Subscription keys
Allow-list of `Ocp-Apim-Subscription-Key` values (also accepted: bearer tokens minted by /sts/v1.0/issueToken, and, on the WebSocket, the key/Authorization in the query string). A key not on the list gets the observed empty 401 (issueToken: the 401 JSON body). Region: not enforced.
Latency and REST shape
Injected latency (ms) and the REST score shape ("flat" = docs REST sample, "nested" = SDK/WebSocket shape).
Forced failure
Make every data-plane call (recognition, issueToken, WebSocket upgrade) answer an HTTP status until cleared — or, with a RecognitionStatus, answer 200 with that status (NoMatch / InitialSilenceTimeout / BabbleTimeout / Error).
Scoring rules
Runtime rules are tried before config rules, first match wins; no match → the deterministic default from sha256(audio) + ReferenceText. Rule: {"match":{"refText":{"contains":"…"}},"level":"poor","status":"NoMatch","scores":{"PronScore":42},"words":[{"word":"morning","accuracy":30}]} — scores are on the 0-100 scale.
Recent assessments
Last 50 recognition calls (metadata + audio sha256; the audio bytes are never stored).