---
title: "Update quiz question-bank assignments"
method: PATCH
path: "/v2/quizzes/{quiz_id}/question-banks/"
tags: ["Quizzes"]
---

# Update quiz question-bank assignments

`PATCH /v2/quizzes/{quiz_id}/question-banks/`

Update up to BATCH_MAX_ITEMS quiz↔question-bank assignments in one request.

The ``quiz_id`` path resource is resolved once up front (document-level 404).
Each item carries the ``question_bank_id`` natural key plus the writable
fields; a bank not assigned to this quiz is a per-item ``not_found``. An empty
attributes set (only the key) is a no-op success. Within-batch duplicate
detection is first-wins on ``question_bank_id`` (mirrors ``bind`` / ``unbind``);
subsequent duplicates are pre-marked ``duplicate_in_batch`` without reaching
the service, so a logical update fires its ``QuestionBankAssignmentUpdated``
event exactly once. Response is 200 if all succeed, 207 if any fail, 400 if the
envelope is empty or over the cap.

See ``api_v2/docs/batch-responses.md`` for the 200/207/400 status convention.

**Required OAuth scope:** `quizzes:write`

## Path parameters

- `quiz_id` string, required

## Request body

- QuestionBankAssignmentBatchUpdateRequestEnvelope — JSON:API envelope for PATCH /v2/quizzes/{quiz_id}/question-banks/ batch updates. The ``data`` field is always an array. Cap enforcement (<=100 items) lives in the endpoint so violations produce HTTP 400 rather than Pydantic 422.
  - `data` QuestionBankAssignmentBatchUpdateData[], required — List of assignment update items.
    - `type` 'question-bank-assignments', required — Must be "question-bank-assignments".
    - `attributes` QuestionBankAssignmentUpdateRequest, required — Request schema for partial updates of a quiz↔question-bank assignment. ``question_bank_id`` is required — it is the natural key (with the path ``quiz_id``) identifying WHICH assignment to update, not a writable field. ``order`` / ``randomize_questions`` / ``limit_question_count`` are the writable fields and use PATCH semantics: a Python-level sentinel default combined with ``model_fields_set`` means an omitted field stays out of ``model_dump(exclude_unset=True)``. The endpoint pops ``question_bank_id`` before forwarding the remaining fields as ``update_fields``. ``extra="forbid"`` rejects unknown attribute keys with a 422 at the schema layer (mirrors ``QuizUpdateRequest``); the service also allowlist-guards the writable set as defense-in-depth for any non-HTTP caller.
      - `question_bank_id` string, required — Obfuscated ID of the assigned question bank to update.
      - `order` integer — New ordering value within the quiz.
      - `randomize_questions` boolean — If true, the bank's questions are presented in a random order.
      - `limit_question_count` integer — Number of questions drawn from this bank. 0 means all questions.

## Response `200`

OK

- BatchResultEnvelopeQuestionBankAssignmentResource
  - `data` union[], required — Per-item results in request order.
    - union
      - BatchSucceededItemQuestionBankAssignmentResource
        - `status` 'succeeded'
        - `id` string, nullable — Resource ID of the created or updated resource.
        - `result` QuestionBankAssignmentResource, required — JSON:API resource object for a quiz↔question-bank assignment.
          - `type` 'question-bank-assignments' — Always "question-bank-assignments".
          - `id` string, required — Opaque assignment ID.
          - `attributes` QuestionBankAssignmentAttributes, required — Attributes of a question-bank-assignment resource object. Fields mirror the writable/observable ``quiz.models.QuestionBankAssignment`` columns. ``question_bank_id`` (obfuscated) identifies the bound bank; the assignment's own obfuscated PK is the resource ``id``. No ``external_id`` — the model is not an ``ExternallyAuditableModel``.
            - `question_bank_id` string, required — Obfuscated ID of the bound question bank.
            - `order` integer, required — Ordering value of this bank within the quiz.
            - `randomize_questions` boolean, required — If true, the bank's questions are presented in a random order.
            - `limit_question_count` integer, required — Number of questions drawn from this bank. 0 means all questions.
            - `created_at` string, date-time, required — Timestamp when the assignment was created.
            - `modified_at` string, date-time, required — Timestamp when the assignment was last modified.
          - `links` object, nullable — Self and related links.
      - BatchFailedItem — Wrapper for a failed item in a 207 batch response.
        - `status` 'failed'
        - `id` string, nullable — Echoed resource ID if the input identified a row.
        - `error` BatchItemError, required — Per-item error inside a 207 batch response. Aligned with JSON:API ``ErrorObject`` field naming (``code`` rather than ``reason``) so consumers can reuse error-handling logic across document-level errors (``ErrorObject`` in ``ErrorEnvelope``) and per-item errors (here). Differences from ``ErrorObject``: ``status``/``title`` are omitted because they're redundant for the 207-batch context (HTTP status is on the envelope, and the title is derivable from ``code``).
          - `code` 'duplicate_email' | 'duplicate_in_batch' | 'duplicate_name' | 'validation_error' | 'not_found' | 'internal_error' | 'not_in_domain' | 'already_enrolled' | 'already_published', required — Machine-readable error code.
          - `source` object, nullable — Pointer to the offending input slot, e.g. {"pointer": "/data/0/attributes/email"}.
          - `detail` string, nullable — Human-readable explanation of the error.
  - `summary` BatchSummary, required — Aggregate counts for a 207 batch response. Invariant: ``succeeded + failed == total``. Enforced by ``@model_validator``.
    - `total` integer, required — Total number of items submitted.
    - `succeeded` integer, required — Number of items that succeeded.
    - `failed` integer, required — Number of items that failed.

## Other responses

- `207` — Multi-Status
- `400` — Bad Request
- `401` — Unauthorized
- `403` — Forbidden
- `404` — Not Found
- `422` — Unprocessable Entity
- `500` — Internal Server Error

---

[API](https://skmtc.net/skilljar/apis/skilljar-api-v2.md) · [All operations](https://skmtc.net/skilljar/apis/skilljar-api-v2/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/skilljar/skilljar-api-v2/revisions/f8025de20169/schema)