answer payload.
`action_ts_ms`	integer	no	Client action timestamp (ms).

Responses

Status	Description
`200`	Success.
`400`	400 Bad Request — a request parameter, body field, or the JSON body itself failed validation.
`401`	401 Unauthorized — missing, expired, malformed, or revoked credentials.
`403`	FORBIDDEN — missing the `training.learn` permission or not entitled.
`404`	404 Not Found — the requested resource does not exist or is not visible to the caller.
`500`	500 Internal Server Error — an unexpected server-side error. The message is sanitized; the correlation id is logged server-side.

POST /v1/training/attempts/grade

Override grade / add feedback

Admin override of an attempt score or instructor feedback. Requires `training.admin`.

Auth Session JWT (Bearer)

Request Body

Field	Type	Required
`attempt_id`	string<uuid>	yes
`kind`	string (enum) `overridefeedback`	yes
`new_score`	number	no
`new_is_correct`	boolean	no
`instructor_feedback`	string	no
`reason`	string	no

Responses

Status	Description
`200`	Success.
`400`	400 Bad Request — a request parameter, body field, or the JSON body itself failed validation.
`401`	401 Unauthorized — missing, expired, malformed, or revoked credentials.
`403`	FORBIDDEN — missing the `training.admin` permission or not entitled.
`404`	404 Not Found — the requested resource does not exist or is not visible to the caller.
`500`	500 Internal Server Error — an unexpected server-side error. The message is sanitized; the correlation id is logged server-side.

GET /v1/training/catalog

Get the course catalog

Returns the courses the caller is entitled to. Requires `training.learn`.

Auth Session JWT (Bearer)

Responses

Status	Description
`200`	Success.
`401`	401 Unauthorized — missing, expired, malformed, or revoked credentials.
`403`	FORBIDDEN — missing the `training.learn` permission or not entitled.
`500`	500 Internal Server Error — an unexpected server-side error. The message is sanitized; the correlation id is logged server-side.

GET /v1/training/certificates

List certificates

Lists the callers certificates; admins see all org certificates. Requires `training.learn`.

Auth Session JWT (Bearer)

Responses

Status	Description
`200`	Success.
`401`	401 Unauthorized — missing, expired, malformed, or revoked credentials.
`403`	FORBIDDEN — missing the `training.learn` permission or not entitled.
`500`	500 Internal Server Error — an unexpected server-side error. The message is sanitized; the correlation id is logged server-side.

POST /v1/training/certificates/revoke

Revoke a certificate

Revokes a certificate by enrollment id or serial. Requires `training.admin`.

Auth Session JWT (Bearer)

Request Body

Field	Type	Required
`enrollment_id`	string<uuid>	no
`serial`	string	no
`reason`	string	no

Responses

Status	Description
`200`	Success.
`400`	400 Bad Request — a request parameter, body field, or the JSON body itself failed validation.
`401`	401 Unauthorized — missing, expired, malformed, or revoked credentials.
`403`	FORBIDDEN — missing the `training.admin` permission or not entitled.
`404`	404 Not Found — the requested resource does not exist or is not visible to the caller.
`500`	500 Internal Server Error — an unexpected server-side error. The message is sanitized; the correlation id is logged server-side.

GET /v1/training/certificates/verify

Verify a certificate

Verifies a certificate by serial. Available to any authenticated user.

Auth Session JWT (Bearer)

Parameters

Name	In	Type	Required	Description
`serial`	query	string	yes	Certificate serial to verify.

Responses

Status	Description
`200`	Success.
`400`	400 Bad Request — a request parameter, body field, or the JSON body itself failed validation.
`401`	401 Unauthorized — missing, expired, malformed, or revoked credentials.
`404`	404 Not Found — the requested resource does not exist or is not visible to the caller.
`500`	500 Internal Server Error — an unexpected server-side error. The message is sanitized; the correlation id is logged server-side.

POST /v1/training/courses

Create a course

Creates a training course bound to a project and a training entity type. Requires the `training.author` permission.

Auth Session JWT (Bearer)

Request Body

Field	Type	Required	Description
`project_id`	string<uuid>	yes
`entity_type_id`	string<uuid>	yes
`title`	string	yes
`slug`	string	no	URL slug (lowercase alphanumeric + hyphens).
`description`	string	no
`locale`	string	no
`estimated_minutes`	integer	no
`difficulty`	string	no
`access_model`	string (enum) `public_freesubscriptionorg_internal`	no
`pricing_type`	string (enum) `freeone_timesubscription`	no
`certificate_ttl_days`	integer	no
`settings`	object	no
`metadata`	object	no

Responses

Status	Description
`201`	Success.
`400`	400 Bad Request — a request parameter, body field, or the JSON body itself failed validation.
`401`	401 Unauthorized — missing, expired, malformed, or revoked credentials.
`403`	FORBIDDEN — missing the `training.author` permission or not entitled.
`500`	500 Internal Server Error — an unexpected server-side error. The message is sanitized; the correlation id is logged server-side.

GET /v1/training/courses/{courseId}

Get a course tree

Returns the full course tree (chapters/lessons/steps). Answer keys are stripped for learners; authors/admins see them. Requires entitlement to the course.

Auth Session JWT (Bearer)

Parameters

Name	In	Type	Required	Description
`courseId`	path	string<uuid>	yes	Course identifier (UUIDv7).

Responses

Status	Description
`200`	Success.
`401`	401 Unauthorized — missing, expired, malformed, or revoked credentials.
`403`	403 Forbidden — authenticated but lacking the required membership, role, permission, MFA step-up, or feature entitlement.
`404`	404 Not Found — the requested resource does not exist or is not visible to the caller.
`500`	500 Internal Server Error — an unexpected server-side error. The message is sanitized; the correlation id is logged server-side.

PATCH /v1/training/courses/{courseId}

Update course metadata

Updates course metadata (title/description/locale/etc). At least one field required. Requires `training.author`.

Auth Session JWT (Bearer)

Parameters

Name	In	Type	Required	Description
`courseId`	path	string<uuid>	yes	Course identifier (UUIDv7).

Request Body

Field	Type	Required
`title`	string	no
`description`	string	no
`locale`	string	no
`estimated_minutes`	integer	no
`difficulty`	string	no
`access_model`	string (enum) `public_freesubscriptionorg_internal`	no
`settings`	object	no

Responses

Status	Description
`200`	Success.
`400`	400 Bad Request — a request parameter, body field, or the JSON body itself failed validation.
`401`	401 Unauthorized — missing, expired, malformed, or revoked credentials.
`403`	FORBIDDEN — missing the `training.author` permission or not entitled.
`404`	404 Not Found — the requested resource does not exist or is not visible to the caller.
`409`	CONFLICT — the course cannot be updated in its current state.
`500`	500 Internal Server Error — an unexpected server-side error. The message is sanitized; the correlation id is logged server-side.

POST /v1/training/courses/{courseId}/archive

Archive a course

Archives a course. Requires `training.author`.

Auth Session JWT (Bearer)

Parameters

Name	In	Type	Required	Description
`courseId`	path	string<uuid>	yes	Course identifier (UUIDv7).

Responses

Status	Description
`200`	Success.
`401`	401 Unauthorized — missing, expired, malformed, or revoked credentials.
`403`	FORBIDDEN — missing the `training.author` permission or not entitled.
`404`	404 Not Found — the requested resource does not exist or is not visible to the caller.
`409`	CONFLICT — the course is already archived.
`500`	500 Internal Server Error — an unexpected server-side error. The message is sanitized; the correlation id is logged server-side.

POST /v1/training/courses/{courseId}/publish

Publish a course

Publishes a course, optionally binding pricing/feature-flag/marketplace listing. Requires `training.author`.

Auth Session JWT (Bearer)

Parameters

Name	In	Type	Required	Description
`courseId`	path	string<uuid>	yes	Course identifier (UUIDv7).

Request Body

Field	Type	Required
`is_free`	boolean	no
`saas_package_id`	string<uuid>	no
`pricing_plan_id`	string<uuid>	no
`feature_flag_id`	string<uuid>	no
`flag_source`	string (enum) `systemcustom`	no
`listing_id`	string<uuid>	no
`visibility`	string (enum) `marketplacepackage_onlyunlisted`	no

Responses

Status	Description
`200`	Success.
`400`	400 Bad Request — a request parameter, body field, or the JSON body itself failed validation.
`401`	401 Unauthorized — missing, expired, malformed, or revoked credentials.
`403`	FORBIDDEN — missing the `training.author` permission or not entitled.
`404`	404 Not Found — the requested resource does not exist or is not visible to the caller.
`409`	CONFLICT — the course is in a state that cannot be published.
`500`	500 Internal Server Error — an unexpected server-side error. The message is sanitized; the correlation id is logged server-side.

POST /v1/training/courses/{courseId}/unpublish

Unpublish a course

Reverts a published course to draft. Requires `training.author`.

Auth Session JWT (Bearer)

Parameters

Name	In	Type	Required	Description
`courseId`	path	string<uuid>	yes	Course identifier (UUIDv7).

Responses

Status	Description
`200`	Success.
`401`	401 Unauthorized — missing, expired, malformed, or revoked credentials.
`403`	FORBIDDEN — missing the `training.author` permission or not entitled.
`404`	404 Not Found — the requested resource does not exist or is not visible to the caller.
`409`	CONFLICT — the course cannot be unpublished in its current state.
`500`	500 Internal Server Error — an unexpected server-side error. The message is sanitized; the correlation id is logged server-side.

POST /v1/training/enrollments

Enroll in a course

Enrolls the caller (or, for assigners, another user) in a course. Requires `training.learn`.

Auth Session JWT (Bearer)

Request Body

Field	Type	Required	Description
`course_id`	string<uuid>	yes
`user_id`	string<uuid>	no	Target user (assigners only; defaults to caller).
`source`	string (enum) `selfassignedrequired`	no
`due_at`	string<date-time>	no

Responses

Status	Description
`201`	Success.
`400`	400 Bad Request — a request parameter, body field, or the JSON body itself failed validation.
`401`	401 Unauthorized — missing, expired, malformed, or revoked credentials.
`403`	FORBIDDEN — missing the `training.learn` permission or not entitled.
`404`	404 Not Found — the requested resource does not exist or is not visible to the caller.
`409`	409 Conflict — the request conflicts with an existing resource or current state (unique constraint, optimistic-lock, duplicate).
`500`	500 Internal Server Error — an unexpected server-side error. The message is sanitized; the correlation id is logged server-side.

POST /v1/training/entity-types/clone

Clone a training entity type

Clones a system or org training entity type into the organization, optionally renaming and adding fields. Requires the `entity_type.create` permission.

Auth Session JWT (Bearer)

Request Body

Field	Type	Required	Description
`source_type_id`	string<uuid>	yes	Source training type to clone.
`source_scope`	string (enum) `systemorg`	no	Whether the source is a system or org type.
`rename`	string	no	New name for the clone.
`add_fields`	array of object	no	Additional field definitions.
`parent_uuid`	string<uuid>	no	Optional parent type.

Responses

Status	Description
`200`	Success.
`400`	400 Bad Request — a request parameter, body field, or the JSON body itself failed validation.
`401`	401 Unauthorized — missing, expired, malformed, or revoked credentials.
`403`	FORBIDDEN — missing the `entity_type.create` permission or not entitled.
`404`	404 Not Found — the requested resource does not exist or is not visible to the caller.
`500`	500 Internal Server Error — an unexpected server-side error. The message is sanitized; the correlation id is logged server-side.

POST /v1/training/learners/erase

Erase learner training data

GDPR/FERPA erasure of a learners training data at the chosen scope. Requires `training.admin`.

Auth Session JWT (Bearer)

Request Body

Field	Type	Required
`learner_user_id`	string<uuid>	yes
`scope`	string (enum) `allcourseenrollment`	no
`scope_ref`	string<uuid>	no
`reason`	string	no

Responses

Status	Description
`200`	Success.
`400`	400 Bad Request — a request parameter, body field, or the JSON body itself failed validation.
`401`	401 Unauthorized — missing, expired, malformed, or revoked credentials.
`403`	FORBIDDEN — missing the `training.admin` permission or not entitled.
`404`	404 Not Found — the requested resource does not exist or is not visible to the caller.
`500`	500 Internal Server Error — an unexpected server-side error. The message is sanitized; the correlation id is logged server-side.

GET /v1/training/my

Get the learner hub

Returns the callers enrollments, progress, and assignments. Requires `training.learn`.

Auth Session JWT (Bearer)

Responses

Status	Description
`200`	Success.
`401`	401 Unauthorized — missing, expired, malformed, or revoked credentials.
`403`	FORBIDDEN — missing the `training.learn` permission or not entitled.
`500`	500 Internal Server Error — an unexpected server-side error. The message is sanitized; the correlation id is logged server-side.

GET /v1/training/my/transcript

Export own transcript

Exports the callers training transcript. Requires `training.learn`.

Auth Session JWT (Bearer)

Responses

Status	Description
`200`	Success.
`401`	401 Unauthorized — missing, expired, malformed, or revoked credentials.
`403`	FORBIDDEN — missing the `training.learn` permission or not entitled.
`500`	500 Internal Server Error — an unexpected server-side error. The message is sanitized; the correlation id is logged server-side.

POST /v1/training/nodes

Upsert a course node

Creates or updates a chapter/lesson/step node in a course. Requires `training.author`.

Auth Session JWT (Bearer)

Request Body

Field	Type	Required	Description
`project_id`	string<uuid>	yes
`entity_type_id`	string<uuid>	yes
`title`	string	yes
`entity_id`	string<uuid>	no	Existing node to update (omit to create).
`parent_id`	string<uuid>	no	Parent node.
`metadata`	object	no
`sort_order`	integer	no

Responses

Status	Description
`200`	Success.
`400`	400 Bad Request — a request parameter, body field, or the JSON body itself failed validation.
`401`	401 Unauthorized — missing, expired, malformed, or revoked credentials.
`403`	FORBIDDEN — missing the `training.author` permission or not entitled.
`404`	404 Not Found — the requested resource does not exist or is not visible to the caller.
`500`	500 Internal Server Error — an unexpected server-side error. The message is sanitized; the correlation id is logged server-side.

POST /v1/training/progress

Batch-update progress

Upserts progress for up to 500 nodes in an enrollment. Requires `training.learn`.

Auth Session JWT (Bearer)

Request Body

Field	Type	Required
`enrollment_id`	string<uuid>	yes
`nodes`	array of object	yes
`total_steps`	integer	no
`last_entity_id`	string<uuid>	no

Responses

Status	Description
`200`	Success.
`400`	400 Bad Request — a request parameter, body field, or the JSON body itself failed validation.
`401`	401 Unauthorized — missing, expired, malformed, or revoked credentials.
`403`	FORBIDDEN — missing the `training.learn` permission or not entitled.
`404`	404 Not Found — the requested resource does not exist or is not visible to the caller.
`500`	500 Internal Server Error — an unexpected server-side error. The message is sanitized; the correlation id is logged server-side.

POST /v1/training/required

Set required training

Upserts a required-training rule for an org/role/group/user scope with optional recurrence. Requires `training.assign`.

Auth Session JWT (Bearer)

Request Body

Field	Type	Required
`course_id`	string<uuid>	yes
`scope`	string (enum) `orgrolegroupuser`	no
`scope_ref`	string<uuid>	no
`recurrence_interval`	string (enum) `onceannualbiennialcustom_days`	no
`recurrence_days`	integer	no
`is_active`	boolean	no

Responses

Status	Description
`200`	Success.
`400`	400 Bad Request — a request parameter, body field, or the JSON body itself failed validation.
`401`	401 Unauthorized — missing, expired, malformed, or revoked credentials.
`403`	FORBIDDEN — missing the `training.assign` permission or not entitled.
`404`	404 Not Found — the requested resource does not exist or is not visible to the caller.
`500`	500 Internal Server Error — an unexpected server-side error. The message is sanitized; the correlation id is logged server-side.