Harness

Connect Harness so agents can check delivery health, diagnose failed executions, review cloud cost data, and edit resources through your Approvals

Connect a Harness account to let CloudThinker agents inventory your pipelines, services, and environments, find failed or stuck executions, read failed-step logs, and review Cloud Cost Management data. The connection signs in with one Harness API key, either a personal access token (PAT) or a service account token (SAT).

Prerequisites

• A Harness account with the organizations, projects, and cost data you want agents to read.
• Permission to create a service account and assign role bindings. For a quick personal test, your own API key works instead.
• The identifiers (not display names) of any default organization or project you want to set.
• The Admin role in your CloudThinker workspace, which can add and edit connections. See Roles.

Setup

1. Create a service account

   In Harness, open Account Settings → Access Control → Service Accounts and create one named cloudthinker. Then add role bindings for read-only access:

   Role	Resource group	Why
   Account Viewer	All Resources Including Child Scopes	Read organizations, projects, pipelines, and executions
   CCM Viewer	All Resources Including Child Scopes	Read Cloud Cost Management data. Skip it if you don’t use CCM.

   An account-level service account covers both project delivery data and account-level cost data.

2. Generate a token

   Open the service account, select API Keys → API Key, and save a new key. Under that key, select Token, set an expiration date, and click Generate Token.

   Copy the token right away. It starts with sat., and Harness shows it once. A personal key from your profile’s My API Keys gives a pat. token the same way.

3. Add the connection in CloudThinker

   In the sidebar, click More → Workspace settings → Connections, stay on the Builtin Connections tab, and select Harness. Fill in:

   • API key: the token you generated
   • Harness URL: keep https://app.harness.io unless you use another cluster or a self-managed install. To find yours, sign in to Harness and copy the scheme and host from the browser address bar, for example https://<your-host>.
   • Default organization and Default project: optional. Set both or leave both blank.

   Click Connect.

   Success state: Harness shows Connected in the Connections list. That means CloudThinker loaded the Harness tools. Run the verify prompt to confirm the token can read your projects.

Harness shows a generated token only once. If you lose it, generate a new token on the same key and update the connection.

Connection details

Field	Description	Default
API key	PAT or SAT, in the form pat.<accountId>.<tokenId>.<secret> or sat.<accountId>.<tokenId>.<secret>. CloudThinker reads the account from the token, so there’s no account field.	none
Harness URL	Base URL. Change it only for a non-default cluster or a self-managed install.	https://app.harness.io
Default organization	Organization identifier added to every scoped request. Leave blank to let the agent pick per question.	blank
Default project	Project identifier. Only used together with Default organization, so set both.	blank

Copy identifiers exactly as they appear in the resource’s settings in Harness. A display name like “Payments Team” won’t match.

Required permissions

The token inherits the permissions of its service account or user. Grant view access to everything agents should inspect:

Access	Enables
Organization and project view	Discovery across your Harness hierarchy
Pipeline, service, environment, and execution view	Inventory, delivery health, and failure diagnosis
Cloud Cost Management view	Spend, recommendations, anomalies, and budgets
Create, edit, or delete on chosen resource groups, for example a custom role with pipeline create and edit, bound to a resource group that holds only the target project	Resource changes through CloudThinker, under your Approvals

Start with view access only. Add create, edit, or delete permissions for specific resource groups when you want agents to propose changes there.

Agent capabilities

Capability	What agents can do	Approval
Discovery	List organizations, projects, pipelines, services, environments, connectors, and triggers	No
Delivery health	Summarize a project’s recent executions and find failed or stuck runs	No
Failure diagnosis	Read an execution’s failure details and failed-step logs	No
Cloud costs	Review account spend, recommendations, anomalies, and budgets	No
Resource changes	Create, update, or delete a Harness resource, such as a pipeline definition	Through Approvals

Every create, update, or delete goes through Approvals.

Every change an agent makes goes through your workspace’s Approvals first. On the default Auto · Rules + AI · Ask me mode, AI judgment can let a safe change run without asking — and an Allow Rule can too, once CloudThinker turns on Rule enforcement for your workspace. Choose Manual to approve every change yourself.

There’s no Allow writes switch on this connection, so to keep it read-only, grant the token view roles only. Agents can’t run, retry, or interrupt a pipeline execution, toggle a feature flag, sync a GitOps application, or approve a Harness approval step. Those controls aren’t part of this connection.

Verify the connection

List my Harness organizations and projects, then summarize delivery health for one project

Expect your organization and project identifiers and a short health summary of recent executions. A 403 on one project means the token’s role bindings don’t cover it.

Example prompts

Show failed and stuck Harness executions in project payments_prod this week
Diagnose the latest failed Harness execution and name the step that broke
Rank Harness Cloud Cost Management recommendations by monthly savings

Troubleshooting

Requests return 401 Unauthorized

The token is wrong, expired, or revoked. Generate a new token, edit the connection, and paste it into API key.

Requests return 403 or not authorized

The service account or user has no role binding for that scope. Check its roles and resource groups in Harness and grant the missing view permission.

A request says project scope is required

The resource needs both an organization and a project identifier. Set Default organization and Default project, or ask the agent to list your organizations and projects first, then repeat the request with the identifiers.

An organization or project is not found

You used a display name instead of an identifier. Copy the identifier from the resource’s settings in Harness.

The agent won't run or retry a pipeline

That’s by design. Run, retry, or interrupt the pipeline in Harness. Agents can still inspect the execution and diagnose why it failed.

Security

• Least privilege — grant only the permissions the agents need for your use case; start read-only and widen later.
• Read-only by default — use read-only credentials unless you want agents to make changes through this connection.
• Rotate credentials — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
• Revoke on offboarding — remove the credential at the provider when you delete a connection or a teammate leaves.

• Service account over personal key: the connection keeps working when a person’s access changes or they leave.
• Expiring token: set an expiration date on the token and replace it before it lapses.

Related

CircleCI Connection

Check pipeline status and analyze failed workflows.

Approvals

Control which Harness changes wait for a person.