# Ωmegas docs > Documentation for Continuity, Handoff, and Operator: tools for agents that do real work, with the record to prove it. ## Docs - [Overview](https://docs.omegas.dev/index.md): Start with the Omega product that matches the work your agent needs to do. - [Continuity](https://docs.omegas.dev/continuity/overview.md): Move a Claude Code or Codex setup without moving a secret. Open source, local-first, MIT. - [Continuity quickstart](https://docs.omegas.dev/continuity/quickstart.md): Scan, explain, export and re-apply an agent setup in five commands. Everything on this page runs locally and contacts nothing. - [Continuity CLI reference](https://docs.omegas.dev/continuity/cli.md): Every subcommand, flag and exit code of the @omegas/continuity command line. - [Continuity security model](https://docs.omegas.dev/continuity/security.md): How Continuity reads hostile filesystems, redacts credentials in five layers, and imports bundles as untrusted input. - [Handoff](https://docs.omegas.dev/handoff/overview.md): Ask a person once, receive typed data, and redeem one effect with a durable receipt. - [Handoff quickstart](https://docs.omegas.dev/handoff/quickstart.md): Probe the live service, run the reference server and its conformance suite locally, and make your first request from Python or TypeScript. - [The Handoff protocol](https://docs.omegas.dev/handoff/protocol.md): A tour of the normative v0.1 specification: the object model, the state machines, receipts, authorizations, and the signing scheme. - [Handoff SDKs](https://docs.omegas.dev/handoff/sdks.md): The Python and TypeScript clients, their honest installation state, and the patterns they make easy. - [Handoff conformance](https://docs.omegas.dev/handoff/conformance.md): How to run the Handoff compatibility suite against your own deployment. - [Operator](https://docs.omegas.dev/operator/overview.md): Cloud browser devices driven by tasks, with live view, human takeover, webhooks, and an audit trail. In closed preview; access is granted per organization. - [Operator: authentication and scopes](https://docs.omegas.dev/operator/authentication.md): One credential, a scope table with no surprises left in it, and the credential-custody rules that keep a key out of your logs. - [Operator: tasks and event streams](https://docs.omegas.dev/operator/tasks.md): Submitting a task, reading it back at the right route, streaming its events past the 300-second cap, and what needs_human means. - [Operator: live view and takeover](https://docs.omegas.dev/operator/live-view.md): Watch sessions, control sessions, the takeover lease, and why read-only is genuinely read-only. - [Operator: webhooks](https://docs.omegas.dev/operator/webhooks.md): Verifying signed deliveries, answering duplicates correctly, and keeping your endpoint out of the auto-disable path. - [Operator: errors and conventions](https://docs.omegas.dev/operator/conventions.md): The error taxonomy and which codes are retryable, idempotency on the two routes that accept it, and cursor pagination. - [Operator: limits, stated plainly](https://docs.omegas.dev/operator/limits.md): Properties of what ships today, not a roadmap. Each limit is enforced or observable, and integrations should be designed against them. - [List audit](https://docs.omegas.dev/operator/api/endpoints/list-audit.md): The org's Operator audit trail, newest first. - [List devices](https://docs.omegas.dev/operator/api/endpoints/list-devices.md): List the caller org's devices, newest first, with keyset pagination and optional status/Space filters. An org-wide key may omit `space_id`; a Space-scoped key MUST name a Space it holds. - [Create device](https://docs.omegas.dev/operator/api/endpoints/create-device.md): Create + provision an Operator device. Runs the write gate (scope + entitlement), resolves the target Space (org-wide key: `space_id` required + Space check; Space-scoped key: its held Space), enforces the device-count and rolling-duration quotas, provisions the device sprite, and returns the active… - [Get device](https://docs.omegas.dev/operator/api/endpoints/get-device.md): Fetch one device by `dev_`. A foreign-org (or malformed) id is a 404, never a 403. - [Delete device](https://docs.omegas.dev/operator/api/endpoints/delete-device.md): Terminate a device (202): accrue final duration, destroy the sprite, mark `terminated`. A second delete of an already-terminated device is `410 device_terminated` (documented: delete reports the terminal state rather than silently no-oping). - [Create session](https://docs.omegas.dev/operator/api/endpoints/create-session.md): Mint a live-view session for a device (201). - [Sleep device](https://docs.omegas.dev/operator/api/endpoints/sleep-device.md): Sleep a device (202): accrue duration, suspend the sprite, mark `sleeping`. Idempotent. - [List device tasks](https://docs.omegas.dev/operator/api/endpoints/list-device-tasks.md): List one device's tasks, newest first, with keyset pagination. The device is resolved (and its Space checked) first, so a foreign-org device id is a 404 before any task is read. - [Submit task](https://docs.omegas.dev/operator/api/endpoints/submit-task.md): Submit a browser task to a device (202). Runs the write gate (scope + entitlement), loads the device org-scoped and checks its Space, requires the device be `active` (terminated → 410, otherwise → 409 `device_not_ready`), claims the device's single task slot (a held slot → 409 `device_busy`), and pe… - [Wake device](https://docs.omegas.dev/operator/api/endpoints/wake-device.md): Wake a device (202): re-provision/attach the sprite and mark `active`. Terminated → 410; the rolling-duration quota is enforced here too. - [Watch device](https://docs.omegas.dev/operator/api/endpoints/watch-device.md): `WS /v1/devices/{id}/watch` — upgrade, validate, then relay. The credential is offered as the `omega.token.` subprotocol, NEVER as a query parameter (see [`token_from_subprotocols`]). - [List escalations](https://docs.omegas.dev/operator/api/endpoints/list-escalations.md): The org's escalation attempts, newest first. - [Get escalation](https://docs.omegas.dev/operator/api/endpoints/get-escalation.md): One escalation attempt. - [Resolve escalation](https://docs.omegas.dev/operator/api/endpoints/resolve-escalation.md): The escalation destination's callback. Authenticated by the per-escalation bearer, not an API key. - [Get session](https://docs.omegas.dev/operator/api/endpoints/get-session.md): Read one session's state. Carries no token — a lost `session_token` cannot be recovered here. - [Revoke session](https://docs.omegas.dev/operator/api/endpoints/revoke-session.md): Revoke a session (204). The gateway re-checks liveness on every relayed message, so any socket the session holds dies at once rather than at its next reconnect. - [Release](https://docs.omegas.dev/operator/api/endpoints/release.md): RELEASE the device back to the agent (202): resume the sprite and un-park the task, then drop the hold. This is the EXIT from the `needs_human` wall a takeover parks on. - [Takeover](https://docs.omegas.dev/operator/api/endpoints/takeover.md): TAKE the device: pause the agent so a human can drive (200). - [Get task](https://docs.omegas.dev/operator/api/endpoints/get-task.md): Fetch one task by `task_`. A foreign-org (or malformed) id is a 404, never a 403. - [Cancel task](https://docs.omegas.dev/operator/api/endpoints/cancel-task.md): Request a task cancel (202): stamp the durable cancel flag; the worker that owns the sprite performs the sprite stop + terminal write + claim release + token revoke on its next pass. Loads the task org-scoped and checks its Space first. Idempotent — cancelling an already-terminal task replays its st… - [Task events](https://docs.omegas.dev/operator/api/endpoints/task-events.md): Stream a task's steps as Server-Sent Events, then a terminal `done` frame. Loads the task org-scoped and checks its Space, then emits `event: step` (data = the step payload) for each step with `seq > after_seq` in order, and `event: done` (data = the terminal Task) once the task finishes. Poll-based… - [Usage](https://docs.omegas.dev/operator/api/endpoints/usage.md): The caller org's Operator usage rows over the rolling 24h window (metered dimensions, priced where the rate card prices them). Reads only — no browser provider required. - [List endpoints](https://docs.omegas.dev/operator/api/endpoints/list-endpoints.md): List the org's webhook endpoints, newest first. - [Create endpoint](https://docs.omegas.dev/operator/api/endpoints/create-endpoint.md): Register a webhook endpoint (201). The response carries the signing secret ONCE. - [Get endpoint](https://docs.omegas.dev/operator/api/endpoints/get-endpoint.md): Fetch one endpoint. Carries no secret — a lost signing key cannot be recovered here. - [Delete endpoint](https://docs.omegas.dev/operator/api/endpoints/delete-endpoint.md): Delete an endpoint (204). Idempotent for a caller: a second delete of an id that is gone is the same 404 a foreign-org id gets, because by then the two are indistinguishable. - [Update endpoint](https://docs.omegas.dev/operator/api/endpoints/update-endpoint.md): Update an endpoint (200). Re-enabling clears the failure streak — the one path out of auto-disable. - [Whoami](https://docs.omegas.dev/operator/api/endpoints/whoami.md): Reflect the authenticated machine principal. Requires a valid `omg_…` API key; this is the end-to-end proof that [`ApiKeyPrincipal`] resolves, verifies, and scopes a key. ## OpenAPI Specs - [operator](https://docs.omegas.dev/schemas/operator.json)