Embedding assessments in your own training website with APIs
An assessment API is a documented set of web requests that lets your own website or portal assign tests, start attempts and receive results from an assessment platform, so learners never need to see the vendor’s screens. It is one of four ways to put assessments on a training site, alongside a link, an iframe and an LTI launch.
This guide is for training providers and the web or operations leads who must decide which option to buy and how to scope it. It is a decision guide, not a developer tutorial. As of October 2026, searches for “assessment api” mostly return developer reference pages and hiring-software documentation, which rarely explain what each option costs you in control, effort and risk. Vendor behavior described here comes from that vendor’s published documentation.
Key takeaways
- Four embedding options exist: link-out, iframe, LTI launch and assessment API, and they trade build effort against control of the screen, the login and the data.
- Choose an LTI launch when learners already work inside an LMS, a link or iframe when speed matters most, and an assessment API when your portal must own the experience and the records.
- Settle which system issues the learner ID before anyone builds, because every option depends on matching learners across systems.
- Ask every vendor in writing about authentication, webhooks, rate limits, results export, versioning, sandbox access and plan limits before you sign.
What are the four ways to embed an assessment in your own training website?
The four ways are a link-out to the vendor’s hosted exam page, an iframe that shows that page inside yours, an LTI launch from a learning platform, and an assessment API where your own pages call the platform and display the results. They differ mainly in who controls the screen, the login and the data.
Here is how each option works:
- Link-out: the learner clicks from your site to a page the vendor hosts. It is the quickest to set up and the least integrated.
- Iframe: your page frames the vendor’s page, so the exam appears inside your site while the vendor still runs the screens.
- LTI: 1EdTech describes LTI as a technical standard, not a product, that connects learning tools to a learning environment without a separate login to each tool. LTI 1.3 is the current version, and its Advantage services add grade return, user and role data, and Deep Linking.
- API (headless): your developers build the screens and call the platform for items, attempts and scores, the pattern described in what a headless assessment platform is.
The options are not exclusive. Practitioner write-ups commonly describe LTI and API as complementary: LTI handles the launch and the grade, while an API covers everything else.
How do link-out, iframe, LTI and API embedding compare?
Link-out and iframe take the least effort and give you the least control. LTI gives a standard, login-free launch inside an LMS but mainly returns scores. An assessment API gives you full control of screens, identity and records, at the cost of developer time and ongoing maintenance.
This table compares the four options on the factors most training providers weigh; the ratings are our judgment, built from the vendor and standards documents cited in this post.
| Option | Screen and branding | Identity and SSO | Where results live | Build effort |
|---|---|---|---|---|
| Link-out | Vendor page, branded as far as its theme settings allow | Vendor login, or a passed ID if supported | With the vendor; you export or receive them | Lowest |
| Iframe | Your page frames the vendor’s screens | Depends on browser cookie rules and vendor support | With the vendor; you export or receive them | Low |
| LTI | Vendor tool launched from your LMS | Launch carries identity from the LMS, so no second login | Scores in the LMS gradebook, detail with the vendor | Medium; needs an LMS as the LTI platform |
| API | You build the screens, so branding is complete | You map your learner IDs to platform records | You can keep a copy in your own database | Highest: developers plus upkeep |
Which embedding option fits which training provider?
Pick the lightest option that meets your identity and reporting needs. Use a link-out or iframe to launch a few exams quickly, LTI when you or your clients deliver training in an LMS, and an assessment API when your portal must own the learner experience, pass your own learner IDs and keep results in your database.
Each option also has a case where it is the wrong choice:
- Link-out fits a provider with a handful of exams and no developers. Avoid it if clients expect one login and one brand from start to finish.
- Iframe fits a provider that wants the exam on its own page. Avoid it for exams that rely on lockdown or webcam features, as the next section explains.
- LTI fits a provider whose courses already run in an LMS that supports it. Avoid it if no learning platform exists, because LTI connects a tool to a platform.
- API fits a provider selling exams inside its own product or triggering certificates from results. Avoid it without developer capacity, because you then own the integration and the screens.
Pro tip: Write the Identity Rule First. Before comparing vendors, write one sentence stating which system creates the learner ID and which one is the master record. Every option fails the same way when two systems each issue their own IDs: results land on the wrong learner or on none.
What can go wrong when you put an assessment in an iframe?
An iframe can fail for three reasons: the exam page may refuse to be framed, the browser may block cookies the exam needs, or security features such as lockdown or webcam recording may not work inside a frame. Test in Safari, Firefox and a private Chrome window before promising a launch date.
The first failure is permission. MDN explains that the frame-ancestors directive, sent by the framed page’s server, specifies which parents may embed a page. So the vendor must allow your domain. You cannot fix a refusal on your side.
The second is cookies. According to MDN’s guide to third-party cookies, Firefox and Safari restrict them by default and Chrome blocks them in Incognito mode. Testportal’s embedding guide gives the same warning and suggests sending learners to a full browser tab if problems persist.
The third is security features. TestInvite’s help article says tests that use lockdown, webcam recording, screen recording or logging should not be embedded, and recommends linking to the test’s own URL instead.
What does an assessment API let you do that a link cannot?
An assessment API lets your own system tell the platform who the learner is, start or assign an attempt, and receive the result automatically. That removes re-entered names, manual score exports and a second login, and lets you show results, issue certificates or update client records from your own portal.
Published vendor documentation shows the range. Testportal says its API extension lets you pass your own user identifiers, skip the start page, and receive results at a webhook or download them through API requests, and that the extension is available only in its MAX Customized plan as of October 2026. ClassMarker’s integration page describes webhooks that send exam results to your platform and an API that can read, add and edit questions and categories.
The cost of full control is ownership. If you build the screens, you own error messages, accessibility and mobile behavior. Our post on what learners notice in a branded exam portal covers that side, and the build-versus-buy framework shows where interoperability sits in the cost of an engine.
What belongs on an integration scoping checklist?
An integration scoping checklist lists the decisions to settle before any developer starts: who issues learner IDs, which exam rules the platform enforces, where results are stored, what learners see on failure, who owns the data on exit, and who maintains the integration. Settling these first prevents most rework.
Work through these items with your web lead, your operations lead and the vendor:
- Identity: which system creates the learner ID, and how do you match a learner who already has two accounts?
- Assignment: who assigns exams, and what triggers it: a purchase, a course completion or an instructor action?
- Exam rules: which rules, such as time limit, attempts and pass mark, live in the platform and which in your portal?
- Results: which fields must come back (score, pass or fail, date, item-level data), how fast, and which certificates or client reports depend on them?
- Failure: what does the learner see if the platform or your site goes down mid-exam, and who gets the call?
- Ownership and exit: where does the data live after you leave, and in what format?
- Maintenance: who watches version notices and error logs, and how often?
Which questions should you ask any vendor about its assessment API?
Ask each vendor for written answers on authentication, webhooks, rate limits, results export, versioning, sandbox access, plan limits and standards support. Vague replies are a signal to ask for the documentation before you commit. A mature API can usually answer all of these from published pages.
This table lists the questions and what a good answer looks like, with published examples as of October 2026.
| Topic | Ask the vendor | What a good answer looks like |
|---|---|---|
| Authentication | How are credentials issued, scoped and revoked? Can one learner’s record be read with another learner’s ID? | Scoped, revocable credentials and object-level access checks. The OWASP API Security Top 10 (2023) ranks broken object level authorization and broken authentication first and second. Inspera’s API policy states that authentication uses OAuth. |
| Webhooks | Which events exist, how are they signed, how often are they retried, and how do we spot duplicates? | Signed payloads, a stable event ID and retries with backoff. The Standard Webhooks spec uses an HMAC-SHA256 signature, an ID that stays the same across retries, and retries over a period of days. |
| Rate limits | What are the limits per customer and per endpoint, and what happens when we exceed them? | Numbers in the documentation and an HTTP 429 response, optionally with a Retry-After header. Inspera’s policy caps concurrent requests at ten per customer. |
| Results export | Can we pull item-level results in bulk through the API, not only a spreadsheet from the admin screen? | A documented endpoint or scheduled export, tested on one of your real exams. |
| Versioning | How are breaking changes versioned, and how much notice do we get? | A written policy. Inspera’s says breaking changes are generally announced at least six months ahead, and never with less than 30 days. |
| Sandbox | Is there a non-production environment with test data and the same API behavior? | A separate sandbox included in your quote, so you never build against live learners. |
| Plan limits | Is API access included in the plan you are quoting? | Written confirmation. Learnosity’s documentation says its lower-level Assess API “may not be available on all plans”. |
| Standards and exit | Can we export items in QTI, and is the LTI 1.3 launch certified? | A QTI export tested on your items. 1EdTech’s TrustEd Apps Directory lists products that have achieved its interoperability certification. |
Apply the same reading to SimpliAssess. Its features page describes an API-first design for delivering items and tests to web apps, mobile apps and other digital devices, lists easy integration as a standard feature, and lists customization and integration support as a premium one. Its published pages do not describe authentication, webhooks, SSO, LTI or iframe embedding, so put every question in the table to SimpliAssess in writing, as you would to any vendor.
Pro tip: Rehearse a Bad Day. During the pilot, switch your results endpoint off for an hour, then back on. Confirm the missed results arrive after the retries and that none are counted twice. Vendors that can show this on request have usually thought about failure; those that cannot may not have.
What should you do next?
Run a one-week paper exercise before any build. Write the identity rule, the results fields you need and the failure behavior, then score the four options in the comparison table against them. Most providers will find one option clearly wins on their own constraints.
Then pilot the lightest option that passes. If you are still choosing a platform, add the vendor questions above to your assessment platform RFP checklist, and ask for sandbox access so your messiest real exam runs through the integration before you commit.
Frequently asked questions
What is an assessment API?
An assessment API is a documented interface that lets your software work with an assessment platform: assign or start tests for known learners, fetch questions or attempts, and receive scores and results. It makes a headless setup possible, because your own pages handle the screens while the platform runs the items, scoring and records.
Is an iframe or an API better for embedding assessments?
Neither is better in every case. An iframe is faster and needs little code, but the vendor controls the screens and browsers or security settings can break it. An assessment API takes developer time but gives you your own screens, learner IDs and results. Choose the iframe for a quick launch and the API for a portal you will keep extending.
Does LTI replace an assessment API?
No. LTI is a 1EdTech standard for launching a tool from a learning platform without a separate login and returning grades, and its Advantage services add rosters and deep linking. An API covers cases LTI does not, such as a custom portal or data beyond one course. Many setups use both.
Can you embed an assessment without a developer?
Yes, for link-out and iframe options. Some vendors generate the embed code and you paste it into your page, as TestInvite’s help article describes. You need a developer for an assessment API, and for any setup that must pass learner IDs, receive webhooks or sync results with your own systems.
How do assessment results get back to my own system?
There are three routes: a webhook the platform calls when a result is ready, an API call where your system asks for results, or an LTI grade return into an LMS gradebook. Ask which fields each route carries, because a score alone may not include item-level responses or attempt details.
What is QTI, and does it matter for embedding?
QTI is the 1EdTech Question and Test Interoperability standard for exchanging item and test content and results between systems; version 3.0 reached final release on May 11, 2022. It matters less for the embed itself than for exit, because it lets you move your item bank if you change platforms.
