PATCH /v1/harnesses/{harness_id}
const url = 'https://app.everruns.com/api/v1/harnesses/example';const options = { method: 'PATCH', headers: {'Content-Type': 'application/json'}, body: '{"capabilities":[{"config":{},"ref":"current_time"},{"config":{},"ref":"web_fetch"}],"default_model_id":"model_01933b5a00007000800000000000001","description":"Research harness with web tools","display_name":"Updated Research Harness","initial_files":[{"content":"Cite sources verbatim.\n","path":"INSTRUCTIONS.md"}],"mcpServers":{"additionalProperty":{"auth_mode":"none","headers":{"additionalProperty":"example"},"oauth_provider_id":"example","tool_discovery":true,"type":"http","url":"example"}},"name":"updated-research","network_access":{"allowed":["*.example.com","https://api.acme.com/"],"blocked":["169.254.169.254"]},"parent_harness_id":"example","status":"active","system_prompt":"You are a research assistant. Cite sources verbatim.","tags":["research","web-tools"]}'};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request PATCH \ --url https://app.everruns.com/api/v1/harnesses/example \ --header 'Content-Type: application/json' \ --data '{ "capabilities": [ { "config": {}, "ref": "current_time" }, { "config": {}, "ref": "web_fetch" } ], "default_model_id": "model_01933b5a00007000800000000000001", "description": "Research harness with web tools", "display_name": "Updated Research Harness", "initial_files": [ { "content": "Cite sources verbatim.\n", "path": "INSTRUCTIONS.md" } ], "mcpServers": { "additionalProperty": { "auth_mode": "none", "headers": { "additionalProperty": "example" }, "oauth_provider_id": "example", "tool_discovery": true, "type": "http", "url": "example" } }, "name": "updated-research", "network_access": { "allowed": [ "*.example.com", "https://api.acme.com/" ], "blocked": [ "169.254.169.254" ] }, "parent_harness_id": "example", "status": "active", "system_prompt": "You are a research assistant. Cite sources verbatim.", "tags": [ "research", "web-tools" ] }'Parameters
Section titled “ Parameters ”Path Parameters
Section titled “Path Parameters ”Harness ID (prefixed)
Request Body required
Section titled “Request Body required ”Request to update a harness. Only provided fields will be updated.
object
Replace the capability list entirely; omit to leave unchanged.
Per-agent capability configuration
Associates a capability with an agent, including optional per-agent configuration. The config field allows the same capability to behave differently per-agent.
object
Per-agent configuration for this capability (capability-specific)
Reference to the capability ID
Example
[ { "config": {}, "ref": "current_time" }, { "config": {}, "ref": "web_fetch" }]New default model selected when sessions inherit from this harness; omit to leave unchanged.
Example
model_01933b5a00007000800000000000001Human-readable description. Safe to render in user-facing messages.
Example
Research harness with web toolsHuman-readable display name.
Example
Updated Research HarnessReplace the initial-files list entirely; omit to leave unchanged.
Starter file copied into a new session from an agent or harness.
object
File content: plain text or base64-encoded binary.
Content encoding: text or base64.
Prevent session-side edits or deletes when true.
Absolute path within the session workspace. /workspace prefix is accepted.
Example
[ { "content": "Cite sources verbatim.\n", "path": "INSTRUCTIONS.md" }]Replace the scoped MCP server set entirely; omit to leave unchanged.
object
Session-, agent-, or harness-scoped remote MCP server configuration.
This intentionally mirrors the mcpServers object shape used by common MCP
client config files while staying within Everruns’ current remote-HTTP-only
support.
object
Authentication mode used when executing tools from this scoped server.
Example
api_keyAdditional HTTP headers sent on MCP requests.
object
Provider id used to resolve a user-scoped bearer token.
Whether to discover tool definitions live from this server.
MCP transport type. Only remote HTTP is supported today.
Example
httpURL of the remote MCP server endpoint.
Name, unique per org.
Example
updated-researchNetwork access list. Send {} (empty object) to clear. Omit to leave unchanged.
Example shape is defined on NetworkAccessList.
object
Allowed host patterns. If non-empty, only matching URLs are permitted. An empty list means “no restriction from this layer” (inherit parent).
Blocked host patterns. Always denied, even if matched by allowed.
Example
{ "allowed": [ "*.example.com", "https://api.acme.com/" ], "blocked": [ "169.254.169.254" ]}New parent harness for inheritance. Outer None leaves unchanged; inner None removes inheritance (becomes a root harness).
New system prompt the harness contributes to sessions; omit to leave unchanged.
Example
You are a research assistant. Cite sources verbatim.Replace the tag list entirely; omit to leave unchanged.
Example
[ "research", "web-tools"]Responses
Section titled “ Responses ”Harness updated
Wrapper that adds API and UI links to a serialized resource.
Uses self_url (not url) for the API link to avoid collision with
resources that already have a url field (e.g. McpServer).
object
Timestamp when the harness was archived.
Capabilities enabled for this harness with per-harness configuration.
Per-agent capability configuration
Associates a capability with an agent, including optional per-agent configuration. The config field allows the same capability to behave differently per-agent.
object
Per-agent configuration for this capability (capability-specific)
Reference to the capability ID
Timestamp when the harness was created.
Default LLM model ID for this harness. Lowest priority in chain: controls > session > agent > harness.
Timestamp when the harness was deleted.
Human-readable description of what the harness does.
Human-readable display name shown in UI.
Unique identifier for the harness (format: harness_{32-hex}).
Starter files copied into each new session for this harness.
Starter file copied into a new session from an agent or harness.
object
File content: plain text or base64-encoded binary.
Content encoding: text or base64.
Prevent session-side edits or deletes when true.
Absolute path within the session workspace. /workspace prefix is accepted.
Whether this harness is built-in (system-managed, readonly). Built-in harnesses are provisioned during org initialization and cannot be modified or deleted via the API. Users can copy them.
Remote MCP servers scoped to this harness and inherited by descendant layers.
object
Session-, agent-, or harness-scoped remote MCP server configuration.
This intentionally mirrors the mcpServers object shape used by common MCP
client config files while staying within Everruns’ current remote-HTTP-only
support.
object
Authentication mode used when executing tools from this scoped server.
Additional HTTP headers sent on MCP requests.
object
Provider id used to resolve a user-scoped bearer token.
Whether to discover tool definitions live from this server.
MCP transport type. Only remote HTTP is supported today.
URL of the remote MCP server endpoint.
Name, unique per org (e.g. “generic”).
Network access list controlling which hosts/URLs sessions can reach. Merged with agent and session layers (allowed: intersect, blocked: union).
object
Allowed host patterns. If non-empty, only matching URLs are permitted. An empty list means “no restriction from this layer” (inherit parent).
Blocked host patterns. Always denied, even if matched by allowed.
Optional parent harness that this harness inherits from.
Current lifecycle status of the harness.
System prompt that defines the harness’s base behavior. Forms the foundation of the prompt stack.
Tags for organizing and filtering harnesses.
Timestamp when the harness was last updated.
Full API endpoint URL for this resource.
Alias for view_url, used by command and MCP outputs.
Full UI URL for viewing this resource.
Example
{ "default_model_id": "model_01933b5a00007000800000000000001", "id": "harness_01933b5a00007000800000000000001", "mcpServers": { "additionalProperty": { "auth_mode": "none", "type": "http" } }, "network_access": { "allowed": [ "*.example.com", "https://api.acme.com/" ], "blocked": [ "169.254.169.254" ] }, "parent_harness_id": "harness_01933b5a000070008000000000000602", "status": "active"}Invalid input
Standard error response.
Wire shape is RFC 9457 Problem Details:
every error response includes title and status, and may include
detail, code, allowed_actions, retry_after_seconds, instance,
and type. The content type is rewritten to application/problem+json
by [problem_json_content_type].
object
Recovery actions the caller can take next.
Agent-actionable recovery hint attached to an error response.
object
Short, agent-readable hint (e.g. “Shorten ‘name’ to <= 200 chars.”).
Optional absolute or relative URL the caller may invoke directly.
OpenAPI operationId the caller should invoke to recover.
Link relation describing the action (e.g. retry, get-existing,
unarchive, retry-later).
Stable, machine-readable error code (snake_case).
Human-readable explanation specific to this occurrence.
Request URI for this occurrence.
Seconds the caller should wait before retrying (429 / transient 503).
HTTP status code; mirrors the response status line.
Short, human-readable summary of the problem (e.g. “Not Found”).
RFC 9457 problem type URI. Optional; identifies the problem class.
Example generated
{ "allowed_actions": [ { "hint": "example", "href": "example", "operation_id": "example", "rel": "example" } ], "code": "example", "detail": "example", "instance": "example", "retry_after_seconds": 1, "status": 1, "title": "example", "type": "example"}Forbidden
Standard error response.
Wire shape is RFC 9457 Problem Details:
every error response includes title and status, and may include
detail, code, allowed_actions, retry_after_seconds, instance,
and type. The content type is rewritten to application/problem+json
by [problem_json_content_type].
object
Recovery actions the caller can take next.
Agent-actionable recovery hint attached to an error response.
object
Short, agent-readable hint (e.g. “Shorten ‘name’ to <= 200 chars.”).
Optional absolute or relative URL the caller may invoke directly.
OpenAPI operationId the caller should invoke to recover.
Link relation describing the action (e.g. retry, get-existing,
unarchive, retry-later).
Stable, machine-readable error code (snake_case).
Human-readable explanation specific to this occurrence.
Request URI for this occurrence.
Seconds the caller should wait before retrying (429 / transient 503).
HTTP status code; mirrors the response status line.
Short, human-readable summary of the problem (e.g. “Not Found”).
RFC 9457 problem type URI. Optional; identifies the problem class.
Example generated
{ "allowed_actions": [ { "hint": "example", "href": "example", "operation_id": "example", "rel": "example" } ], "code": "example", "detail": "example", "instance": "example", "retry_after_seconds": 1, "status": 1, "title": "example", "type": "example"}Harness not found
Standard error response.
Wire shape is RFC 9457 Problem Details:
every error response includes title and status, and may include
detail, code, allowed_actions, retry_after_seconds, instance,
and type. The content type is rewritten to application/problem+json
by [problem_json_content_type].
object
Recovery actions the caller can take next.
Agent-actionable recovery hint attached to an error response.
object
Short, agent-readable hint (e.g. “Shorten ‘name’ to <= 200 chars.”).
Optional absolute or relative URL the caller may invoke directly.
OpenAPI operationId the caller should invoke to recover.
Link relation describing the action (e.g. retry, get-existing,
unarchive, retry-later).
Stable, machine-readable error code (snake_case).
Human-readable explanation specific to this occurrence.
Request URI for this occurrence.
Seconds the caller should wait before retrying (429 / transient 503).
HTTP status code; mirrors the response status line.
Short, human-readable summary of the problem (e.g. “Not Found”).
RFC 9457 problem type URI. Optional; identifies the problem class.
Example generated
{ "allowed_actions": [ { "hint": "example", "href": "example", "operation_id": "example", "rel": "example" } ], "code": "example", "detail": "example", "instance": "example", "retry_after_seconds": 1, "status": 1, "title": "example", "type": "example"}Internal server error
Standard error response.
Wire shape is RFC 9457 Problem Details:
every error response includes title and status, and may include
detail, code, allowed_actions, retry_after_seconds, instance,
and type. The content type is rewritten to application/problem+json
by [problem_json_content_type].
object
Recovery actions the caller can take next.
Agent-actionable recovery hint attached to an error response.
object
Short, agent-readable hint (e.g. “Shorten ‘name’ to <= 200 chars.”).
Optional absolute or relative URL the caller may invoke directly.
OpenAPI operationId the caller should invoke to recover.
Link relation describing the action (e.g. retry, get-existing,
unarchive, retry-later).
Stable, machine-readable error code (snake_case).
Human-readable explanation specific to this occurrence.
Request URI for this occurrence.
Seconds the caller should wait before retrying (429 / transient 503).
HTTP status code; mirrors the response status line.
Short, human-readable summary of the problem (e.g. “Not Found”).
RFC 9457 problem type URI. Optional; identifies the problem class.
Example generated
{ "allowed_actions": [ { "hint": "example", "href": "example", "operation_id": "example", "rel": "example" } ], "code": "example", "detail": "example", "instance": "example", "retry_after_seconds": 1, "status": 1, "title": "example", "type": "example"}