Upgrades the connection to fuse-vnc/1 and relays a raw RFB (VNC)
byte stream between the caller and the vnc server inside the guest,
both directions, until either end closes. This is the live view of
the desktop, and — because RFB carries input — human takeover of a
session an agent is driving.
Handshake. The request must carry Upgrade: fuse-vnc/1 (and,
per HTTP, Connection: Upgrade). On success the server answers
101 Switching Protocols; the first byte after the response head
is the first byte of the vnc server’s RFB greeting. There is no
frame protocol on top: the stream is RFB verbatim, so any VNC
client can speak it once the upgrade and bearer auth are handled
(the fuse desktop CLI command wraps this in a browser viewer).
The vnc server inside the guest binds localhost only; this authed
route is the only way to reach it. Unlike exec and attach this
accepts API keys, for the same reason the computer action route
does: the stream views and drives the same display an API key can
already drive click by click.
An open stream counts as environment activity for as long as it is
open, so a watched-but-idle desktop is not reaped.
While a human holds a takeover (or an ask stall waits to be
acked) the stream answers 423 locked, like the agent’s computer
actions: input sent on it would get past the lock. A takeover
holder’s view is GET /v1/interventions/{interventionId}/desktop.
GET/v1/environments/{vmId}/computer/stream
Authorization
AuthorizationBearer token · headerrequired
`Authorization: Bearer <token>` — either the static master token
(`ORCH_AUTH_TOKEN`) or a revocable API key issued via
/v1/api-keys (API keys require Postgres; without a database only
the master token is accepted). Master-only surfaces (exec,
attach, API key management) refuse API keys with 403. An expired
key is refused with 401 like an unknown one.
A key minted with `scopes` reaches only the hitl routes
(`/v1/interventions`, `/v1/hitl/*`, and POST /v1/api-keys to mint
a narrower key). Any other route is 403 code `forbidden`, reason
`env_scope`, except an `/v1/environments/{vmId}` route for an
environment the key does not cover, which is 404 so the key
cannot probe which environments exist.
**Authentication can be disabled entirely.** When neither
`ORCH_AUTH_TOKEN` nor an API key store (`DATABASE_URL`) is
configured — the default local-development posture — the bearer
middleware becomes a pass-through: every operation this document
marks as secured is reachable with no credentials, requests carry
no principal, and master-only surfaces therefore admit everyone.
Never run that configuration on a reachable network; set
`ORCH_REQUIRE_AUTH=true` to make the orchestrator refuse to start
without a master token.
or
fuse_sessionAPI key · cookierequired
HttpOnly session cookie set by POST /login for browser callers.
Consulted only when no Authorization header is present.
Path parameters
vmIdstringrequired
VM identifier assigned by the orchestrator.
Responses
101Upgrade accepted. The connection leaves HTTP and carries raw
RFB bytes in both directions until either end closes it.
400The request did not carry `Upgrade: fuse-vnc/1`.
errorobjectrequired
Show propertiesHide properties
codestringrequired
Stable machine-readable code. `route_not_found` (404)
means the URL matches no route this server exposes —
usually a wrong host, port, or path prefix — as opposed
to `not_found`, where the route exists but the resource
does not. `forbidden` is emitted by CIDR-allowlist
rejections and by hitl access checks, which set
`details.reason` (see the Forbidden response);
master-only refusals (exec, attach, listing and revoking
API keys) return 403 with code `unauthorized`.
Optional stable, non-sensitive metadata (e.g. ids,
counts). Omitted when empty. A 403 `forbidden` from a
hitl access check carries `reason` (`missing_scope`,
`env_scope`, `self_approval`, `actor_required`,
`actor_mismatch`, `actor_not_allowed`,
`mint_escalation`, `hitl_denied`), plus `scope` for
`missing_scope`, and `gate` and `intervention_id` for
`hitl_denied`. A 423 `locked` carries `intervention_id`
and `kind` (`takeover` or `stall`).
404Resource does not exist. Note the distinct code
`route_not_found`, returned when the URL matches no registered
route at all (wrong host, port, or path prefix) rather than a
known route with a missing resource.
errorobjectrequired
Show propertiesHide properties
codestringrequired
Stable machine-readable code. `route_not_found` (404)
means the URL matches no route this server exposes —
usually a wrong host, port, or path prefix — as opposed
to `not_found`, where the route exists but the resource
does not. `forbidden` is emitted by CIDR-allowlist
rejections and by hitl access checks, which set
`details.reason` (see the Forbidden response);
master-only refusals (exec, attach, listing and revoking
API keys) return 403 with code `unauthorized`.
Optional stable, non-sensitive metadata (e.g. ids,
counts). Omitted when empty. A 403 `forbidden` from a
hitl access check carries `reason` (`missing_scope`,
`env_scope`, `self_approval`, `actor_required`,
`actor_mismatch`, `actor_not_allowed`,
`mint_escalation`, `hitl_denied`), plus `scope` for
`missing_scope`, and `gate` and `intervention_id` for
`hitl_denied`. A 423 `locked` carries `intervention_id`
and `kind` (`takeover` or `stall`).
409The environment is not running.
errorobjectrequired
Show propertiesHide properties
codestringrequired
Stable machine-readable code. `route_not_found` (404)
means the URL matches no route this server exposes —
usually a wrong host, port, or path prefix — as opposed
to `not_found`, where the route exists but the resource
does not. `forbidden` is emitted by CIDR-allowlist
rejections and by hitl access checks, which set
`details.reason` (see the Forbidden response);
master-only refusals (exec, attach, listing and revoking
API keys) return 403 with code `unauthorized`.
Optional stable, non-sensitive metadata (e.g. ids,
counts). Omitted when empty. A 403 `forbidden` from a
hitl access check carries `reason` (`missing_scope`,
`env_scope`, `self_approval`, `actor_required`,
`actor_mismatch`, `actor_not_allowed`,
`mint_escalation`, `hitl_denied`), plus `scope` for
`missing_scope`, and `gate` and `intervention_id` for
`hitl_denied`. A 423 `locked` carries `intervention_id`
and `kind` (`takeover` or `stall`).
423A human holds the environment, so the agent's call was refused
before it reached the guest (code `locked`). Either a takeover is
held (`details.kind` `takeover`), or a stall in `ask` mode is
waiting for a human to ack it (`details.kind` `stall`).
`details.intervention_id` names the intervention. Long-poll it
with GET /v1/interventions/{interventionId}?wait= until it is no
longer `pending`, then send the call again; a new 423 means wait
again. The lock never outlives the intervention's deadline, so
this always ends. The SDKs wait and retry by default, and raise
a `LockedError` carrying the intervention id and kind when told
not to wait.
errorobjectrequired
Show propertiesHide properties
codestringrequired
Stable machine-readable code. `route_not_found` (404)
means the URL matches no route this server exposes —
usually a wrong host, port, or path prefix — as opposed
to `not_found`, where the route exists but the resource
does not. `forbidden` is emitted by CIDR-allowlist
rejections and by hitl access checks, which set
`details.reason` (see the Forbidden response);
master-only refusals (exec, attach, listing and revoking
API keys) return 403 with code `unauthorized`.
Optional stable, non-sensitive metadata (e.g. ids,
counts). Omitted when empty. A 403 `forbidden` from a
hitl access check carries `reason` (`missing_scope`,
`env_scope`, `self_approval`, `actor_required`,
`actor_mismatch`, `actor_not_allowed`,
`mint_escalation`, `hitl_denied`), plus `scope` for
`missing_scope`, and `gate` and `intervention_id` for
`hitl_denied`. A 423 `locked` carries `intervention_id`
and `kind` (`takeover` or `stall`).
500The guest stream could not be opened, or the connection was
not hijackable. Raised before the upgrade; once the socket is
hijacked there is no ResponseWriter left to report through.
errorobjectrequired
Show propertiesHide properties
codestringrequired
Stable machine-readable code. `route_not_found` (404)
means the URL matches no route this server exposes —
usually a wrong host, port, or path prefix — as opposed
to `not_found`, where the route exists but the resource
does not. `forbidden` is emitted by CIDR-allowlist
rejections and by hitl access checks, which set
`details.reason` (see the Forbidden response);
master-only refusals (exec, attach, listing and revoking
API keys) return 403 with code `unauthorized`.
Optional stable, non-sensitive metadata (e.g. ids,
counts). Omitted when empty. A 403 `forbidden` from a
hitl access check carries `reason` (`missing_scope`,
`env_scope`, `self_approval`, `actor_required`,
`actor_mismatch`, `actor_not_allowed`,
`mint_escalation`, `hitl_denied`), plus `scope` for
`missing_scope`, and `gate` and `intervention_id` for
`hitl_denied`. A 423 `locked` carries `intervention_id`
and `kind` (`takeover` or `stall`).
501The operation is not supported by the backing provider (e.g. an
exec or attach against an environment with no real guest).
errorobjectrequired
Show propertiesHide properties
codestringrequired
Stable machine-readable code. `route_not_found` (404)
means the URL matches no route this server exposes —
usually a wrong host, port, or path prefix — as opposed
to `not_found`, where the route exists but the resource
does not. `forbidden` is emitted by CIDR-allowlist
rejections and by hitl access checks, which set
`details.reason` (see the Forbidden response);
master-only refusals (exec, attach, listing and revoking
API keys) return 403 with code `unauthorized`.
Optional stable, non-sensitive metadata (e.g. ids,
counts). Omitted when empty. A 403 `forbidden` from a
hitl access check carries `reason` (`missing_scope`,
`env_scope`, `self_approval`, `actor_required`,
`actor_mismatch`, `actor_not_allowed`,
`mint_escalation`, `hitl_denied`), plus `scope` for
`missing_scope`, and `gate` and `intervention_id` for
`hitl_denied`. A 423 `locked` carries `intervention_id`
and `kind` (`takeover` or `stall`).
503The guest is running but has nothing to stream: not a desktop
image, the display is still starting, or the vnc unit is down.
errorobjectrequired
Show propertiesHide properties
codestringrequired
Stable machine-readable code. `route_not_found` (404)
means the URL matches no route this server exposes —
usually a wrong host, port, or path prefix — as opposed
to `not_found`, where the route exists but the resource
does not. `forbidden` is emitted by CIDR-allowlist
rejections and by hitl access checks, which set
`details.reason` (see the Forbidden response);
master-only refusals (exec, attach, listing and revoking
API keys) return 403 with code `unauthorized`.
Optional stable, non-sensitive metadata (e.g. ids,
counts). Omitted when empty. A 403 `forbidden` from a
hitl access check carries `reason` (`missing_scope`,
`env_scope`, `self_approval`, `actor_required`,
`actor_mismatch`, `actor_not_allowed`,
`mint_escalation`, `hitl_denied`), plus `scope` for
`missing_scope`, and `gate` and `intervention_id` for
`hitl_denied`. A 423 `locked` carries `intervention_id`
and `kind` (`takeover` or `stall`).
Request
curl -X GET "http://localhost:8080/v1/environments/string/computer/stream" \ -H "Authorization: Bearer YOUR_TOKEN"