ClassMarker
BUSINESS · TASKS
Exam results, the question bank, and its categories in the account they connected.
Connecting ClassMarker in practice
ClassMarker allows 30 requests per hour per API key, which is two orders of magnitude tighter than most of this catalog and makes polling a non-starter — results are meant to arrive by webhook. Every request also carries a SHA256 hash of api_key + secret + timestamp valid within a five-minute window, so clock drift presents as an authentication failure.
Rate limits
- 30 requests per hour per API key. Responses include next_request_after, the timestamp at which you may retry.
- Adding or removing access codes does not count against the hourly allowance.
- A maximum of 200 results per request; the limit parameter cannot exceed 200.
Worth knowing
- Authentication is a signature, not a bearer token: hash('sha256', api_key + secret + timestamp) in lowercase, with the timestamp in seconds and only five minutes of allowed variance.
- Webhooks retry within minutes on the first failure, then once an hour for 72 hours, and the webhook is set inactive after 1,000 consecutive failures; the counter resets on any 2XX and only the failing webhook is deactivated.
- Webhook payloads are verified with an HMAC SHA256 in the X-Classmarker-Hmac-Sha256 header computed over the raw JSON body, so any middleware that reformats the body breaks verification.
- Pagination is timestamp-based through finishedAfterTimestamp rather than page numbers — except question retrieval, which does use page — so two different walk patterns are needed in the same integration.
- Access is granted per test result rather than by scope: ClassMarker’s wording is that you have "full control over adding and removing access to particular test results for each API key", and the account has to be upgraded before the API works at all.
Checked against ClassMarker API documentation (2026-09-29), ClassMarker webhooks (2026-09-29)
What an agent can do
Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.
Often connected alongside
Put ClassMarker behind one governed endpoint.
Same permissions, same audit trail, whatever else you connect next.