can the post be sanitised before passing to the external service?

Trusting the raw post from a user (anonymously - no login is required on this page either) - and then allowing it to just post the full payload without any sanitising/cleaning seems pretty risky here - probably makes it easy to overwhelm the end point.

As this is only triggered on grading page by teachers - surely there should be a require_login call and a capabiltiy check to see if the user can actually grade users before allowing it to use the endpoint?