---
title: "Analyze Pronunciation Preview"
method: POST
path: "/api/word-of-day/pronounce-preview"
tags: ["word-of-day", "word_of_day"]
---

# Analyze Pronunciation Preview

`POST /api/word-of-day/pronounce-preview`

Analyze pronunciation for preview/onboarding users (anonymous users).
Saves attempts to database for anonymous users.
No authentication required but user_id should be provided.

🔒 Deliberately unauthenticated (onboarding happens before an account
exists), but the `user_id` used to attribute a saved attempt had no
ownership check at all: anyone — including an authenticated caller —
could pass a REAL registered user's UUID and write a forged pronunciation
attempt (score, analysis) into their history/leaderboard placement. When
the CALLER does present a valid token, the attempt is attributed to that
token's identity, not the client-supplied user_id — closing the "logged
in attacker targets a real victim account" case while leaving the
genuinely anonymous onboarding flow (no token at all) unchanged.

## Response `200`

Successful Response

- unknown

## Other responses

- `422` — Validation Error

---

[API](https://skmtc.dev/fluentea/apis/aurqa-language-learning-platform-refactored.md) · [All operations](https://skmtc.dev/fluentea/apis/aurqa-language-learning-platform-refactored/llms.txt) · [OpenAPI document](https://skmtc.dev/fluentea/apis/aurqa-language-learning-platform-refactored/revisions/ee945980cf00?raw)