Opens the takeover holder’s live desktop. This is the computer
stream (see computerStream for the fuse-vnc/1 handshake; the
stream is raw RFB) with a recording on it. While the takeover is
held this is the only desktop stream the environment serves: the
plain computer stream and the agent’s computer actions answer
423. The Go SDK (Environments.TakeoverDesktop) and the CLI
(fuse hitl takeover --via desktop) speak it.
It needs hitl:takeover, and the caller must be the takeover’s
holder (the master token skips the holder check). Start the
takeover first with POST /v1/environments/{vmId}?action=takeover
and viadesktop; a human claiming an agent’s pending request
keeps the via the agent asked for.
Recorded. The session is kept as an input-action log read
off the viewer’s half of the stream (each pointer button change
with its coordinates, named keys and chords such as Return or
ctrl+c, a count of printable keys typed but never the keys
themselves, and the byte size of each clipboard paste but never
its text) plus a screenshot at the start and every 10 seconds.
When the stream closes the recording is sealed with
TOKEN_ENCRYPTION_KEY (stored unencrypted, with a warning, when
the orchestrator has none) and linked from a takeover_session
audit row by recording_id. Screenshots stop at 32 MiB and the
log at 50,000 entries, and the recording is marked truncated;
the view keeps working.
GET/v1/interventions/{interventionId}/desktop
Authorization
AuthorizationBearer token · headerrequired
`Authorization: Bearer <token>` — either the static master token
(`ORCH_AUTH_TOKEN`) or a revocable API key issued via
/v1/api-keys (API keys require Postgres; without a database only
the master token is accepted). Master-only surfaces (exec,
attach, API key management) refuse API keys with 403. An expired
key is refused with 401 like an unknown one.
A key minted with `scopes` reaches only the hitl routes
(`/v1/interventions`, `/v1/hitl/*`, and POST /v1/api-keys to mint
a narrower key). Any other route is 403 code `forbidden`, reason
`env_scope`, except an `/v1/environments/{vmId}` route for an
environment the key does not cover, which is 404 so the key
cannot probe which environments exist.
**Authentication can be disabled entirely.** When neither
`ORCH_AUTH_TOKEN` nor an API key store (`DATABASE_URL`) is
configured — the default local-development posture — the bearer
middleware becomes a pass-through: every operation this document
marks as secured is reachable with no credentials, requests carry
no principal, and master-only surfaces therefore admit everyone.
Never run that configuration on a reachable network; set
`ORCH_REQUIRE_AUTH=true` to make the orchestrator refuse to start
without a master token.
or
fuse_sessionAPI key · cookierequired
HttpOnly session cookie set by POST /login for browser callers.
Consulted only when no Authorization header is present.
Path parameters
interventionIdstringrequired
A held takeover started with `via` `desktop`.
Header parameters
Fuse-Actorstring
The person behind this request, as an opaque id (`user_42`,
`alice@corp.com`, `slack:U0123`). Fuse records it on hitl
interventions and the audit log and never checks it. Accepted on
every authenticated route; it matters wherever an actor is
recorded (raising, deciding, minting). At most 128 bytes, no
control characters; a malformed value is 400.
How the recorded actor is resolved:
- key pinned to an actor: that actor (`source: pinned`). A
different `Fuse-Actor` is 403 `forbidden`, reason
`actor_mismatch`.
- key with `hitl:act-as`: the header value (`source: asserted`,
with the asserting key's id), else `key:<key_id>`.
- any other key: `key:<key_id>` named after the key's label
(`source: key`). Sending the header is 403 `forbidden`, reason
`actor_not_allowed`, rather than silently dropped.
- master token: the header value (`source: asserted`), else
`master` (`source: key`).
An asserted actor is only as true as the key holder's own auth.
max length 128
Fuse-Actor-Namestring
Optional display name for `Fuse-Actor`, at most 256 bytes. Sending
it without `Fuse-Actor` is 400.
max length 256
Responses
101Upgrade accepted. The connection leaves HTTP and carries raw
RFB bytes in both directions until either end closes it.
400No `Upgrade: fuse-vnc/1`, the intervention is not a takeover,
or the takeover is not via `desktop`.
errorobjectrequired
Show propertiesHide properties
codestringrequired
Stable machine-readable code. `route_not_found` (404)
means the URL matches no route this server exposes —
usually a wrong host, port, or path prefix — as opposed
to `not_found`, where the route exists but the resource
does not. `forbidden` is emitted by CIDR-allowlist
rejections and by hitl access checks, which set
`details.reason` (see the Forbidden response);
master-only refusals (exec, attach, listing and revoking
API keys) return 403 with code `unauthorized`.
Optional stable, non-sensitive metadata (e.g. ids,
counts). Omitted when empty. A 403 `forbidden` from a
hitl access check carries `reason` (`missing_scope`,
`env_scope`, `self_approval`, `actor_required`,
`actor_mismatch`, `actor_not_allowed`,
`mint_escalation`, `hitl_denied`), plus `scope` for
`missing_scope`, and `gate` and `intervention_id` for
`hitl_denied`. A 423 `locked` carries `intervention_id`
and `kind` (`takeover` or `stall`).
403The key lacks `hitl:takeover` (`details.reason`
`missing_scope`), or the caller is not the takeover's holder
(code `forbidden`, no reason).
errorobjectrequired
Show propertiesHide properties
codestringrequired
Stable machine-readable code. `route_not_found` (404)
means the URL matches no route this server exposes —
usually a wrong host, port, or path prefix — as opposed
to `not_found`, where the route exists but the resource
does not. `forbidden` is emitted by CIDR-allowlist
rejections and by hitl access checks, which set
`details.reason` (see the Forbidden response);
master-only refusals (exec, attach, listing and revoking
API keys) return 403 with code `unauthorized`.
Optional stable, non-sensitive metadata (e.g. ids,
counts). Omitted when empty. A 403 `forbidden` from a
hitl access check carries `reason` (`missing_scope`,
`env_scope`, `self_approval`, `actor_required`,
`actor_mismatch`, `actor_not_allowed`,
`mint_escalation`, `hitl_denied`), plus `scope` for
`missing_scope`, and `gate` and `intervention_id` for
`hitl_denied`. A 423 `locked` carries `intervention_id`
and `kind` (`takeover` or `stall`).
404Resource does not exist. Note the distinct code
`route_not_found`, returned when the URL matches no registered
route at all (wrong host, port, or path prefix) rather than a
known route with a missing resource.
errorobjectrequired
Show propertiesHide properties
codestringrequired
Stable machine-readable code. `route_not_found` (404)
means the URL matches no route this server exposes —
usually a wrong host, port, or path prefix — as opposed
to `not_found`, where the route exists but the resource
does not. `forbidden` is emitted by CIDR-allowlist
rejections and by hitl access checks, which set
`details.reason` (see the Forbidden response);
master-only refusals (exec, attach, listing and revoking
API keys) return 403 with code `unauthorized`.
Optional stable, non-sensitive metadata (e.g. ids,
counts). Omitted when empty. A 403 `forbidden` from a
hitl access check carries `reason` (`missing_scope`,
`env_scope`, `self_approval`, `actor_required`,
`actor_mismatch`, `actor_not_allowed`,
`mint_escalation`, `hitl_denied`), plus `scope` for
`missing_scope`, and `gate` and `intervention_id` for
`hitl_denied`. A 423 `locked` carries `intervention_id`
and `kind` (`takeover` or `stall`).
409The takeover is not held (never started, or already resolved).
errorobjectrequired
Show propertiesHide properties
codestringrequired
Stable machine-readable code. `route_not_found` (404)
means the URL matches no route this server exposes —
usually a wrong host, port, or path prefix — as opposed
to `not_found`, where the route exists but the resource
does not. `forbidden` is emitted by CIDR-allowlist
rejections and by hitl access checks, which set
`details.reason` (see the Forbidden response);
master-only refusals (exec, attach, listing and revoking
API keys) return 403 with code `unauthorized`.
Optional stable, non-sensitive metadata (e.g. ids,
counts). Omitted when empty. A 403 `forbidden` from a
hitl access check carries `reason` (`missing_scope`,
`env_scope`, `self_approval`, `actor_required`,
`actor_mismatch`, `actor_not_allowed`,
`mint_escalation`, `hitl_denied`), plus `scope` for
`missing_scope`, and `gate` and `intervention_id` for
`hitl_denied`. A 423 `locked` carries `intervention_id`
and `kind` (`takeover` or `stall`).
500Unexpected server error.
errorobjectrequired
Show propertiesHide properties
codestringrequired
Stable machine-readable code. `route_not_found` (404)
means the URL matches no route this server exposes —
usually a wrong host, port, or path prefix — as opposed
to `not_found`, where the route exists but the resource
does not. `forbidden` is emitted by CIDR-allowlist
rejections and by hitl access checks, which set
`details.reason` (see the Forbidden response);
master-only refusals (exec, attach, listing and revoking
API keys) return 403 with code `unauthorized`.
Optional stable, non-sensitive metadata (e.g. ids,
counts). Omitted when empty. A 403 `forbidden` from a
hitl access check carries `reason` (`missing_scope`,
`env_scope`, `self_approval`, `actor_required`,
`actor_mismatch`, `actor_not_allowed`,
`mint_escalation`, `hitl_denied`), plus `scope` for
`missing_scope`, and `gate` and `intervention_id` for
`hitl_denied`. A 423 `locked` carries `intervention_id`
and `kind` (`takeover` or `stall`).
501The operation is not supported by the backing provider (e.g. an
exec or attach against an environment with no real guest).
errorobjectrequired
Show propertiesHide properties
codestringrequired
Stable machine-readable code. `route_not_found` (404)
means the URL matches no route this server exposes —
usually a wrong host, port, or path prefix — as opposed
to `not_found`, where the route exists but the resource
does not. `forbidden` is emitted by CIDR-allowlist
rejections and by hitl access checks, which set
`details.reason` (see the Forbidden response);
master-only refusals (exec, attach, listing and revoking
API keys) return 403 with code `unauthorized`.
Optional stable, non-sensitive metadata (e.g. ids,
counts). Omitted when empty. A 403 `forbidden` from a
hitl access check carries `reason` (`missing_scope`,
`env_scope`, `self_approval`, `actor_required`,
`actor_mismatch`, `actor_not_allowed`,
`mint_escalation`, `hitl_denied`), plus `scope` for
`missing_scope`, and `gate` and `intervention_id` for
`hitl_denied`. A 423 `locked` carries `intervention_id`
and `kind` (`takeover` or `stall`).
503The guest has nothing to stream (not a desktop image, or the vnc unit is down).
errorobjectrequired
Show propertiesHide properties
codestringrequired
Stable machine-readable code. `route_not_found` (404)
means the URL matches no route this server exposes —
usually a wrong host, port, or path prefix — as opposed
to `not_found`, where the route exists but the resource
does not. `forbidden` is emitted by CIDR-allowlist
rejections and by hitl access checks, which set
`details.reason` (see the Forbidden response);
master-only refusals (exec, attach, listing and revoking
API keys) return 403 with code `unauthorized`.
Optional stable, non-sensitive metadata (e.g. ids,
counts). Omitted when empty. A 403 `forbidden` from a
hitl access check carries `reason` (`missing_scope`,
`env_scope`, `self_approval`, `actor_required`,
`actor_mismatch`, `actor_not_allowed`,
`mint_escalation`, `hitl_denied`), plus `scope` for
`missing_scope`, and `gate` and `intervention_id` for
`hitl_denied`. A 423 `locked` carries `intervention_id`
and `kind` (`takeover` or `stall`).
Request
curl -X GET "http://localhost:8080/v1/interventions/string/desktop" \ -H "Authorization: Bearer YOUR_TOKEN"