Upcoming change: user_id required

Every request your key makes for a student will need to name that student with user_id. Today a request without it is answered with your whole service account’s data — every student’s chats, quizzes and marks are reachable by id. Requiring user_id means a request can only ever reach the student it names, so one student can never see another’s work even if a request is replayed or an id is guessed.

Nothing changes yet. We will switch this on for your key only after we’ve agreed a date with you. Until then, requests without user_id keep working exactly as they do today.

What to do

Send your student identifier — the same user_id you already send when you create the resource — on every request about that student:

• POST / PATCH: at the root of the JSON body (unchanged).
• GET: as a query parameter.

Use the same user_id that created the resource: a request naming a different student gets 404 NOT_FOUND, as it already does today.

Endpoints affected

Endpoint	Methods
/chats/:id, /chats/:id/messages	GET, POST
/quizzes/:id	GET
/mark/submissions/:id, /remark, /correction_attempts	GET, POST
/mark/essays/:id, /mark/adhoc/:id	GET
/exams/papers, /exams/papers/:id	GET
/study/flashcards/:id, /study/explain_backs/:id, /audio, /responses	GET, POST
/naplan/attempts/:id, /naplan/writing_attempts/:id	GET, PATCH
/insights/:id, /insights/:id/ask	GET, POST

Catalog endpoints (subjects, topics, personas) and creating your own assessments are not affected.

How to tell if you’re ready

Until enforcement, every affected request that omits user_id carries this response header:

When none of your responses carry it, you’re ready. After enforcement the same request returns:

We can also send you a per-endpoint count of your requests that omit user_id. Email ai@intu.com.au.