Run your first simulation
Three steps to ship a controlled Breach & Attack Simulation against an LLM endpoint.
This walkthrough covers the shortest path from an empty workspace to a completed controlled run: create tenant credentials, pick a scenario template, and read the verdict. Every step uses the same public API that the CLI and SDKs wrap, so what you set up here transfers directly to CI.
Before starting, have an administrator API key ready (Settings → API keys, didk_ prefix) and a target you are authorized to test. The starting profile is quick with low attack depth — the conservative default every first run should keep.
Create your account and target
Register, generate an API token, and register the first allowed target. Targets must match your scope policy; out-of-scope endpoints are rejected.
Checklist
- Register a tenant and verify your email.
- Generate an API token from Settings → API keys.
- POST /v1/runs with your first target and the `quick` profile.
Pick a scenario catalogue
Choose a built-in catalogue (quick / deep / OWASP LLM only) or a tenant scenario template. Verdicts use validated engine evidence; uncertain model or judge output remains inconclusive.
Checklist
- Pick a scenario catalogue from the run creation dialog.
- Adjust scenario parameters if your endpoint expects a specific format.
- Set the target_scope: which domains and paths the engine may probe.
Run and read the findings
Trigger the run, watch the dashboard stream events, and, on an eligible Starter+ run, open the evidence pack when it finishes. Each finding ships with a prioritized remediation plan.
Checklist
- Start the run (idempotent via Idempotency-Key).
- Read findings; sort by severity and confidence, then verify the referenced evidence.
- For an eligible Starter+ run, export the evidence pack and assign actions to your team.