Using API endpoints for Quizzes

[MarilouLandes]

I am developing an external app that starts a quiz, retrieves the questions, then saves/updates the responses, and finally, completes the quiz, using various API Endpoints.  There does not appear to be any type of workflow documentation for this process, so my methodology is basically to "try this and see what happens".

For all the following, Shibboleth authentication is used, and an OAuth2 workflow is completed successfully.

Using my personal credentials as an administrator, I am able to

1. list quizzes in a course,
2. create a quiz submission for a quiz in a course, and
3. get Quiz Questions for a specific quiz in a course (GET /api/v1/courses/:courseID/quizzes/:quizID/questions)

Using a test student account, I am able to

1. list quizzes in a course,
2. create a quiz submission for a quiz in a course, and
3. I am unable to get Quiz Questions for a specific quiz in a course.  The response is {"status":"unauthorized","errors":[{"message":"user not authorized to perform that action"}]}

The have several questions:

1. Is there some workflow-type documentation that describes how the various endpoints should be used?
2. Am I using the correct endpoint for the student to retrieve the quiz qestions?
3. Are there (script) examples of this process that anyone is willing to share from which I can learn?

Thanks for any and all feedback!

[James]

This is an interesting idea. I can see where it would come in handy for students in courses that allow unlimited attempts and keep the highest grade (like our mandatory student orientation course). Students could run the script until they get a high grade without having to know anything. Thankfully, New Quizzes allows you to enforce a waiting period before reattempting a quiz and that would definitely come in handy here.

The Quiz Questions API has lots of gotchas. I've got about 30 seconds before I have to pack up and go, so I won't get to all of them.

Has the test student taken the quiz?

Are you specifying the quiz submission ID and the quiz attempt? Otherwise, it's going to fall through to the next line of code that does the check for authorization, which is the error you're getting. If so, are you confusing the quiz submission ID with the assignment submission ID or the quiz ID?

Quiz Questions from an administrator account doesn't return all of the questions in the quiz if you use question banks, but it will return some questions. For students, they need to have started the quiz, otherwise a student could get a list of all of the questions ahead of time.

[MarilouLandes]

Thanks for the quick response...

To answer your questions -

The test student has not taken the quiz.  However, my app is set up to 'start' a quiz automatically, if one is not already started.

I've tried 3 different variations of the request to list questions in a quiz; each is a failure.

• courseID is 552
• quizID is 216962
• submissionID is 8605758
• attempt is 1

Attempt 1 - no arguments for submission ID or attempt

<cfhttp method="GET" url="#get( 'canvasURL' )#/api/v1/courses/#arguments.courseID#/quizzes/#arguments.quizID#/questions" result="local.result">
<cfhttpparam type="HEADER" name="Authorization" value="Bearer #arguments.access_token#" />
</cfhttp>

{"status":"unauthorized","errors":[{"message":"user not authorized to perform that action"}]}

The error detail is 401 Unauthorized

Attempt 2 -  arguments for submission ID and attempt in the request body 

<cfhttp method="GET" url="#get( 'canvasURL' )#/api/v1/courses/#arguments.courseID#/quizzes/#arguments.quizID#/questions" result="local.result">
<cfhttpparam type="HEADER" name="Authorization" value="Bearer #arguments.access_token#" />
<cfhttpparam type="BODY" name="quiz_submission_id" value="#arguments.quizSubmissionID#" />
<cfhttpparam type="BODY" name="quiz_submission_attempt" value="#arguments.quizSubmissionAttempt#" />
</cfhttp>

{"status":"unauthorized","errors":[{"message":"user not authorized to perform that action"}]}

The error detail is 401 Unauthorized

Attempt 3 -  arguments for submission ID and attempt in the request URL

<cfhttp method="GET" url="#get( 'canvasURL' )#/api/v1/courses/#arguments.courseID#/quizzes/#arguments.quizID#/questions" result="local.result">
<cfhttpparam type="HEADER" name="Authorization" value="Bearer #arguments.access_token#" />
<cfhttpparam type="URL" name="quiz_submission_id" value="#arguments.quizSubmissionID#" />
<cfhttpparam type="URL" name="quiz_submission_attempt" value="#arguments.quizSubmissionAttempt#" />
</cfhttp>

{"errors":[{"message":"The specified resource does not exist."}]}
The error detail is 404 Not Found

[James · Accepted solution]

@MarilouLandes 

Now that I'm not rushed to pick up my daughter, I took another look at things. I am thinking that the "update" permission is the one that allows the instructor to add, delete, or manage quizzes. That is, students will never have it, which means that you will not be able to get the student's response out of there with a student token, unless perhaps you have the quiz submission ID.

Of the three IDs you gave me, none of them were the quiz submission ID.

To get the Quiz Submission ID, get the submissions: GET /api/v1/courses/:course_id/quizzes/:quiz_id/submissions

The id is the quiz submission id since you're making a call to get the submissions (whatever object you are fetching, the "id" is the id for that object and other id's have prefixes that name them).

I went through and was able to get the quiz questions (just the questions, not the responses) using that API for the teacher. When I try masquerading as the student who took the quiz, I get the 401 Unauthorized message.

That means that you're not going to be able to get the questions as the student using that API call.

I was, however, able to get the quiz questions using a student token from the Quiz Submission Questions API: GET /api/v1/quiz_submissions/:quiz_submission_id/questions

Again, those are just the questions, not the responses that were given. It does, however, include a correct property that indicates whether the student scored the question correctly (this might depend on quiz settings).

[MarilouLandes]

Using the "id" of the quiz submission object did the trick.  In looking at the JSON returned from quiz submissions - {"quiz_id":216962,"id":1144880,"submission_id":8605758,...- I was using the "submission_id" and not the "id".  The documentation of the Quiz Submission object doesn't do much to explain the difference between the two.

Thank you VERY much for your help!

[Rajyalakshmi]

Participation in a quiz is always a challenge for a few students and it is important to motivate students by showing live examples of the topic what the quiz is about is my suggestion.

[mirzakhalov]

Hi @James!

Our team is working on a Canvas integration where we turn quizzes and assignments students already completed into Quizlet format flashcards. Following your steps, we were able to retrieve the quiz questions using the student's access token but we are unable to get the correct answers even though they are visible to the student through UI (screenshot below). This is only relevant in the cases where the teacher enables the answers on the quizzes and we would like to retrieve those answers using the student access token. Is there any workaround here that you suggest?

[James]

@mirzakhalov 

What you are saying is consistent with what I found: "That means that you're not going to be able to get the questions as the student using that API call."

The correct responses are delivered as part of the HTML with the page, not through the API. That means that you would need to parse the DOM on the page and find the answers if you want to get them that way. I don't recommend that, but if you're doing it as a student, that may be your only recourse.

As far as workarounds, I have to admit that I'm not understanding what you're trying to do (or perhaps why you're trying to do it this way). Sometimes not understanding the whole picture makes it difficult to provide solutions.

It seems that you want to

1. take the correct answers / feedback for the questions and make Quizlet flash cards from it. The cards do not consist of the student answers, but the correct answers from Canvas, and
2. only allow students who have completed the quiz to see the Quizlet cards.

If #1 is correct, then it seems like you would be making one Quizlet for the entire class, not individual Quizlets for students. Is that even possible -- to create a Quizlet as someone else so that only they see it?

If #1 is correct, then you wouldn't need to use the student token, you would want to use a token of someone who has the ability to see the correct responses -- the teacher, instructional designer, administrator, etc. That token will have permission to the view responses (provided they don't come from linked question banks).

#2 is easy to determine from the Canvas side, but I'm not sure how you're going to enforce it from the Quizlet side. I will admit that I have limited experience with Quizlet, just having used the web interface. I don't anything about their API and Google searches for Quizlet API documentation are not helpful. You can share a Quizlet by email but there is no guarantee that a student won't then share it with other students. This is true whether you create it for the student or you create it as the instructor and then share it.

Since preventing sharing completely isn't feasible, you would not generally want to make a Quizlet out of a high-stakes assessment such as a test. The data will be out there for the next time the course content is used and it will appear on sites where students try to be helpful by posting answers from their courses for the rest of the world to see.

That makes it seem like something that the instructor would want to create and then share with students. If they need to complete the quiz first, then I can think of several ways to make that happen.

1. Use module requirements. They often don't provide the flexibility that you need or might be used in another way, so as much as this is "the official way", it's often not helpful.
2. Use submission comments. Once a student has completed the quiz, send a comment with a link to the Quizlet.
3. Use an LTI that scans which assignments have been completed and then provides links to any Quizlets the student has permission to view.
4. Wait until the assignment has closed and then add the review to a Quizlet classroom. This allows students who don't complete the quiz to still see the review, which is a problem that exists now (people want to extend the show correct answers date to allow students to for review for the final, but students cannot see them to review if they didn't take it when it was open).
5. Let students view the answers to the quiz more than once and for an indefinite amount of time. This not the same as a flashcard, but it would allow them to review.

As an instructor, any of those would work for me except (a). (b) would be the easiest for me to do because I rarely use Quizlet in the classroom. If I used a lot of Quizlet, then (d) would be easiest. (e) doesn't involve Quizlet, so I might steer away from it. (c) requires programming skills, which I have but wouldn't use for this. I realize that once I make the answers available, then students will share. That's part of why I try to make sure that my questions come from question groups with more questions than used on the quiz.

As an instructor, I would absolutely want control over whether this happened. I would not want someone coming along automatically and adding this just because I make the answers available. I would want to control which quizzes this happened for. That means that it should be driven from the instructor side, with the instructor creating the Quizlets, not the students. I realize that if students want to create the Quizlet, there's nothing I can do to stop them if I show the answers.

[mirzakhalov]

Hi @James !

Thank you for your very insightful response. First of all, I want to apologize for the confusion regarding Quizlet. We are not using or involving Quizlet APIs in this case, but rather want to create flashcards for students to review that are similar to Quizlet flashcards. 

Now, for the use case, (2) is closer to what we want to accomplish. Imagine this scenario, a student has taken multiple quizzes and assignments during class and now wants to study for an exam or a midterm. Currently, there is no easy way for students to review everything from their class all at once and they rely on external software like Quizlet and create their own study sets. For a functional flashcard, we would need a question and an answer. As you have mentioned, an answer could be the officially correct one that the instructor releases (this is what I asked in the original question) OR we could also be okay with using the student response to the question as the "answer" (and let the student edit it after in our LTI). 

Since your points about the instructor's perspective on the quizzes and assignments answers being leaked are absolutely valid, would it be possible to retrieve the student's answers to those questions through API?
We are thinking that if this is not available through API directly, we would simply create the flashcard for the students for each question and let them complete the answers themselves but this is just very unintuitive from the user experience perspective since their answers are "right there in their Canvas".