Skip to main content
GET
Fetch the governance config for the authenticated user/org

Authorizations

Authorization
string
header
required

OAuth 2.0 access token obtained through RFC 8628 at /api/auth/device/code and /api/auth/oauth2/token. The API enforces governance:read, session:write, and client-status:write as appropriate.

Response

The governance config

revision
string
required

Reconcile key; daemon acts on change

Example:

"251e6087-98cf-4861-9668-f09f537d5e4d"

allowed_harnesses
string[]
required

Harness key from the compiled registry

contract_version
integer
default:1

Governance wire contract version

required_capabilities
enum<string>[]
Available options:
adapter_intervals,
compiled_harness_registry,
transactional_reconcile,
unverified_harness_versions,
versioned_state
minimum_client_version
string

Operator-visible rollout floor; required capabilities enforce compatibility

ttl_seconds
integer

Client cache TTL (default 300)

Example:

300

required
boolean

If true, client fails closed without fresh config

harnesses
object
packages
object[]
gateway
object

Present ⇒ gateway mode for every allowed harness; omit ⇒ governance-only. proxy_url and token are runtime fields injected by the control API when it delivers the policy to an authenticated client.

session_upload
object

Global opt-in portable-session capture. When present, every compatible supported harness registers its native hook. The authenticated endpoint returns a short-lived provider-specific blob upload request.

telemetry
object