API tokens
Allow-list of tokens accepted after the scheme word: `Authorization: ELSA <token>` (any scheme word works — the real service ignores it). Unscripted (`/api/v1/*`, FastAPI) also reads the `session_token` header; scripted (`/api/v2|v3/score_audio`, Rails) also reads `?Authorization=`. A wrong token gets the documented 401/403 for that route family.
Latency
Injected latency (ms) before every data-plane call.
Forced failure
Make every data-plane call answer a documented error until cleared: pick a catalogue error (e.g. ClientHasNoMoreMinutes, InvalidAudioFormat) and/or an HTTP status; optional call count.
Scoring rules
Runtime rules are tried before config rules; first match wins. `match.text` is tested against the reference sentence (scripted) or the generated transcript (unscripted). No match → deterministic default from sha256(audio) + sentence.
Recent evaluations
Last 50 scored uploads (audio is hashed, never stored in the request log).