generated: '2026-09-04'
method: searched
source: >-
  https://docs.virtualitics.com/hc/en-us/articles/25103039519635-Setting-up-the-Virtualitics-Python-API-pyVIP-with-Virtualitics-Explore,
  https://docs.virtualitics.com/hc/en-us/articles/34015231987347-Installing-the-Virtualitics-SDK-and-CLI-Packages,
  https://docs.virtualitics.com/hc/en-us/articles/34080541869715-Deploying-an-App-Using-the-Command-Line-Interface-CLI,
  https://docs.virtualitics.com/hc/en-us/articles/21926415922323-Setting-Password-Security-and-Configuring-Single-Sign-On-SSO
checked: '2026-09-04'
derived_from_spec: false
spec_note: >-
  No OpenAPI or other machine-readable contract is published, so no securitySchemes could be
  derived. Everything below is read from the provider's own documentation.
summary: >-
  Virtualitics authenticates developers with long-lived API tokens minted by the user in the
  Virtualitics Account Portal, and authenticates human platform users with password or SSO against
  the customer's identity provider. There is no OAuth 2.0 authorization server, no OpenID Connect
  discovery document, no scope model and no published token endpoint.
schemes:
- id: vip-auth-token
  type: apiKey
  surface: Virtualitics Explore Python API (pyVIP)
  in: client-configuration
  parameter: VIP_AUTH_TOKEN
  transport: WebSocket (Explore server <-> Python client, user-chosen port)
  issued_by: Virtualitics Account Portal (https://accounts.virtualitics.com) — My Account -> Tokens and Keys -> Generate
  presentation: >-
    Set as the user environment variable VIP_AUTH_TOKEN, or passed positionally when instantiating
    the handler: `from virtualitics import api; explore = api.VIP(<token>)`.
  rotation: user-initiated regeneration in the Account Portal; no documented expiry or rotation policy
  scopes: []
  source: https://docs.virtualitics.com/hc/en-us/articles/25103039519635-Setting-up-the-Virtualitics-Python-API-pyVIP-with-Virtualitics-Explore
- id: vip-encryption-key
  type: shared-secret
  surface: Virtualitics Explore Python API (pyVIP)
  in: client-configuration
  parameter: VIP_ENCRYPTION_KEY
  role: payload encryption, not identity
  required: false
  recommended: true
  description: >-
    "We strongly recommend using an encryption key. This key is used to encrypt all data passed
    through the API." Set as a user environment variable alongside VIP_AUTH_TOKEN, or supplied at
    VIP class instantiation. This is a confidentiality control layered on the WebSocket, distinct
    from the auth token.
  source: https://docs.virtualitics.com/hc/en-us/articles/25103039519635-Setting-up-the-Virtualitics-Python-API-pyVIP-with-Virtualitics-Explore
- id: vaip-cli-credentials
  type: apiKey
  surface: Virtualitics CLI (`vaip`)
  in: local-config-file
  parameters:
  - api key
  - username
  - host
  established_by: '`vaip config`'
  description: >-
    "we will create a configuration file that will hold your API key, username, and host to deploy
    to." The host is the customer's own VAIP tenant, e.g. https://abcd.virtualitics.com. The
    equivalent one-shot form documented in the SDK FAQ is
    `virtualitics-cli upload dist/<app>.whl --host https://your-platform.com --username <user>`.
  scopes: []
  source: https://docs.virtualitics.com/hc/en-us/articles/34015231987347-Installing-the-Virtualitics-SDK-and-CLI-Packages
- id: platform-sso
  type: openIdConnect-or-saml
  surface: Virtualitics AI Platform (human sign-in)
  description: >-
    Platform administrators configure Single Sign-On and password security policy for their tenant.
    The article documents the administrative capability; it does not publish the protocol, the
    metadata URL, or any discovery document, and no /.well-known/openid-configuration is served on
    any Virtualitics host (see well-known/virtualitics-well-known.yml).
  discovery_document: null
  source: https://docs.virtualitics.com/hc/en-us/articles/21926415922323-Setting-Password-Security-and-Configuring-Single-Sign-On-SSO
oauth2: false
oidc_discovery: false
scopes_published: false
mtls: false
authorization_model:
  kind: role and group based, administered in-platform
  concepts:
  - users
  - groups
  - access levels
  - user roles
  - sharing permissions
  source: https://docs.virtualitics.com/hc/en-us/articles/34964622116499-Exploring-Access-Levels-User-Roles-and-Sharing-Permissions
  note: >-
    Documented as platform administration ("Managing Users", "Managing Groups", "Exploring Access
    Levels, User Roles, and Sharing Permissions"), not as an API authorization scope vocabulary.
gaps:
- No token expiry, lifetime or rotation policy is published for VIP_AUTH_TOKEN.
- No scope or least-privilege model exists for either the pyVIP token or the CLI API key.
- No machine-readable discovery document (OIDC or OAuth) is served on any host.