# Blue

> Governance and dynamic extension distribution for coding-agent CLIs, with an optional bring-your-own inference gateway and session capture.

- [Blue](https://docs.bluee.sh/next/introduction.md): Understand how Blue governs coding-agent configuration and dynamically distributes extensions.
- [Quickstart](https://docs.bluee.sh/next/quickstart.md): Deploy Blue on your infrastructure, sign in as an administrator, and launch your first governed coding agent.
- [Deployment contract](https://docs.bluee.sh/next/deployment/runtime-contract.md): Run Blue on Kubernetes, a container scheduler, or virtual machines by implementing its platform-neutral workload contract.
- [Kubernetes with Helm](https://docs.bluee.sh/next/deployment/production.md): Implement Blue's deployment contract on Kubernetes with the maintained Helm chart and optional AWS OpenTofu starter.
- [Configure blue.yaml](https://docs.bluee.sh/next/deployment/blue-yaml.md): Author the unified deployment configuration for runtime services, governance policy, gateway routing, and managed package catalogs.
- [Managed repository connections](https://docs.bluee.sh/next/deployment/managed-repositories.md): Configure private GitHub and Bitbucket repositories as organization-managed extension sources.
- [Architecture](https://docs.bluee.sh/next/concepts/architecture.md): See how the CLI, dashboard, Control API, inference proxy, database, and blob storage interact.
- [Configuration lifecycle](https://docs.bluee.sh/next/concepts/configuration.md): Understand policy revisions, caching, personalization, additive merges, and launch-scoped overlays.
- [Harness version compatibility](https://docs.bluee.sh/next/concepts/harness-version-compatibility.md): Pin native harness versions and understand how Blue selects maintained config and extension translators.
- [Bring your own gateway](https://docs.bluee.sh/next/concepts/gateway-mode.md): Connect your organization-operated gateway to Blue and understand routing, credentials, and setup.
- [Authentication and authorization](https://docs.bluee.sh/next/concepts/authentication.md): Learn how dashboard sessions, CLI device authorization, API scopes, and gateway identities are separated.
- [CLI commands](https://docs.bluee.sh/next/cli/commands.md): Reference the public harness commands and their expected behavior.
- [Supported harnesses](https://docs.bluee.sh/next/cli/harnesses.md): See how Codex, Claude Code, Kimi Code, and OpenCode receive governed launch overlays.
- [Troubleshooting](https://docs.bluee.sh/next/cli/troubleshooting.md): Diagnose authentication, reconciliation, gateway streaming, and session upload failures.
- [Dashboard administration](https://docs.bluee.sh/next/admin/dashboard.md): Manage users, policy revisions, clients, and captured sessions in the dashboard.
- [Manage users and invitations](https://docs.bluee.sh/next/admin/user-management.md): Invite accounts, assign roles, suspend access, revoke sessions, and remove login access without deleting governance history.
- [Set up Okta SSO and SCIM](https://docs.bluee.sh/next/admin/identity-provisioning.md): Configure OIDC single sign-on and SCIM 2.0 user and group provisioning with Okta, then validate the complete identity lifecycle.
- [Managed packages](https://docs.bluee.sh/next/admin/managed-packages.md): Distribute and remove governed skills, hooks, subagents, plugins, and helper binaries from the dashboard.
- [Manage organization policy](https://docs.bluee.sh/next/admin/configuration.md): Edit, validate, version, and deliver governance policy from the dashboard.
- [Gateway access](https://docs.bluee.sh/next/admin/gateway-access.md): Operate gateway identities, managed credentials, inference routing, and request history.
- [Custom gateway provisioners](https://docs.bluee.sh/next/admin/custom-gateway-provisioners.md): Deploy a digest-pinned executable gateway provisioner.
- [Session capture](https://docs.bluee.sh/next/admin/session-capture.md): Configure, operate, retain, share, and restore portable coding-agent sessions.
- [Local development with Docker Compose](https://docs.bluee.sh/next/development/local-compose.md): Run Blue's reference services locally for development and end-to-end evaluation.
- [Contributing](https://docs.bluee.sh/next/development/contributing.md): Build, test, and extend Blue and its public documentation.
- [Harness adapter architecture](https://docs.bluee.sh/next/development/harness-adapter-architecture.md): Extend Blue across new agent harnesses and breaking harness-version boundaries.
- [Gateway adapter architecture](https://docs.bluee.sh/next/development/gateway-adapter-architecture.md): Add a compiled inference gateway integration across Blue's client, proxy, and credential lifecycle.
- [Governance configuration](https://docs.bluee.sh/next/reference/governance-config.md): Reference the organization policy fields delivered to Blue clients.
- [Authentication endpoints](https://docs.bluee.sh/next/reference/auth-endpoints.md): Reference the dashboard-origin endpoints used by browser sessions and OAuth device authorization.
- [Discover Control API and OAuth device-flow settings](https://docs.bluee.sh/next/api-reference/system/discover-control-api-and-oauth-device-flow-settings.md): Public, versioned bootstrap metadata containing no credentials or organization policy.
- [Liveness probe](https://docs.bluee.sh/next/api-reference/system/liveness-probe.md)
- [Readiness probe](https://docs.bluee.sh/next/api-reference/system/readiness-probe.md)
- [Check database schema compatibility](https://docs.bluee.sh/next/api-reference/system/check-database-schema-compatibility.md)
- [Check singleton background-worker freshness](https://docs.bluee.sh/next/api-reference/system/check-singleton-background-worker-freshness.md)
- [Check session and package object stores](https://docs.bluee.sh/next/api-reference/system/check-session-and-package-object-stores.md)
- [Check the gateway credential resolver store](https://docs.bluee.sh/next/api-reference/system/check-the-gateway-credential-resolver-store.md)
- [Prometheus metrics](https://docs.bluee.sh/next/api-reference/system/prometheus-metrics.md)
- [Check Control API dependencies](https://docs.bluee.sh/next/api-reference/system/check-control-api-dependencies.md): Checks PostgreSQL, blob buckets, and the inference proxy when configured. Available to administrators and members for CLI health diagnostics.
- [Fetch deployment-wide dashboard branding](https://docs.bluee.sh/next/api-reference/system/fetch-deployment-wide-dashboard-branding.md)
- [Resolve the current OAuth token or dashboard session](https://docs.bluee.sh/next/api-reference/system/resolve-the-current-oauth-token-or-dashboard-session.md)
- [Get inference JWT verification keys](https://docs.bluee.sh/next/api-reference/gateway/get-inference-jwt-verification-keys.md)
- [Revoke the gateway session bound to the current OAuth session](https://docs.bluee.sh/next/api-reference/gateway/revoke-the-gateway-session-bound-to-the-current-oauth-session.md)
- [Describe gateway policy and runtime readiness without contacting the gateway](https://docs.bluee.sh/next/api-reference/gateway/describe-gateway-policy-and-runtime-readiness-without-contacting-the-gateway.md)
- [Ping the configured inference proxy](https://docs.bluee.sh/next/api-reference/gateway/ping-the-configured-inference-proxy.md): Administrator-only server-side health request that does not expose gateway credentials.
- [Get the authenticated user's managed gateway-key status](https://docs.bluee.sh/next/api-reference/gateway/get-the-authenticated-users-managed-gateway-key-status.md): Credential and inference JWT values are never returned.
- [Provision or reconcile the authenticated user's managed gateway key](https://docs.bluee.sh/next/api-reference/gateway/provision-or-reconcile-the-authenticated-users-managed-gateway-key.md): Invokes the configured built-in or executable provisioner when the credential is missing, stale, failed previously, or its configuration or policy revision changed. Manual retries bypass provisioning backoff.
- [Validate the authenticated user's stored upstream gateway key](https://docs.bluee.sh/next/api-reference/gateway/validate-the-authenticated-users-stored-upstream-gateway-key.md): Contacts the provisioner at most once per minute. A confirmed invalid credential is cleared and reported as invalid; replacement requires a subsequent ensure call. A missing credential is reported without contacting the provisioner.
- [List organization inference-proxy request metadata](https://docs.bluee.sh/next/api-reference/gateway/list-organization-inference-proxy-request-metadata.md): Administrator-only retained request metadata. Bodies, query strings, credentials, and arbitrary headers are never returned or retained.
- [List organization request-log filter values](https://docs.bluee.sh/next/api-reference/gateway/list-organization-request-log-filter-values.md): Administrator-only filter values for the organization request-log list.
- [Fetch the governance config for the authenticated user/org](https://docs.bluee.sh/next/api-reference/configuration/fetch-the-governance-config-for-the-authenticated-userorg.md): Returns which harnesses are allowed, per-harness managed config, MCP/skills, and — in gateway mode — a session-bound inference JWT embedded in the global `gateway` block. Response is scoped to the caller's org/groups (server-side).
- [Return the trusted compiled harness registry](https://docs.bluee.sh/next/api-reference/configuration/return-the-trusted-compiled-harness-registry.md)
- [Watch organization governance revision changes](https://docs.bluee.sh/next/api-reference/configuration/watch-organization-governance-revision-changes.md): Optional SSE invalidation stream. It emits the current revision immediately, then emits newly committed revisions for the authenticated organization. Clients must continue to fetch configuration from `/governance-config`.
- [Report a local client's applied revision and managed-file health](https://docs.bluee.sh/next/api-reference/configuration/report-a-local-clients-applied-revision-and-managed-file-health.md)
- [Create a short-lived session artifact upload request](https://docs.bluee.sh/next/api-reference/sessions/create-a-short-lived-session-artifact-upload-request.md): Reference path for the global session_upload.presign_url. Implementations may host this endpoint elsewhere. A typical AWS implementation returns an S3 presigned PUT and any headers that were included in its signature.
- [List captured sessions visible to the caller](https://docs.bluee.sh/next/api-reference/sessions/list-captured-sessions-visible-to-the-caller.md): Organization administrators see their organization for audit; members see owned and shared sessions. Resumable mode always applies own/shared picker visibility. Callers may use cursor parameters or numbered page parameters, but must not combine the two modes.
- [List users and harnesses available as captured-session filters](https://docs.bluee.sh/next/api-reference/sessions/list-users-and-harnesses-available-as-captured-session-filters.md): Facets use the same organization and ownership visibility rules as the session list.
- [Search active organization members for session sharing](https://docs.bluee.sh/next/api-reference/sessions/search-active-organization-members-for-session-sharing.md)
- [Get captured-session metadata and artifact history](https://docs.bluee.sh/next/api-reference/sessions/get-captured-session-metadata-and-artifact-history.md)
- [Verify the uploaded object and commit its metadata](https://docs.bluee.sh/next/api-reference/sessions/verify-the-uploaded-object-and-commit-its-metadata.md): The control API HEADs blob storage and checks size and SHA-256 metadata before making the artifact current.
- [Create a short-lived download request for the current artifact](https://docs.bluee.sh/next/api-reference/sessions/create-a-short-lived-download-request-for-the-current-artifact.md)
- [Get the current sharing mode and active recipients](https://docs.bluee.sh/next/api-reference/sessions/get-the-current-sharing-mode-and-active-recipients.md)
- [Replace owner-managed session sharing grants](https://docs.bluee.sh/next/api-reference/sessions/replace-owner-managed-session-sharing-grants.md): Idempotently sets private, workspace-wide, or selected-active-member access. Only the owner may call this endpoint.
- [Read the organization's current editable YAML configuration](https://docs.bluee.sh/next/api-reference/administration/read-the-organizations-current-editable-yaml-configuration.md)
- [Validate and save a new governance configuration revision](https://docs.bluee.sh/next/api-reference/administration/validate-and-save-a-new-governance-configuration-revision.md)
- [List recent governance configuration revisions](https://docs.bluee.sh/next/api-reference/administration/list-recent-governance-configuration-revisions.md)
- [Export the mounted deployment configuration with current governance](https://docs.bluee.sh/next/api-reference/administration/export-the-mounted-deployment-configuration-with-current-governance.md)
- [Replace deployment-wide dashboard branding](https://docs.bluee.sh/next/api-reference/administration/replace-deployment-wide-dashboard-branding.md)
- [List curated extension packages available to the organization](https://docs.bluee.sh/next/api-reference/administration/list-curated-extension-packages-available-to-the-organization.md)
- [Resolve, hash, and optionally mirror a managed repository source](https://docs.bluee.sh/next/api-reference/administration/resolve-hash-and-optionally-mirror-a-managed-repository-source.md)
- [List repository connections allowed for the administrator's organization](https://docs.bluee.sh/next/api-reference/administration/list-repository-connections-allowed-for-the-administrators-organization.md)
- [Save packages, per-harness overrides, and MCP servers as a new revision](https://docs.bluee.sh/next/api-reference/administration/save-packages-per-harness-overrides-and-mcp-servers-as-a-new-revision.md)
- [Read one coding agent's managed configuration as YAML](https://docs.bluee.sh/next/api-reference/administration/read-one-coding-agents-managed-configuration-as-yaml.md)
- [Save one coding agent's managed configuration as a new revision](https://docs.bluee.sh/next/api-reference/administration/save-one-coding-agents-managed-configuration-as-a-new-revision.md)
- [Read every supported coding agent's managed configuration as YAML](https://docs.bluee.sh/next/api-reference/administration/read-every-supported-coding-agents-managed-configuration-as-yaml.md)
- [List and filter local client status reports for the organization](https://docs.bluee.sh/next/api-reference/administration/list-and-filter-local-client-status-reports-for-the-organization.md)
- [List users and harnesses available as client-status filters](https://docs.bluee.sh/next/api-reference/administration/list-users-and-harnesses-available-as-client-status-filters.md)
- [Remove an organization client inventory record](https://docs.bluee.sh/next/api-reference/administration/remove-an-organization-client-inventory-record.md)
- [Create a short-lived download request for an organization-scoped package artifact](https://docs.bluee.sh/next/api-reference/governance/create-a-short-lived-download-request-for-an-organization-scoped-package-artifact.md)
- [Get the deployment-managed identity and provisioning status](https://docs.bluee.sh/next/api-reference/user-management/get-the-deployment-managed-identity-and-provisioning-status.md): Returns non-secret OIDC mode and SCIM configuration metadata. Credential values are never returned.
- [List users in the administrator's organization](https://docs.bluee.sh/next/api-reference/user-management/list-users-in-the-administrators-organization.md): Includes active, suspended, and access-removed users so historical ownership remains visible.
- [List non-removed organization users for selection controls](https://docs.bluee.sh/next/api-reference/user-management/list-non-removed-organization-users-for-selection-controls.md)
- [Search active and already-selected organization users](https://docs.bluee.sh/next/api-reference/user-management/search-active-and-already-selected-organization-users.md)
- [Get an organization user](https://docs.bluee.sh/next/api-reference/user-management/get-an-organization-user.md)
- [Delete a user's account access while retaining governance history](https://docs.bluee.sh/next/api-reference/user-management/delete-a-users-account-access-while-retaining-governance-history.md): Deletes the Better Auth identity, memberships, credentials, and gateway selection. The identifiable governance user and historical revisions, clients, and captured sessions remain.
- [Change a user's role or active/suspended state](https://docs.bluee.sh/next/api-reference/user-management/change-a-users-role-or-activesuspended-state.md): Role and status changes revoke existing browser and CLI credentials. Removed users must be invited again.
- [Revoke all browser, OAuth, and device sessions for a user](https://docs.bluee.sh/next/api-reference/user-management/revoke-all-browser-oauth-and-device-sessions-for-a-user.md)
- [List organization invitations](https://docs.bluee.sh/next/api-reference/user-management/list-organization-invitations.md)
- [Invite an email address to create an organization account](https://docs.bluee.sh/next/api-reference/user-management/invite-an-email-address-to-create-an-organization-account.md): The recipient email and role are fixed. The recipient supplies only a password during acceptance.
- [Get an organization invitation](https://docs.bluee.sh/next/api-reference/user-management/get-an-organization-invitation.md)
- [Cancel a pending invitation](https://docs.bluee.sh/next/api-reference/user-management/cancel-a-pending-invitation.md)
- [Resend and renew a pending or expired invitation for 24 hours](https://docs.bluee.sh/next/api-reference/user-management/resend-and-renew-a-pending-or-expired-invitation-for-24-hours.md)
- [List or equality-filter provisioned users](https://docs.bluee.sh/next/api-reference/identity-provisioning/list-or-equality-filter-provisioned-users.md)
- [Provision a passwordless user](https://docs.bluee.sh/next/api-reference/identity-provisioning/provision-a-passwordless-user.md)
- [Get scimv2users](https://docs.bluee.sh/next/api-reference/identity-provisioning/get-scimv2users.md)
- [Put scimv2users](https://docs.bluee.sh/next/api-reference/identity-provisioning/put-scimv2users.md)
- [Delete scimv2users](https://docs.bluee.sh/next/api-reference/identity-provisioning/delete-scimv2users.md)
- [Patch scimv2users](https://docs.bluee.sh/next/api-reference/identity-provisioning/patch-scimv2users.md)
- [Get scimv2groups](https://docs.bluee.sh/next/api-reference/identity-provisioning/get-scimv2groups.md)
- [Post scimv2groups](https://docs.bluee.sh/next/api-reference/identity-provisioning/post-scimv2groups.md)
- [Get scimv2groups 1](https://docs.bluee.sh/next/api-reference/identity-provisioning/get-scimv2groups-1.md)
- [Put scimv2groups](https://docs.bluee.sh/next/api-reference/identity-provisioning/put-scimv2groups.md)
- [Delete scimv2groups](https://docs.bluee.sh/next/api-reference/identity-provisioning/delete-scimv2groups.md)
- [Patch scimv2groups](https://docs.bluee.sh/next/api-reference/identity-provisioning/patch-scimv2groups.md)
- [Get scimv2serviceproviderconfig](https://docs.bluee.sh/next/api-reference/identity-provisioning/get-scimv2serviceproviderconfig.md)
- [Get scimv2resourcetypes](https://docs.bluee.sh/next/api-reference/identity-provisioning/get-scimv2resourcetypes.md)
- [Get scimv2schemas](https://docs.bluee.sh/next/api-reference/identity-provisioning/get-scimv2schemas.md)

## OpenAPI Specs

- [next](/openapi/next.yaml)