# Proctoring settings

Endpoint has two settings layers. They are not interchangeable.

| Layer | Set by | Scope | Use for |
|---|---|---|---|
| Per-launch LTI policy | Your platform in the launch JWT | One attempt | Identity, room scan, setup checks, and LTI Proctoring Services second-monitor policy. |
| Tenant account settings | Endpoint on your account | All sessions for the tenant | Clipboard behavior, recording delivery, and webhook configuration. |

LTI Proctoring Services should use the per-launch policy. A limited LTI Core launch path may accept the same claim if present, but that does not turn it into the full Proctoring Services lifecycle.

## Per-launch policy

Put the standard LTI Proctoring Services claim in the launch JWT. Endpoint defines the opaque `data` string as JSON.

```json
{
  "https://purl.imsglobal.org/spec/lti-ap/claim/proctoring_settings": {
    "data": "{\"version\":1,\"identity_verification\":\"required\",\"room_scan\":\"skip\",\"secondary_monitor\":\"allow\",\"setup_checks\":\"required\"}"
  }
}
```

Send only keys you want to change. Omitted keys use defaults. The policy is snapshotted onto the attempt at launch.

| Key | Values | Default |
|---|---|---|
| `version` | `1` | Required when the claim is present |
| `identity_verification` | `required`, `skip` | `required` |
| `room_scan` | `required`, `skip` | `required` |
| `secondary_monitor` | `allow`, `flag` | `flag` |
| `setup_checks` | `required`, `skip` | `required` |

| Key | Effect |
|---|---|
| `identity_verification` | `required` shows government ID and liveness checks; `skip` omits them. |
| `room_scan` | `required` shows the four-frame room scan; `skip` omits it. |
| `secondary_monitor` | For LTI Proctoring Services, `flag` reports additional displays and `allow` disables that detection. |
| `setup_checks` | `required` runs camera, screen-share, test-violation, and heartbeat checks; `skip` marks them complete and records `staging_skipped_by_policy`. |

Identity and room scan each allow three attempts before the session is held for review. Accepted ID types are `passport`, `driver_license`, `military_id`, `national_id`, `state_id`, and `residence_card`.

## Validation

Malformed policy fails closed. Endpoint rejects the launch instead of silently falling back to a weaker policy.

Rejected examples include:

- `proctoring_settings` is not an object.
- `data` is missing, not a string, invalid JSON, or not a JSON object.
- `version` is missing or not `1`.
- Unknown keys are present.
- A value is outside the allowed set, including explicit `null`.

A launch with no `proctoring_settings` claim is valid and uses defaults.

## Tenant account settings

Ask Endpoint to change these. There is no partner-facing API for tenant settings.

| Setting | Current behavior |
|---|---|
| `allow_copy_paste` | Honored. When false, copy, cut, and paste are blocked and reported. When true, clipboard behavior is allowed. |
| `allow_second_monitor` | Account-level fallback for sessions without a per-launch policy. LTI Proctoring Services uses the per-launch `secondary_monitor` policy. |
| `save_screen_recording` | Controls partner S3 delivery. Camera upload to partner S3 happens when S3 is configured; screen upload requires explicit enablement. Do not infer a global recording default from this setting alone. |
| `require_id` | Not currently honored as a tenant control. Use per-launch policy on LTI. |
| `require_room_scan` | Not currently honored as a tenant control. Use per-launch policy on LTI. |
| `strict_mode` | Not currently honored. |
| `allow_tab_switches` | Not a supported partner threshold. Treat tab switches as reportable from the first detection. |

Storage credentials, webhook URL, webhook secret, and selected webhook events are also tenant-level configuration. See [Webhooks and events](/docs/proctoring/webhooks-and-events).

## Common policies

| Goal | Policy |
|---|---|
| Standard high-assurance exam | Send no claim; defaults require identity, room scan, second-monitor flagging, and setup checks. |
| Your platform already verified identity | `identity_verification: skip` |
| Low-friction exam | `identity_verification: skip`, `room_scan: skip`, `setup_checks: skip` |
| Candidate is allowed a second display | `secondary_monitor: allow` |
| Your platform runs equivalent system checks | `setup_checks: skip` |

## Related

- [LTI 1.3 Proctoring Services](/docs/proctoring/lti-1-3)
- [Overview](/docs/proctoring/overview)
- [Webhooks and events](/docs/proctoring/webhooks-and-events)

_Last verified: 2026-09-03 against main._