It looks like given the auth token of a student's account, /quizzes/:id/questions endpoint is not accessible, same as the /assignments/:id/submissions endpoint. Using /quizzes/:id endpoint I am able to get the html_url: https://school.instructure.com/courses/1354624/quizzes/2056699, which returns the HTML page with the quiz questions and submissions, which is okay (I can parse the HTML page to get that info), but that page is not loading without the SAML (outlook) authentication. I need to retrieve that information on the backend for different students using just their auth token. Is there another endpoint I can use, or any other suggestions?

curl -H "Authorization: Bearer XXXX" "https://school.instructure.com/api/v1/courses/1354624/quizzes/2056699/questions"

{"status":"unauthorized","errors":[{"message":"user not authorized to perform that action"}]}%

curl -H "Authorization: Bearer XXXX" "https://school.instructure.com/api/v1/courses/1354624/assignments/7335561/submissions"

{"status":"unauthorized","errors":[{"message":"user not authorized to perform that action"}]}