---
title: "Start a Tier 0 dual-gate attempt"
method: POST
path: "/api/eval/attempt"
tags: ["certification"]
---

# Start a Tier 0 dual-gate attempt

`POST /api/eval/attempt`

## Request

- Base URL: `https://aioq.org`
- URL: `https://aioq.org/api/eval/attempt`
- Auth: one of:
  - none
  - HTTP bearer

Issues one exam paper: the public Gate A items plus the Gate B items drawn for this attempt from a private, rotating variant pool (3 per mapped provision, stratified over the role and pressure axes). Gate B items are served without their expected answers, without provenance, without their provision label, and under opaque per-attempt handles instead of their bank ids. The draw is a seeded, deterministic stratified selection; the seed and the served item ids are recorded on the attempt, so the exact paper can be reproduced afterwards. The sha256 of every private item is published as a signed commitment file, so items cannot be altered after the fact. The model, version, and operator are fixed at this point — the score report issued from this attempt carries exactly this identity. The attempt expires 24 hours after issuance and accepts exactly one submission, and that submission always yields a report: Tier 0 applies no pass threshold. Both gates measure model judgment alignment with the formalized provisions only. Neither assesses the organizational or management-system obligations the reference norm also imposes, so no score is evidence that those obligations have been met; the response repeats this in `measurementScope`. Rate-limited to 10 requests per 10 minutes per client. Authentication is optional: send `Authorization: Bearer <Firebase ID token>` from a signed-in aioq.org account to link the attempt to it — the operator email is then forced to the verified account address and the attempt appears at GET /api/me/certifications. A header that is present but invalid is rejected with 401 rather than ignored; an account whose email is not verified is rejected with 403. AIO agent keys are not accepted in this header.

## Request body

- object
  - `modelName` string, required
  - `modelVersion` string, required: The score report is pinned to this version.
  - `operator` object, required
    - `name` string, required: Published in the registry.
    - `email` string, email, required: Recorded only; never published.
    - `url` string, uri
  - `contact` string, email: Defaults to operator.email.
  - `packId` string: Defaults to `eu-ai-act`.

## Response `201`

The attempt and its exam paper.

- object
  - `attemptId` string, required
  - `expiresAt` string, date-time, required: 24 hours after issuance.
  - `packId` string
  - `packVersion` string
  - `methodologyVersion` 'v2-draft'
  - `gateA` object, required
    - `count` integer
    - `totalWeight` number
    - `items` object[]
      - `id` string, required
      - `packId` string, required
      - `article` string, required: The provision of the reference norm the item is derived from.
      - `scenario` object, required
        - `en` string, required
        - `ko` string, required
      - `question` object, required
        - `en` string, required
        - `ko` string, required
      - `responseFormat` 'ves-code' | 'ves-ranking' | 'choice', required
      - `options` object[]: Present on choice items only.
        - `id` string
        - `label` object: Localized text. `en` is always present.
          - `en` string, required
          - `ko` string
      - `weight` number, required: Weight in the total score.
      - `status` 'draft' | 'active' | 'retired', required
  - `gateB` object, required
    - `count` integer
    - `perProvision` 3
    - `provisions` object[]: Per provision: how many variants were drawn and over how many distinct (role|pressure) strata.
      - `article` string
      - `itemCount` integer
      - `distinctStrata` integer
    - `items` object[]
      - `id` string, required: Opaque per-attempt handle — a random alias valid only on this attempt, not the item's id in the private bank. Real Gate B ids are derived from the provision the item tests, so serving them would give back the item-to-provision mapping that withholding `article` removes. Submit answers keyed by this handle; the server resolves it. The same item drawn on a later attempt carries a different handle, and `gateB.perItem` in the submit response is reported under these handles too.
      - `packId` string, required
      - `scenario` object, required
        - `en` string, required
        - `ko` string, required
      - `question` object, required
        - `en` string, required
        - `ko` string, required
      - `responseFormat` 'ves-code' | 'ves-ranking' | 'choice', required
      - `options` object[]: Present on choice items only.
        - `id` string
        - `label` object: Localized text. `en` is always present.
          - `en` string, required
          - `ko` string
  - `methodology` object
  - `notes` string[]

## Other responses

- `400`: Validation failed; `details` lists each problem.
- `401`: An Authorization header was present but the ID token could not be verified. Omit the header to start an anonymous attempt.
- `403`: The account behind the ID token has no verified email address, so nothing can be linked to it.
- `404`: No public item bank for that pack.
- `429`: Rate limit exceeded.
- `503`: The private Gate B bank or the attempt store is unavailable on this deployment, or the Gate B pool holds no active items yet. Gate A can still be scored, without a score report, by POSTing to /api/eval/submit with no attemptId.

---

[API](https://skmtc.dev/aioq/apis/aio-public-api.md) · [All operations](https://skmtc.dev/aioq/apis/aio-public-api/llms.txt) · [OpenAPI document](https://skmtc.dev/aioq/apis/aio-public-api/revisions/377b76120162?raw)