I'm seeing the same behavior you are. Usually, at this point, I'd dig into the source code for Canvas, but New Quizzes isn't open source, so I can't say anything definitively. Here's my best shot, though.
As a note on the internals of New Quizzes as I understand them (I'm not an Instructure employee, but I've spent enough time reading the Canvas codebase to understand a lot of how it works), New Quizzes isn't technically a part of Canvas; it's an LTI that has a number of special UI considerations in Canvas to make it seem like it's an integral part of Canvas. However, despite the tight integration with Canvas, the entirety of New Quizzes is hosted on a separate system. What Canvas is doing when you call the New Quizzes API is likely proxying those calls to the actual New Quizzes service (hence why the API endpoints are incongruent with the rest of the Canvas API). You can verify this by making an External Tool assignment in Canvas and selecting "Quizzes 2" from the list of LTIs---even if the New Quizzes feature flag is disabled in your Canvas instance, you'll have created a New Quizzes quiz.
I was able to take a look at the code that generates the list of scopes in the Developer Keys UI, and that did give a promising lead. From what it looks like, that modal makes a call to /api/v1/accounts/self/scopes?group_by=controller. By downloading the JSON that endpoint returns, I was able to find some evidence that at least one New Quizzes scope is included in the list of scopes:
| 767 |
|
| controller |
"quizzes_next/quizzes_api" |
| action |
"index" |
| verb |
"GET" |
| path |
"/api/v1/courses/:course_id/all_quizzes" |
| scope |
"url:GET|/api/v1/courses/:course_id/all_quizzes" |
| resource |
"quizzes" |
| resource_name |
"Quizzes" |
Canvas sometimes internally refers to New Quizzes as Quizzes Next, so this looks promising. However, it's troubling that the path and scope for this are not listed on the documentation for the New Quizzes API and that this is the only scope that looks relevant. Looking at the code in Canvas that generates the list of valid scopes, it looks like this is automatically generated by walking through the API routes defined in the router.rb file in Canvas. Looking at router.rb, this assumption seems to be correct.
Given the differences in how New Quizzes works versus the rest of Canvas, here's a few possibilities (entirely speculation; not based on actual testing):
- The New Quizzes endpoints, not technically being part of Canvas itself, don't require granting scopes for the developer key to work but will work regardless of the scopes on the developer key
- The New Quizzes endpoints cannot be used with scoped developer keys because they're not part of Canvas itself
- The New Quizzes endpoints *actually* don't have unique scopes and use the same scopes as the Classic Quizzes API
- Someone forgot to add the special case for the New Quizzes API endpoints and what happens is anyone's guess
Either way, all of these possibilities point to a bug in Canvas itself, and Instructure support or your CSM are going to be the ones that can actually get this in front of one of the Canvas developers.
I hope this helps you build that case with them.
