Harthelm Docs
REST APIWorkspaces

Agent channel (WebSocket)

A WebSocket upgrade (subprotocol `harthelm.agent.v1`) that core relays to the workspace agent: shared terminals, status, git head and the read-only file API. Core checks `workspace.view` and passes the agent a signed claim with the caller's permissions; the agent refuses terminal input without `workspace.exec`. Frames are `ChannelMessage` JSON text frames and binary terminal frames.

Generated from openapi/harthelm.yaml at v1.5.0
GET
/workspaces/{ws}/agent

Authorization

cookie__Host-harthelm_session<token>

Browser session of the UI (12 h idle, 7 days absolute). State-changing requests also need the header Harthelm-CSRF: 1 and a matching Origin.

Path Parameters

ws*integer

Numeric resource id.

Formatint64
Range1 <= value

Response Body

Switching to the WebSocket protocol.

curl -X GET 'https://console.example.com/api/v1/workspaces/1/agent'
Empty

Set a secret

Stores a new revision of the key, encrypted with the vault's data key. Services that reference the key get the value at their next Sync. Needs `landscape.manage` on the workspace that uses the vault.

Mint an IDE entry URL

Returns the URL the shell sets as the code-server iframe `src`: the IDE host's `/__harthelm/enter?t=<token>` with a single-use token (60 s, audience = IDE host). Needs `workspace.code`. The router turns the token into the workspace cookie.