Skip to main content

​
API keys

Send a Continuous API key on every /v1 operation:
There is one security scheme and no scopes or roles. A key resolves to exactly one workspace, so no workspace header is needed. Lists and reads return that workspace’s resources plus the Continuous catalog Simulators; catalog Simulators cannot be changed or deleted (403 auth_forbidden). Create API keys in the app under Settings, then API keys. Key management has no public API. See Errors for authentication failures and recovery.

​
Simulation tokens

Send a Simulation token to the Simulation’s data-plane endpoint:
The token never authenticates a /v1 route. Create and fork return a token once, valid for one hour; later reads omit it. Mint more with POST /v1/simulations/{id}/tokens (the generated token endpoint lists the ttl_seconds range); other unexpired tokens stay valid. A missing or rejected token answers 401 auth_invalid with the response header X-Continuous-Simulation-Token-Rejected: true. A stopped Simulation answers 409 simulation_stopped before the token is checked. See Send requests to a Simulation for the other data-plane responses.