---
title: "Create Scenario"
method: POST
path: "/api/v1/simulation/suites/{suite_id}/scenarios"
tags: ["simulation"]
---

# Create Scenario

`POST /api/v1/simulation/suites/{suite_id}/scenarios`

## Request

- Base URL: `https://cp.xenovia.io` (the document declares no server; this is the origin it was published from)
- URL: `https://cp.xenovia.io/api/v1/simulation/suites/{suite_id}/scenarios`
- Auth: none declared

Save a scenario, active or (status draft) waiting for review. Nothing
here calls a model.

## Path parameters

- `suite_id` string, uuid, required

## Headers

- `Authorization` string, nullable
- `X-Request-ID` string, nullable

## Request body

- ScenarioCreate: A new scenario: its name (may be blank, then derived), objective and kind are given. A draft waits for review and never runs.
  - `kind` 'attack' | 'functional', required
  - `objective` string, required
  - `expected` string, required
  - `name` string, nullable, required
  - `category` 'prompt_injection' | 'data_exfiltration' | 'system_prompt_leak' | 'unauthorized_action' | 'off_scope' | 'harmful_content' | 'impersonation' | 'cost_abuse' | 'tool_misuse' | 'privilege_escalation' | 'context_poisoning' | 'jailbreak' | 'output_exfiltration' | 'false_action', nullable
  - `severity` 'critical' | 'high' | 'medium' | 'low', nullable
  - `must_not` string, nullable
  - `persona` Persona: The simulated user: a name and who they are.
    - `name` string, required
    - `context` string, nullable
  - `tool_responses` ToolResponse[], nullable
    - `tool` string, nullable
    - `response` string, required
    - `planted` boolean
  - `facts` string[]
  - `tool_expectations` ToolExpectation[]
    - `kind` 'must_call' | 'never_call' | 'max_calls', required
    - `tool` string, required
    - `arguments` object, nullable
    - `before` string, nullable
    - `count` integer, nullable
  - `tactic` string, nullable
  - `technique` 'direct' | 'crescendo' | 'split_request' | 'role_drift' | 'context_poisoning' | 'many_shot' | 'planted_instruction', nullable
  - `resembles` 'prompt_injection' | 'data_exfiltration' | 'system_prompt_leak' | 'unauthorized_action' | 'off_scope' | 'harmful_content' | 'impersonation' | 'cost_abuse' | 'tool_misuse' | 'privilege_escalation' | 'context_poisoning' | 'jailbreak' | 'output_exfiltration' | 'false_action', nullable
  - `cves` string[]
  - `max_turns` integer
  - `status` 'draft' | 'active'

## Response `201`

Successful Response

- unknown

## Other responses

- `422`: Validation Error

## Changes

- **2026-10-26** `3e25bef24f8f`: 5 breaking, 6 warning, 16 info
  - the request property `expected` became required
  - the request property `kind` became required
  - the request property `name` became required
  - request property `expected` list-of-types was narrowed by removing types `null` from media type `application/json`
  - …23 more
- **2026-10-08** `1882866431ad`: 5 breaking, 5 warning, 13 info
  - removed the enum value `data_exfiltration` of the request property `category`
  - removed the enum value `off_scope` of the request property `category`
  - removed the enum value `prompt_injection` of the request property `category`
  - removed the enum value `system_prompt_leak` of the request property `category`
  - …19 more
- **2026-10-08** `a141cb4fdc6a`: 8 info
  - added the new optional request property `faults`
  - added the new optional request property `injections`
  - added the new optional request property `kind`
  - added the new optional request property `persona`
  - …4 more
- **2026-10-04** `b475b750a0b7`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/xenovia/apis/controlplane/changes/api/v1/simulation/suites/:suite_id/scenarios/post.md)

---

[API](https://skmtc.dev/xenovia/apis/controlplane.md) - [All operations](https://skmtc.dev/xenovia/apis/controlplane/llms.txt) - [OpenAPI document](https://skmtc.dev/xenovia/apis/controlplane/revisions/3e25bef24f8f?raw)