# Score export **What it is.** The outbound half of OSCAR's contract with delivery systems. Code lives in `src/async/async.go` (sweepers + `MakeExtScore`) and the driver files in `src/external/` and `src/panoutbound/`. It runs from [[outbound-score-sweeper]], which pops [[outbound-queue]] messages that [[auto-deliver-sweeper]] (and manual exports) put there. ## Flow (`ProcessOutboundScoreMessage`, `async.go:2471-2663`) 1. Load section/item/rubric (lookup caches). If `meta.do_not_export=true` and not yet exported → `finalizeDoNotExport` (`exported=true, export_bypassed=true`) with no HTTP call. 2. Endpoint = `item.GetEndpointConfigForResp(resp, secondary)` (primary, PV or secondary). `loopback` → URL becomes `CALLBACK_URL + /v1/api/score` (PAN: `/v1/api/pan/score`). 3. Driver ([[outbound-score-drivers]]): `RECOMBINE` type with target ids → `RecombineDriver`; batch → `BatchDriver` (never today); `SCORPION` → Scorpion; `meta.client_type=PAN` → `PanOutboundDriver` (OAuth with env `PAN_CLIENT_ID/SECRET` against `callback_url + /ps/auth`, payload `ExtPANScorePayload`); else `DefaultOutboundDriver`. If `credential_id` set, the [[credential]] is loaded. 4. `MakeExtScore` builds the payload (below). 5. `DefaultOutboundDriver.SendScores` (`outbound_driver.go`): **URL = `response.callback_url` if set and not secondary, else endpoint URL**; `POST`, `Content-Type: application/json`; auth by endpoint type: 0 none, 2 Basic (`credential.key/secret`), 3 GMAC signature, 5 Cognia signature, 7 Pearson OAuth (auth URL derived from the callback host + `/token` unless IRIS), 8 Accuplacer OAuth. Timeout 100 s, dial 15 s, `InsecureSkipVerify`. Any non-200 is a failure. 6. Success (non-secondary): `exporting=false, exported=true, reexported=true, export_error="", exported_at=now`, and `final_score=CalculateFinalScore` unless the response has appeal scores; `protected=true` if `client.protect_on_export`. Notify IEA (`IeaNotifyResponseExported`) when `cf_config.enabled`. Ack (delete) the message. 7. Failure: `RecordError` (broken, see [[outbound-queue]]) + `handleError` → `exporting=false, exported=false, reexported=false, exported_at=nil, export_error=`; message stays LOCKED and is retried after 2 h, up to 5 attempts. 8. Every attempt (success or HTTP failure) is logged to `api_logs_score_export` (`ScoreExportMessage`: body, URL, auth URL, **full Authorization header and credential snapshot**, response status/body). ## Payload (`ExtScorePayload`, `src/external/external_models.go`) ```json { "tenant_id": "", "section_id": "

", "item_id": "", "ref_id": "", "callback_url": "", "flags": [{"flag_name":"","code":"","reason":"","reviewed":true,"status":"…"}], "scores": [{"score_id":"","rater_id":"","score_type":1,"think_time":12, "resolution_choice":0,"created_at":"…", "trait_scores":[{"trait_id":"","trait_name":"","score":2,"condition":"","evidence":"", "max_score":4,"external_id":"","external_item_id":"", "blank_score_flag":false,"annotation":{},"feedback":"…"}], "meta_trait_scores":[{"meta_trait_id":"","value":""}]}], "final_score": { "…": "ExtScore (priority score per final_score_type, trait scores × trait.weight unless do_not_weight_scores) or ExtScoreTraitScoreFinalScore {overall_condition_code, overall_final_score, score_id, rater_id, score_type, trait_scores}" }, "meta": { "…": "response.meta as ingested", "scoredResponseText": "" }, "media": [ "only when api_export_config.include_media" ] } ``` - `scores[]` lists every score on the response in stored order (`only_last_score` keeps just the final/last one; LID exports send `scores: null`). Score types: 1 first, 2 second, 3 resolution, 4 backread, 5 adjudication, 17/18 appeal. - `meta.scoredResponseText`: set from any score whose `scoredResponseText` is non-nil (IEA outcome tag `scoredResponseText`, or carried over by the recombine driver); the last such score wins. Absent when no score has it. Consumers: AD stores it on the response state for NAVVY (AD-6322). - `flags[]`: built by `getFlagDataForScoreExport`; `status` is omitted when it is `exclude`. - `FillStandardFeedback` adds `feedback` per trait when the rubric has `standard_feedback`. ## Gotchas - `payload.Meta` aliases `response.Meta` (no copy), so the cached response's meta gains `scoredResponseText` too. - `OutboundScoreSweeper` processes one message at a time per instance and is **not** scan-locked; it starts before the `SUPPRESS_BACKGROUND_PROCESSES` / `SERVER_MODE` checks, so every instance (including web-mode ones) runs it; concurrency is safe only because claiming uses `FindOneAndUpdate`. - `client.export_delay_ms` sleeps the sweeper goroutine before each send. - A Pearson-type export with a `callback_url` derives the OAuth URL by truncating the callback at the first `.com`. - The batch path (`OutboundScoreBatchSweeper`, `BatchDriver`) is dead while `BATCH_EXPORT_URLS` is empty. ## Surfaces Attempt log: [[api-logs-api]] (`/v1/api_logs/score_export/messages`) over [[score-export-message]]. Manual queueing: [[dashboard-api]] `POST /v1/dashboard/project/section/:sectionID/export` and auditing `QueueExport`.