The Creatium Assess Partner API lets a learning platform, or an organization's own systems, import its assessment catalog, synchronize learner attempts and results, and optionally enroll learners or give them assignments ahead of launch.
Identity. Learners are identified by enterprise email address, compared case-insensitively and returned in lower case. It is the same address the organization's SAML 2.0 identity provider sends as NameID. Every person also has a personId (UUID) that stays the same when their email changes (POST /people/{personId}:changeEmail), and can carry the employer's own externalId. An assessmentId is a UUID. It is stable for the life of the assessment, identical in every endpoint, and never reused.
Tenancy. Every client belongs to one Creatium organization. Every request sees only that organization's assessments, learners and results.
Transport. HTTPS only, TLS 1.2 or later: TLS 1.0 and 1.1 are refused. Plain http:// answers 308 to the same https:// address, but call https directly: a token sent over http has already crossed the network in the clear. Responses carry Strict-Transport-Security.
Conventions. JSON over HTTPS. Timestamps are returned in ISO 8601 UTC with a Z suffix; timestamps sent with another offset are accepted and converted. Field names are camelCase. List endpoints use cursor pagination (see Pagination); a cursor only works with the filters it was issued for (other filters give 400). An ID in the path that is not a UUID gives 400; a well-formed one that matches nothing gives 404. An unknown path gives 404 and a method a path doesn't take gives 405 with Allow, both as problem details. Errors use RFC 9457 problem details (see Problem); each error code is explained at https://app.assess.creatium.com/docs#error-<code>. Unknown fields may be added to responses at any time within a version, so clients should ignore fields they do not recognize.
Response shape. Reads wrap their payload in data (lists add pagination). Six writes return the object itself: POST /enrollments, POST /assignments, GET and PATCH /assignments/{assignmentId}, POST /assignments/{assignmentId}/members and PUT /people/{learnerEmail}. v2 will wrap every response.
Personal data in paths. Paths that name a person (/enrollments/{assessmentId}/{learnerEmail}, /assignments/{assignmentId}/members/{learnerEmail}, /people/{learnerEmail}) take either the email address or the personId. Prefer the personId: proxies and access logs may record paths. v2 will take only the personId.
Data retention. Results are kept while the organization is a customer and deleted 90 days after it leaves. Proctoring readings are kept 90 days. A REMOVED record stays in /results for 30 days. Delivered webhook events are kept 30 days. POST /people/{personId}:erase removes a person on request (GDPR, CCPA) at any time. Data is stored in the United States; other regions on request.
Launch options. Besides launchUrl (SP-initiated SSO), every assessment can be delivered from an LMS as a SCORM 1.2 package (Assessment Designer → Share → SCORM) or embedded in an iframe at /embed/{assessmentId} from domains the organization allows (Admin → Embed). Results from every route appear in /results.
Concurrency and retries. GET /assignments/{assignmentId} returns an ETag; send it back as If-Match on PATCH and a change made by someone else in between gives 412. Every POST, PATCH and PUT takes an Idempotency-Key.
Managers and privacy. People can carry managerEmail, department and location (PUT /people, POST /people:batch). Person-level reads and analytics take team, managerEmail and includeIndirect to narrow themselves. A client can get a token *for a manager* (token exchange, see /oauth/token): it reads only, and only that manager's reports, direct and indirect. What such a token may see, how small a group analytics will show, and whether proctoring and answer keys need their own scopes is the organization's policy (GET /organization/policy, set by its admins).
Events. Every change a webhook announces is also kept 30 days at GET /events, so a client that missed deliveries can catch up. Endpoints can be managed by API (/webhook-endpoints, scope webhooks:manage) as well as in the admin portal. A client can rotate its own secrets (/client-secrets) and revoke its tokens (/oauth/revoke).
Rate limits. 600 requests a minute per client. Every response carries RateLimit-Limit, RateLimit-Remaining and RateLimit-Reset, and an X-Request-Id; over the limit, 429 with Retry-After. List pages hold up to 200 records (1,000 for /analytics/answers).
Credentials. OAuth 2.0 client credentials (oauth2) are the way in. Each client can hold two live secrets, so a secret is rotated without downtime: add a new secret on the organization's API page, switch to it, then revoke the old one. Older integrations may use an API key (apiKey, see security schemes); prefer OAuth clients for anything new.
Sync schedule. Catalogs change rarely: import hourly with updatedSince. Results: pull every few minutes, or on each result.updated webhook.
Timeouts. Calls normally answer in a second or two; the server allows up to 900 seconds. Use a 30-second client timeout and retry with exponential backoff.
Network. No IP allow-listing is needed in either direction: calls to Assess are public HTTPS secured by OAuth. If your firewall allow-lists the addresses you call, every *.assess.creatium.com host (production and staging) answers on 34.102.249.142. Webhook deliveries come from Google Cloud addresses that change, so verify the Creatium-Signature rather than the sender's IP. Fixed outbound IPs are available on request.
Sandbox. On staging (https://staging.app.assess.creatium.com/api/v1) a partner gets its own sandbox organization, with assessments to integrate against. There, POST /sandbox/attempts simulates a learner finishing (or starting) an assessment: the result appears in /results and result.updated and assignment.completed fire, as for a real learner. Ask support for one.
Service levels. The production API is available 99.5% of each calendar month, excluding maintenance announced 48 hours ahead. Live and past availability: https://status.assess.creatium.com, which checks GET /health every five minutes. Support answers within 24 hours; production down within 4 hours at the latest.
Changes in 1.2 to 1.6 (live 1 October 2026; all additive except these, which an existing client may notice): a path ID that isn't a UUID gives 400 (was 404); a cursor reused with other filters gives 400; unknown paths and wrong methods answer problem+json 404/405 (was an HTML page); /oauth/token without grant_type gives invalid_request; a NOT_STARTED record's resultId is now a UUID that its first attempt keeps (enr_… IDs still resolve); ResultStatus adds REMOVED; reportUrl is /report/{resultId}; an analytics team with fewer finished attempts than the organization's minimumGroupSize (default 5) is suppressed; an older attempt's lastUpdated moves when a retake flips its flags; during a webhook secret rotation Creatium-Signature carries two v1 values. The guide lists everything new, version by version.
Versioning. This is v1 (/api/v1). Fields and endpoints can be added at any time within a version. Breaking changes ship only in a new version (/api/v2), with at least 90 days' notice, and v1 keeps running alongside.
Data residency. Learner data is stored and processed in the United States (Google Cloud, US). Residency in other countries is available on request.
Support. Through a shared Slack group or support@creatium.com. Production down: we respond as soon as possible, and within 4 hours at the latest. Everything else: we respond within 24 hours. Escalation: Jisha Nambiar, jisha@creatium.com. Status: https://status.assess.creatium.com; incidents are also posted in the Slack group and emailed to your technical contact. Include the X-Request-Id of the call in question.
