API

The HTTP API lives at https://api.asknex.dev/v1. Responses are JSON; errors follow RFC 9457 (application/problem+json) with a stable code field and field-level errors in extra.errors.

• Authentication: session cookies with a CSRF double-submit header (X-CSRF-Token), or Authorization: Bearer for API clients. Learners and platform staff use their own cookies.
• Concurrency: drafts use If-Match with the draft version; write endpoints accept Idempotency-Key.
• Pagination: cursor based (cursor, limit).
• Attempts: start with POST /v1/publications/{slug}/attempts, save answers with PUT /v1/attempts/{id}/answers (revision based), navigate with next/back, submit, read result. Anonymous attempts receive a capability cookie or token.

The route catalogue is generated from the handlers into docs/api/openapi.yaml.