curl --request GET \
--url https://harness.example.com/governance-config \
--header 'Authorization: Bearer <token>'const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://harness.example.com/governance-config', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://harness.example.com/governance-config"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text){
"revision": "251e6087-98cf-4861-9668-f09f537d5e4d",
"allowed_harnesses": [
"<string>"
],
"contract_version": 1,
"required_capabilities": [
"adapter_intervals"
],
"minimum_client_version": "<string>",
"required_client_version": "0.1.0",
"ttl_seconds": 300,
"required": true,
"harnesses": {},
"packages": [
{
"id": "<string>",
"version": "<string>",
"source_ref": "<string>",
"sha256": "<string>",
"name": "<string>",
"artifact_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"platform_sources": {},
"settings": {},
"adapters": {}
}
],
"gateway": {
"type": "<string>",
"proxy_url": "<string>",
"token": "<string>",
"auth_style": "bearer"
},
"session_upload": {
"presign_url": "<string>"
},
"telemetry": {
"sink_url": "<string>"
}
}Fetch the governance config for the authenticated user/org
Returns which harnesses are allowed, per-harness managed config, MCP/skills, and — in gateway mode — a session-bound inference JWT embedded in the global gateway block. Response is scoped to the caller’s org/groups (server-side).
curl --request GET \
--url https://harness.example.com/governance-config \
--header 'Authorization: Bearer <token>'const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://harness.example.com/governance-config', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://harness.example.com/governance-config"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text){
"revision": "251e6087-98cf-4861-9668-f09f537d5e4d",
"allowed_harnesses": [
"<string>"
],
"contract_version": 1,
"required_capabilities": [
"adapter_intervals"
],
"minimum_client_version": "<string>",
"required_client_version": "0.1.0",
"ttl_seconds": 300,
"required": true,
"harnesses": {},
"packages": [
{
"id": "<string>",
"version": "<string>",
"source_ref": "<string>",
"sha256": "<string>",
"name": "<string>",
"artifact_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"platform_sources": {},
"settings": {},
"adapters": {}
}
],
"gateway": {
"type": "<string>",
"proxy_url": "<string>",
"token": "<string>",
"auth_style": "bearer"
},
"session_upload": {
"presign_url": "<string>"
},
"telemetry": {
"sink_url": "<string>"
}
}Authorizations
OAuth 2.0 access token obtained through RFC 8628 at /api/auth/device/code and /api/auth/oauth2/token. The API enforces governance:read, session:write, and client-status:write as appropriate.
Response
The governance config
Reconcile key; daemon acts on change
"251e6087-98cf-4861-9668-f09f537d5e4d"
Harness key from the compiled registry
Governance wire contract version
adapter_intervals, compiled_harness_registry, tenant_client_version_pin, transactional_reconcile, unverified_harness_versions, versioned_state Operator-visible rollout floor; required capabilities enforce compatibility
Canonical exact SemVer of the recommended Blue CLI release. Defaults to the control API deployment version. Requires tenant_client_version_pin capability.
"0.1.0"
Client cache TTL (default 300)
300
If true, client fails closed without fresh config
Show child attributes
Show child attributes
Show child attributes
Show child attributes
Present ⇒ gateway mode for every allowed harness; omit ⇒ governance-only. proxy_url and token are runtime fields injected by the control API when it delivers the policy to an authenticated client.
Show child attributes
Show child attributes
Global opt-in portable-session capture. When present, every compatible supported harness registers its native hook. The authenticated endpoint returns a short-lived provider-specific blob upload request.
Show child attributes
Show child attributes
Show child attributes
Show child attributes
