POST /v1/harnesses
const url = 'https://app.everruns.com/api/v1/harnesses';const options = { method: 'POST', headers: {'Content-Type': 'application/json'}, body: '{"capabilities":[{"config":{},"ref":"current_time"},{"config":{},"ref":"web_fetch"}],"default_model_id":"model_01933b5a00007000800000000000001","description":"Research harness with planning and web capabilities","display_name":"Deep Research","initial_files":[{"content":"example","encoding":"example","is_readonly":true,"path":"example"}],"mcpServers":{"additionalProperty":{"auth_mode":"none","headers":{"additionalProperty":"example"},"oauth_provider_id":"example","tool_discovery":true,"type":"http","url":"example"}},"name":"deep-research","network_access":{"allowed":["*.example.com","https://api.acme.com/"],"blocked":["169.254.169.254"]},"parent_harness_id":"harness_01933b5a000070008000000000000602","system_prompt":"You are a research assistant with deep analytical capabilities.","tags":["research","planning"]}'};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request POST \ --url https://app.everruns.com/api/v1/harnesses \ --header 'Content-Type: application/json' \ --data '{ "capabilities": [ { "config": {}, "ref": "current_time" }, { "config": {}, "ref": "web_fetch" } ], "default_model_id": "model_01933b5a00007000800000000000001", "description": "Research harness with planning and web capabilities", "display_name": "Deep Research", "initial_files": [ { "content": "example", "encoding": "example", "is_readonly": true, "path": "example" } ], "mcpServers": { "additionalProperty": { "auth_mode": "none", "headers": { "additionalProperty": "example" }, "oauth_provider_id": "example", "tool_discovery": true, "type": "http", "url": "example" } }, "name": "deep-research", "network_access": { "allowed": [ "*.example.com", "https://api.acme.com/" ], "blocked": [ "169.254.169.254" ] }, "parent_harness_id": "harness_01933b5a000070008000000000000602", "system_prompt": "You are a research assistant with deep analytical capabilities.", "tags": [ "research", "planning" ] }'Request Body required
Section titled “Request Body required ”Request to create a new harness
object
Capabilities to enable with per-harness configuration.
Per-agent capability configuration
Associates a capability with an agent, including optional per-agent configuration. The config field allows the same capability to behave differently per-agent.
object
Per-agent configuration for this capability (capability-specific)
Reference to the capability ID
Example
[ { "config": {}, "ref": "current_time" }, { "config": {}, "ref": "web_fetch" }]Default LLM model ID for this harness. Lowest priority in model chain.
Example
model_01933b5a00007000800000000000001Description of what the harness does.
Example
Research harness with planning and web capabilitiesHuman-readable display name shown in UI.
Example
Deep ResearchStarter files copied into each new session for this harness.
Starter file copied into a new session from an agent or harness.
object
File content: plain text or base64-encoded binary.
Content encoding: text or base64.
Prevent session-side edits or deletes when true.
Absolute path within the session workspace. /workspace prefix is accepted.
Remote MCP servers scoped to this harness.
object
Session-, agent-, or harness-scoped remote MCP server configuration.
This intentionally mirrors the mcpServers object shape used by common MCP
client config files while staying within Everruns’ current remote-HTTP-only
support.
object
Authentication mode used when executing tools from this scoped server.
Example
api_keyAdditional HTTP headers sent on MCP requests.
object
Provider id used to resolve a user-scoped bearer token.
Whether to discover tool definitions live from this server.
MCP transport type. Only remote HTTP is supported today.
Example
httpURL of the remote MCP server endpoint.
Name, unique per org. Lowercase alphanumeric and hyphens.
Example
deep-researchNetwork access list controlling which hosts/URLs sessions can reach.
object
Allowed host patterns. If non-empty, only matching URLs are permitted. An empty list means “no restriction from this layer” (inherit parent).
Blocked host patterns. Always denied, even if matched by allowed.
Example
{ "allowed": [ "*.example.com", "https://api.acme.com/" ], "blocked": [ "169.254.169.254" ]}Optional parent harness to inherit from.
Example
harness_01933b5a000070008000000000000602The system prompt defining the harness’s base behavior.
Example
You are a research assistant with deep analytical capabilities.Tags for organizing harnesses.
Example
[ "research", "planning"]Responses
Section titled “ Responses ”Harness created
Wrapper that adds API and UI links to a serialized resource.
Uses self_url (not url) for the API link to avoid collision with
resources that already have a url field (e.g. McpServer).
object
Timestamp when the harness was archived.
Capabilities enabled for this harness with per-harness configuration.
Per-agent capability configuration
Associates a capability with an agent, including optional per-agent configuration. The config field allows the same capability to behave differently per-agent.
object
Per-agent configuration for this capability (capability-specific)
Reference to the capability ID
Timestamp when the harness was created.
Default LLM model ID for this harness. Lowest priority in chain: controls > session > agent > harness.
Timestamp when the harness was deleted.
Human-readable description of what the harness does.
Human-readable display name shown in UI.
Unique identifier for the harness (format: harness_{32-hex}).
Starter files copied into each new session for this harness.
Starter file copied into a new session from an agent or harness.
object
File content: plain text or base64-encoded binary.
Content encoding: text or base64.
Prevent session-side edits or deletes when true.
Absolute path within the session workspace. /workspace prefix is accepted.
Whether this harness is built-in (system-managed, readonly). Built-in harnesses are provisioned during org initialization and cannot be modified or deleted via the API. Users can copy them.
Remote MCP servers scoped to this harness and inherited by descendant layers.
object
Session-, agent-, or harness-scoped remote MCP server configuration.
This intentionally mirrors the mcpServers object shape used by common MCP
client config files while staying within Everruns’ current remote-HTTP-only
support.
object
Authentication mode used when executing tools from this scoped server.
Additional HTTP headers sent on MCP requests.
object
Provider id used to resolve a user-scoped bearer token.
Whether to discover tool definitions live from this server.
MCP transport type. Only remote HTTP is supported today.
URL of the remote MCP server endpoint.
Name, unique per org (e.g. “generic”).
Network access list controlling which hosts/URLs sessions can reach. Merged with agent and session layers (allowed: intersect, blocked: union).
object
Allowed host patterns. If non-empty, only matching URLs are permitted. An empty list means “no restriction from this layer” (inherit parent).
Blocked host patterns. Always denied, even if matched by allowed.
Optional parent harness that this harness inherits from.
Current lifecycle status of the harness.
System prompt that defines the harness’s base behavior. Forms the foundation of the prompt stack.
Tags for organizing and filtering harnesses.
Timestamp when the harness was last updated.
Full API endpoint URL for this resource.
Alias for view_url, used by command and MCP outputs.
Full UI URL for viewing this resource.
Example
{ "default_model_id": "model_01933b5a00007000800000000000001", "id": "harness_01933b5a00007000800000000000001", "mcpServers": { "additionalProperty": { "auth_mode": "none", "type": "http" } }, "network_access": { "allowed": [ "*.example.com", "https://api.acme.com/" ], "blocked": [ "169.254.169.254" ] }, "parent_harness_id": "harness_01933b5a000070008000000000000602", "status": "active"}Invalid input
Standard error response.
Wire shape is RFC 9457 Problem Details:
every error response includes title and status, and may include
detail, code, allowed_actions, retry_after_seconds, instance,
and type. The content type is rewritten to application/problem+json
by [problem_json_content_type].
object
Recovery actions the caller can take next.
Agent-actionable recovery hint attached to an error response.
object
Short, agent-readable hint (e.g. “Shorten ‘name’ to <= 200 chars.”).
Optional absolute or relative URL the caller may invoke directly.
OpenAPI operationId the caller should invoke to recover.
Link relation describing the action (e.g. retry, get-existing,
unarchive, retry-later).
Stable, machine-readable error code (snake_case).
Human-readable explanation specific to this occurrence.
Request URI for this occurrence.
Seconds the caller should wait before retrying (429 / transient 503).
HTTP status code; mirrors the response status line.
Short, human-readable summary of the problem (e.g. “Not Found”).
RFC 9457 problem type URI. Optional; identifies the problem class.
Example generated
{ "allowed_actions": [ { "hint": "example", "href": "example", "operation_id": "example", "rel": "example" } ], "code": "example", "detail": "example", "instance": "example", "retry_after_seconds": 1, "status": 1, "title": "example", "type": "example"}Forbidden
Standard error response.
Wire shape is RFC 9457 Problem Details:
every error response includes title and status, and may include
detail, code, allowed_actions, retry_after_seconds, instance,
and type. The content type is rewritten to application/problem+json
by [problem_json_content_type].
object
Recovery actions the caller can take next.
Agent-actionable recovery hint attached to an error response.
object
Short, agent-readable hint (e.g. “Shorten ‘name’ to <= 200 chars.”).
Optional absolute or relative URL the caller may invoke directly.
OpenAPI operationId the caller should invoke to recover.
Link relation describing the action (e.g. retry, get-existing,
unarchive, retry-later).
Stable, machine-readable error code (snake_case).
Human-readable explanation specific to this occurrence.
Request URI for this occurrence.
Seconds the caller should wait before retrying (429 / transient 503).
HTTP status code; mirrors the response status line.
Short, human-readable summary of the problem (e.g. “Not Found”).
RFC 9457 problem type URI. Optional; identifies the problem class.
Example generated
{ "allowed_actions": [ { "hint": "example", "href": "example", "operation_id": "example", "rel": "example" } ], "code": "example", "detail": "example", "instance": "example", "retry_after_seconds": 1, "status": 1, "title": "example", "type": "example"}Internal server error
Standard error response.
Wire shape is RFC 9457 Problem Details:
every error response includes title and status, and may include
detail, code, allowed_actions, retry_after_seconds, instance,
and type. The content type is rewritten to application/problem+json
by [problem_json_content_type].
object
Recovery actions the caller can take next.
Agent-actionable recovery hint attached to an error response.
object
Short, agent-readable hint (e.g. “Shorten ‘name’ to <= 200 chars.”).
Optional absolute or relative URL the caller may invoke directly.
OpenAPI operationId the caller should invoke to recover.
Link relation describing the action (e.g. retry, get-existing,
unarchive, retry-later).
Stable, machine-readable error code (snake_case).
Human-readable explanation specific to this occurrence.
Request URI for this occurrence.
Seconds the caller should wait before retrying (429 / transient 503).
HTTP status code; mirrors the response status line.
Short, human-readable summary of the problem (e.g. “Not Found”).
RFC 9457 problem type URI. Optional; identifies the problem class.
Example generated
{ "allowed_actions": [ { "hint": "example", "href": "example", "operation_id": "example", "rel": "example" } ], "code": "example", "detail": "example", "instance": "example", "retry_after_seconds": 1, "status": 1, "title": "example", "type": "example"}