curl --request GET \
--url https://harness.example.com/governance-config \
--header 'Authorization: Bearer <token>'const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://harness.example.com/governance-config', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://harness.example.com/governance-config"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text){
"revision": "251e6087-98cf-4861-9668-f09f537d5e4d",
"allowed_harnesses": [
"<string>"
],
"contract_version": 1,
"required_capabilities": [
"adapter_intervals"
],
"minimum_client_version": "<string>",
"ttl_seconds": 300,
"required": true,
"harnesses": {},
"packages": [
{
"id": "<string>",
"version": "<string>",
"source_ref": "<string>",
"sha256": "<string>",
"name": "<string>",
"artifact_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"platform_sources": {},
"settings": {},
"adapters": {}
}
],
"gateway": {
"type": "<string>",
"proxy_url": "<string>",
"token": "<string>",
"auth_style": "bearer"
},
"session_upload": {
"presign_url": "<string>"
},
"telemetry": {
"sink_url": "<string>"
}
}Fetch the governance config for the authenticated user/org
Returns which harnesses are allowed, per-harness managed config, MCP/skills, and — in gateway mode — a session-bound inference JWT embedded in the global gateway block. Response is scoped to the caller’s org/groups (server-side).
curl --request GET \
--url https://harness.example.com/governance-config \
--header 'Authorization: Bearer <token>'const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://harness.example.com/governance-config', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://harness.example.com/governance-config"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text){
"revision": "251e6087-98cf-4861-9668-f09f537d5e4d",
"allowed_harnesses": [
"<string>"
],
"contract_version": 1,
"required_capabilities": [
"adapter_intervals"
],
"minimum_client_version": "<string>",
"ttl_seconds": 300,
"required": true,
"harnesses": {},
"packages": [
{
"id": "<string>",
"version": "<string>",
"source_ref": "<string>",
"sha256": "<string>",
"name": "<string>",
"artifact_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"platform_sources": {},
"settings": {},
"adapters": {}
}
],
"gateway": {
"type": "<string>",
"proxy_url": "<string>",
"token": "<string>",
"auth_style": "bearer"
},
"session_upload": {
"presign_url": "<string>"
},
"telemetry": {
"sink_url": "<string>"
}
}Authorizations
OAuth 2.0 access token obtained through RFC 8628 at /api/auth/device/code and /api/auth/oauth2/token. The API enforces governance:read, session:write, and client-status:write as appropriate.
Response
The governance config
Reconcile key; daemon acts on change
"251e6087-98cf-4861-9668-f09f537d5e4d"
Harness key from the compiled registry
Governance wire contract version
adapter_intervals, compiled_harness_registry, transactional_reconcile, unverified_harness_versions, versioned_state Operator-visible rollout floor; required capabilities enforce compatibility
Client cache TTL (default 300)
300
If true, client fails closed without fresh config
Show child attributes
Show child attributes
Show child attributes
Show child attributes
Present ⇒ gateway mode for every allowed harness; omit ⇒ governance-only. proxy_url and token are runtime fields injected by the control API when it delivers the policy to an authenticated client.
Show child attributes
Show child attributes
Global opt-in portable-session capture. When present, every compatible supported harness registers its native hook. The authenticated endpoint returns a short-lived provider-specific blob upload request.
Show child attributes
Show child attributes
Show child attributes
Show child attributes
