AILAT API v1.0.1

Retry with exponential backoff

async function apiRequest(url, options, maxRetries = 3) {
  for (let i = 0; i < maxRetries; i++) {
    const response = await fetch(url, options);
    if (response.status === 429 || response.status === 503) {
      const retryAfter = response.headers.get('Retry-After') || 5;
      await new Promise((r) =>
        setTimeout(r, retryAfter * 1000 * Math.pow(2, i))
      );
      continue;
    }
    return response;
  }
  throw new Error('Max retries exceeded');
}

Poll for pending results

async function getResults(assessmentId, token) {
  while (true) {
    const res = await fetch(
      `https://ailat.io/api/v1/assessments/${assessmentId}/results`,
      { headers: { Authorization: `Bearer ${token}` } }
    );
    if (res.status === 200) return res.json();
    if (res.status === 202) {
      const delay = res.headers.get('Retry-After') || 30;
      await new Promise((r) => setTimeout(r, delay * 1000));
      continue;
    }
    throw new Error(`Unexpected status: ${res.status}`);
  }
}

• Industry identifiers unified: the API, the question bank, the importer and the picker share one 19-value list (Academia & Education, Legal Services, Science & Research, Retail & Consumer Goods, General, …). The old labels Education, Retail & E-commerce and General (Cross-industry) are still accepted and normalized.
• Session writes are conflict-safe: creation is create-if-absent, activity and status changes are atomic, versions come only from stored state. A stale write can no longer erase an accepted answer or reopen a finished assessment (409 on conflict).
• Answer replay works in every state, including completed, and returns the bound next question; a different answer for an already-answered question returns 409.
• Served content is authoritative for scoring: retiring, editing or retyping a live bank row after it was served does not change what the participant can answer or how it is scored.
• Failed open-ended evaluations are recorded as unscored evidence (evaluation.status: failed) instead of a silent 0.5, retried durably, and republished as a new result_version.
• New terminal state incomplete_inventory for closed banks that run out of eligible items: answers are kept, GET /results returns incomplete: true and no literacy level; incomplete results are excluded from organization averages.
• Results carry provenance: instrument version, bank digest(s) served, selection and generated-item policy, scoring route, per-dimension scored and unscored counts, pretest count, evaluator availability, completion_reason and result_version.
• Organization results use cohort semantics with an observation cutoff (observed_at, completed_in_window, incomplete_assessments); windowed completion_rate is null with a note when start events do not cover the window instead of a manufactured 100%.
• Request schemas are bounded (400 with field errors for wrong types; 100-character role/department; 413 for bodies over 64 KB) and analytics grouping is safe for any label.
• Authorization is checked immediately after lookup on every participant route, so a foreign organization receives an identical 403 regardless of session state.
• The documented 30-minute automatic pause was never enforced and has been removed from the contract; pausing is client-initiated. Retention: 7 days idle, 90 days after completion.
• Post-review fixes: adaptive selection keeps the v2 evidence floor feasible for every participant; a bank outage is a 503, never inventory exhaustion; failed evaluations retry durably outside the object lock and republish automatically; GET /results returns 202 while a corrected score is unpublished; privacy erasure removes retained cohort start keys and the admin export returns every result version; completion_reason distinguishes insufficient_evidence.

• Completed assessments remain viewable indefinitely — GET /assessments/{id}/results now serves directly from the immutable result record without requiring the underlying session to still exist.
• GET /assessments/{id} now redirects (400 + results_url) when the session has been cleaned up but a result still exists, so bookmarked assessment URLs continue to resolve after the retention window.
• Session retention switched from a flat 24h KV TTL to a Durable Object alarm: 7 days idle for in-progress / paused, 90 days after completion. The expires_at field on /status responses now reflects the real retention deadline.
• PUT /assessments/{id}/status now rejects pending_results in addition to completed.
• Errors now always return JSON. Previously some thrown errors fell through to a plain-text 500; clients no longer have to parse non-JSON responses.
• Internal 5xx error messages are no longer disclosed to clients — server-side detail stays in worker logs while clients receive a generic message.
• Authorization is now checked before any session-mutating helper runs on GET /assessments/{id} and POST /assessments/{id}/answers.
• Organization analytics index switched from a mutable JSON array to per-result marker keys, eliminating lost-update races on concurrent completions.

• Adaptive track thresholds adjusted from ±1.5 to ±1.0 for better responsiveness.
• Adaptive track re-evaluation was announced here but shipped only as assignment on entering the adaptive phase (selection policy v1); per-answer reassignment ships as selection policy v2 with instrument v2.
• A 30-minute automatic pause was announced here but never enforced; removed from the contract in v1.1.0.
• Answer submission is idempotent (safe to retry on network timeout).
• Pending results return 202 instead of 500.
• Unimplemented endpoints return 501 with clear messaging.
• Added strongest_dimension, weakest_dimension, time_period to organization results.
• Added Cache-Control headers to results and analytics endpoints.
• Rate limiter fails closed (503) instead of silently bypassing.
• Authentication errors unified to prevent token enumeration.

• Initial API release.
• Core assessment endpoints.
• Organization analytics.
• Adaptive item selection using a 2PL model.
• Learning path recommendations.

• Batch invitations (POST /organizations/{id}/invites).
• Data export (GET /organizations/{id}/export).
• Webhook notifications (POST /webhooks).
• Enhanced organization management.